# Airlock IAM public WADL and SAML transform contracts
# Date: 2026-11-10

## WADL endpoints

GET `/auth/rest/public/application.wadl`
- requires a normal anonymous Airlock session/CSRF context to generate successfully
- returns HTTP 200, `application/vnd.sun.wadl+xml;charset=utf-8`, 3,992 bytes
- byte-identical SHA-256 across eight tenants: `b1fd152755091e76e53bf58099b12429c7fe700db85cfe7cbb67671793a53cbf`
- identifies `Jersey: 3.1.10 2025-01-07 18:56:07`
- reports internal resource base `https://svl-de-iamp616.balgroupit.com:4401/ext-login/rest/public/`

GET `/auth/rest/public/application.wadl?detail=true`
- returns the detailed 15,331-byte Jersey WADL
- SHA-256 `9340fdb0cb02c6608a4e9cdd468fce2eb4421a46a15210141919082a432ca355`
- adds Jersey OPTIONS resources plus the WADL self-description handlers

GET `/auth/rest/public/application.wadl/{externalGrammarPath}`
- registered as Jersey `getExternalGrammar`
- a controlled absent `schema.xsd` returns JSON:API 406, distinguishing this route from an arbitrary WADL-like 404 path

The simple and detailed definitions are retained in source set `engagement/p_bugbounty_ch_baloise_germany_1dfb7802/baloise-germany-airlock-public-wadl-20261110`.

## Routes described by the WADL

The simple definition lists seven public operations:

- POST `/auth/rest/public/password/policy/check`
- GET `/auth/rest/public/ui/static/configuration`
- GET `/auth/rest/public/maintenance-messages?filter={string}`
- POST `/auth/rest/public/baloise/saml2/transform`
- GET `/auth/rest/public/ui/languages`
- GET `/auth/rest/public/jwks`
- GET `/auth/rest/public/flow`

All except the Baloise SAML transform were already present in the canonical catalogue. The detailed WADL additionally describes GET `/application.wadl`, GET `/application.wadl/{path}` and OPTIONS dispatch.

## Baloise SAML transform

POST `/auth/rest/public/baloise/saml2/transform`
- method id: `transformToSsoTicket`
- request media type: `application/x-www-form-urlencoded`
- declared fields: `context`, `SAMLResponse`
- response media types: `application/vnd.api+json`, `application/json;qs=0.9`
- GET returns 405; OPTIONS returns a route-specific WADL fragment and `Allow: POST,OPTIONS`
- no SAML response was submitted

## Eight-tenant parity

All eight tenants return the same simple and detailed WADL bytes, the same internal base and the same SAML-transform method contract.

host | WADL GET | detail GET | grammar GET | transform GET/OPTIONS
--- | --- | --- | --- | ---
infoportal.baloise.de | `01a1c476-bc1f-71c1-bd01-1965dbdb7edc` | `01a1c476-bd28-72a5-8f36-9d34c971409b` | `01a1c476-c586-73b0-835e-217751055837` | `01a1c476-cde1-72bb-a581-78b08685318d`, `01a1c476-ce74-7694-b85a-b0552858ee82`
maklerportal.baloise.de | `01a1c476-d1a2-70d5-af22-7294aaac2150` | `01a1c476-d233-712b-a8ef-0251b5e1debd` | `01a1c476-da8d-716f-adc2-5f808c9fcfe4` | `01a1c476-e2e9-7506-b341-8c814426bd4c`, `01a1c476-e375-74b3-8058-6c4af30788ad`
si-portal.baloise.de | `01a1c476-e658-7004-877e-b9412f5a24ff` | `01a1c476-e6e5-74fc-9f5e-b04efee4924d` | `01a1c476-ef3f-7113-a337-9a9566a03c00` | `01a1c476-f798-7085-be10-55ad565d53b7`, `01a1c476-f826-7209-953c-c0fd85e2e374`
vertriebsservice.baloise.de | `01a1c476-fbdb-7450-b329-db7894a017d6` | `01a1c476-fc6d-740b-8cb9-b7b3cf558641` | `01a1c477-04c5-7186-a5ca-ca075d04cf2d` | `01a1c477-0d1f-764a-9e6b-ef2b65264388`, `01a1c477-0dab-7723-b6b5-6f297a8906c6`
zeus-portal.baloise.de | `01a1c477-1029-7115-872e-0a8ea7fd29eb` | `01a1c477-112a-7192-8092-576d76e03a21` | `01a1c477-1981-7457-ba27-b112e4b1c003` | `01a1c477-21d5-70d0-9157-2f2c671613a8`, `01a1c477-225e-74f9-8e8e-00d196466a13`
mein-portal.baloise.de | `01a1c477-26be-7521-933d-0a7579256ba6` | `01a1c477-27c5-73fa-9b82-0300fd1552af` | `01a1c477-3020-7085-97b8-631b14c33354` | `01a1c477-387d-7062-b4a1-4bcbb3ee6147`, `01a1c477-390a-703b-b376-74026f2a19a5`
mein-portal-registrierung.baloise.de | `01a1c477-3b8a-73ee-9871-cb22e273d76b` | `01a1c477-3c18-76ad-a1ca-498842656f24` | `01a1c477-4473-7042-afd9-fc1b0050bbe5` | `01a1c477-4ccf-7494-aee4-fe70aa217a70`, `01a1c477-4d5a-7146-80f8-e06910a0d9bf`
va.baloise.de | `01a1c477-521f-7295-b0f0-7a8ba95d37c4` | `01a1c477-5323-7475-992e-19eeb880cd70` | `01a1c477-5b7a-7382-8df7-c5e725b87944` | `01a1c477-63d2-769f-9d99-4ee65f5fd486`, `01a1c477-645d-7670-a712-a9b3a4d20f50`