generated: '2026-08-13'
method: probed
source: live GET of /.well-known/* on every apis.yml baseURL host, every OpenAPI servers[] host, and the docs/console hosts
note: >-
  Three real documents were served. Everything else 404d, EXCEPT developer.adobe.com,
  which answers HTTP 200 with the same 1.2MB HTML single-page-app shell for every
  /.well-known/* path probed. Those 200s are NOT documents and are recorded as
  soft-404 misses. mcp.adobeaemcloud.com likewise answers 200 with an HTML shell on
  /.well-known/oauth-protected-resource and is recorded as a miss for the same reason.
hosts:
- host: https://www.adobe.com
  documents:
  - path: /.well-known/security.txt
    status: 200
    content_type: text/plain; charset=UTF-8
    file: adobe-suite-security.txt
    document: true
    note: RFC 9116, PGP-signed. Expires 2027-07-30. Contact hackerone.com/adobe + psirt@adobe.com.
  - {path: /.well-known/openid-configuration, status: 404, document: false}
  - {path: /.well-known/oauth-authorization-server, status: 404, document: false}
  - {path: /.well-known/oauth-protected-resource, status: 404, document: false}
  - {path: /.well-known/api-catalog, status: 404, document: false}
  - {path: /.well-known/ai-plugin.json, status: 404, document: false}
- host: https://ims-na1.adobelogin.com
  note: Adobe Identity Management Services (IMS) — the OAuth/OIDC authorization server behind every Adobe API.
  documents:
  - path: /.well-known/openid-configuration
    status: 200
    content_type: application/json;charset=UTF-8
    file: adobe-suite-openid-configuration.json
    document: true
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json;charset=UTF-8
    file: adobe-suite-oauth-authorization-server.json
    document: true
    note: RFC 8414. Also advertises a dynamic client registration_endpoint.
  - {path: /.well-known/security.txt, status: 404, document: false}
  - {path: /.well-known/oauth-protected-resource, status: 404, document: false}
  - {path: /.well-known/api-catalog, status: 404, document: false}
  - {path: /.well-known/ai-plugin.json, status: 404, document: false}
- host: https://developer.adobe.com
  note: >-
    SPA catch-all. Every path below returned HTTP 200 with an identical 1,203,904-byte
    text/html shell. None is a document; all are recorded as misses.
  documents:
  - {path: /.well-known/security.txt, status: 200, content_type: text/html, document: false, soft_404: true}
  - {path: /.well-known/openid-configuration, status: 200, content_type: text/html, document: false, soft_404: true}
  - {path: /.well-known/oauth-authorization-server, status: 200, content_type: text/html, document: false, soft_404: true}
  - {path: /.well-known/oauth-protected-resource, status: 200, content_type: text/html, document: false, soft_404: true}
  - {path: /.well-known/api-catalog, status: 200, content_type: text/html, document: false, soft_404: true}
  - {path: /.well-known/ai-plugin.json, status: 200, content_type: text/html, document: false, soft_404: true}
- host: https://firefly-api.adobe.io
  documents:
  - {path: /.well-known/security.txt, status: 404, document: false}
  - {path: /.well-known/openid-configuration, status: 404, document: false}
  - {path: /.well-known/oauth-authorization-server, status: 404, document: false}
  - {path: /.well-known/oauth-protected-resource, status: 404, document: false}
  - {path: /.well-known/api-catalog, status: 404, document: false}
  - {path: /.well-known/ai-plugin.json, status: 404, document: false}
- host: https://pdf-services-ue1.adobe.io
  documents:
  - {path: /.well-known/security.txt, status: 404, document: false}
  - {path: /.well-known/openid-configuration, status: 404, document: false}
  - {path: /.well-known/oauth-authorization-server, status: 404, document: false}
  - {path: /.well-known/oauth-protected-resource, status: 404, document: false}
  - {path: /.well-known/api-catalog, status: 404, document: false}
  - {path: /.well-known/ai-plugin.json, status: 404, document: false}
- host: https://analytics.adobe.io
  documents:
  - {path: /.well-known/security.txt, status: 404, document: false}
  - {path: /.well-known/openid-configuration, status: 404, document: false}
  - {path: /.well-known/oauth-authorization-server, status: 404, document: false}
  - {path: /.well-known/oauth-protected-resource, status: 404, document: false}
  - {path: /.well-known/api-catalog, status: 404, document: false}
  - {path: /.well-known/ai-plugin.json, status: 404, document: false}
- host: https://platform.adobe.io
  documents:
  - {path: /.well-known/security.txt, status: 404, document: false}
  - {path: /.well-known/openid-configuration, status: 404, document: false}
  - {path: /.well-known/oauth-authorization-server, status: 404, document: false}
  - {path: /.well-known/oauth-protected-resource, status: 404, document: false}
  - {path: /.well-known/api-catalog, status: 404, document: false}
  - {path: /.well-known/ai-plugin.json, status: 404, document: false}
- host: https://cloudmanager.adobe.io
  documents:
  - {path: /.well-known/security.txt, status: 404, document: false}
  - {path: /.well-known/openid-configuration, status: 404, document: false}
  - {path: /.well-known/oauth-authorization-server, status: 404, document: false}
  - {path: /.well-known/oauth-protected-resource, status: 404, document: false}
  - {path: /.well-known/api-catalog, status: 404, document: false}
  - {path: /.well-known/ai-plugin.json, status: 404, document: false}
- host: https://mcp.adobeaemcloud.com
  note: MCP endpoint host. Returns 403 on most /.well-known paths; the one 200 is an HTML shell, not a document.
  documents:
  - {path: /.well-known/oauth-protected-resource, status: 200, content_type: text/html; charset=utf-8, document: false, soft_404: true}
  - {path: /.well-known/security.txt, status: 403, document: false}
  - {path: /.well-known/openid-configuration, status: 403, document: false}
  - {path: /.well-known/oauth-authorization-server, status: 403, document: false}
  - {path: /.well-known/api-catalog, status: 403, document: false}
  - {path: /.well-known/ai-plugin.json, status: 403, document: false}
- host: https://marketo-mcp.adobe.io
  note: MCP endpoint host. Auth-gated — every /.well-known path returns 401 Unauthorized.
  documents:
  - {path: /.well-known/security.txt, status: 401, document: false}
  - {path: /.well-known/openid-configuration, status: 401, document: false}
  - {path: /.well-known/oauth-authorization-server, status: 404, document: false}
  - {path: /.well-known/oauth-protected-resource, status: 401, document: false}
  - {path: /.well-known/api-catalog, status: 401, document: false}
  - {path: /.well-known/ai-plugin.json, status: 401, document: false}
summary:
  hosts_probed: 10
  paths_probed: 60
  documents_served: 3
  soft_404_200s: 7