diff --git a/dhscanner-kbapi.cabal b/dhscanner-kbapi.cabal
--- a/dhscanner-kbapi.cabal
+++ b/dhscanner-kbapi.cabal
@@ -28,7 +28,7 @@
     fundamental modifications to the structure or specification
     of code facts.
 
-version:            1.0.4
+version:            1.0.5
 license:            GPL-3.0-only
 license-file:       LICENSE
 author:             OrenGitHub
diff --git a/json-schema-creator/Main.hs b/json-schema-creator/Main.hs
--- a/json-schema-creator/Main.hs
+++ b/json-schema-creator/Main.hs
@@ -36,6 +36,7 @@
 instance ToSchema FoundUnauthenticatedHttpPostHandlerRequestObject
 instance ToSchema AuthenticatedHttpPostHandlerRequestObject
 instance ToSchema FoundAuthenticatedHttpPostHandlerRequestObject
+instance ToSchema FoundAuthenticatedHttpPostHandlerRequestObjectMatch
 instance ToSchema FoundHttpPostHandlerRequestObjectMatch
 
 instance ToSchema HttpGetHandlerRequestObject
diff --git a/src/Content.hs b/src/Content.hs
--- a/src/Content.hs
+++ b/src/Content.hs
@@ -64,7 +64,35 @@
    = FoundAuthenticatedHttpPostHandlerRequestObject
      {
          foundAuthenticatedHttpPostHandlerRequestObjectTotal :: Word,
-         foundAuthenticatedHttpPostHandlerRequestObjectMatches :: [ FoundHttpPostHandlerRequestObjectMatch ]
+         foundAuthenticatedHttpPostHandlerRequestObjectMatches :: [ FoundAuthenticatedHttpPostHandlerRequestObjectMatch ]
+     }
+     deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+
+-- | A match for an authenticated POST handler request object query.
+--
+-- Same shape as 'FoundHttpPostHandlerRequestObjectMatch', plus two
+-- structurally discovered pieces of metadata that identify /how/ the
+-- handler is authenticated :
+--
+-- * @foundAuthenticatedHttpPostHandlerAuthenticatingFunctionName@ \-
+--   the name of the callable that gates the handler ( e.g. tier-1
+--   catalog name @\'authenticateRequest\'@ ).
+--
+-- * @foundAuthenticatedHttpPostHandlerHeaderKeyName@ \-
+--   the string constant passed to @Request.headers.get( ... )@ inside
+--   that authenticating function ( e.g. @\'x-api-key\'@ ). Bound by
+--   the KB rule @utils_early_return_null_on_missing_request_header_value@.
+--   Intentionally /not/ named @ApiKey...@ \- other authentication styles
+--   ( bearer tokens, session cookies, custom headers ) all end up
+--   reading a header key too, so the field stays neutral.
+data FoundAuthenticatedHttpPostHandlerRequestObjectMatch
+   = FoundAuthenticatedHttpPostHandlerRequestObjectMatch
+     {
+         foundAuthenticatedHttpPostHandlerLocation :: Location,
+         foundAuthenticatedHttpPostHandlerRequestObjectLocation :: Location,
+         foundAuthenticatedHttpPostHandlerRequestObjectMatchUrl :: String,
+         foundAuthenticatedHttpPostHandlerAuthenticatingFunctionName :: String,
+         foundAuthenticatedHttpPostHandlerHeaderKeyName :: String
      }
      deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )