Omeka S organizes digital collections into items, item sets, media and public sites. A public exhibition site can legitimately show selected objects while the administrative item library contains unpublished records or richer metadata. Discovery should begin with that distinction because a page that looks like a museum catalog is not necessarily a complete view of the repository.
On 2026-10-31, a count-only ZoomEye query returned zero matches for app="Omeka S" and 175 for title="Omeka S". The queries used sub_type=all, page 1 and page size 1. The title query ran at 23:44:40 UTC and the application query at 23:44:39 UTC. A zero application count is a fingerprint gap, not proof that no installation exists. The 175 title matches also include project documentation and hosting pages, so each match needs confirmation.
A confirmed Omeka S site has at least three access contexts: public site visitors, authenticated users with site roles, and the global administration interface. The site may be public or private. Items and item sets have their own visibility and permissions, and the site's resource pool controls which records are available in its browse pages. Review all three contexts instead of assuming that a private site makes every item private.
The API is part of the publication surface. Omeka S API authentication uses a key identity and key credential, and the REST API can expose items, item sets, media and site permissions. Test anonymous access, an API key with read permission, and a key belonging to a user who is not a site manager. Verify that a key cannot discover a private item merely because the client knows its numeric identifier. Check pagination and error responses for clues about restricted resources.
Query-parameter authentication creates a logging and referrer concern. A key credential placed in a URL can appear in proxy logs, browser history, analytics and support tickets. Prefer a supported header-based or server-side integration where available, keep credentials out of page source, and apply a strict referrer policy. TLS is mandatory, but it does not remove keys from application logs.
The site configuration should name an owner for public sharing. A curator may create a public site for an exhibition, then leave the item set connected after the exhibition closes. Review site navigation, featured records, public item sets and the publication status of media files. Remove stale share links through the supported UI and verify that direct file URLs no longer resolve.
The 175 title matches are a small enough set for careful sampling by the owning organizations. For each confirmed installation, collect the base URL, site slug, API endpoint, public item count and authentication method. Compare the visible item set with the repository's publication register. If a record is visible without a corresponding public approval, the team has a concrete review item rather than a vague exposure claim.
Omeka S is designed to present collections in different contexts. That flexibility makes the boundary a configuration decision. ZoomEye provides a starting list of possible sites. The control is a tested mapping from public site to item set to media and API permissions.