Great stuff @mcheek !
Now we need someone to call all these APIs with API credentials to see which ones give an unauthorised response 
. I guess parameters, body and such can be ignored as the auth check will be first anyway right? As long as you pass the method, base url+endpoint and access token you should get a clear response? Maybe content-type checks will run first though.