# Aescape

> Aescape is a New York City lifestyle-robotics company, founded in 2017 by Eric Litman, that builds a fully automated AI-powered robotic massage platform. Its table maps over one million 3D data points of a person's body and drives heated robotic arms through massage techniques at a user-selected pressure, duration and focus area. Aescape publishes no public developer API. This file was generated by the API Evangelist enrichment pipeline from a live probe of Aescape's public surface on 2026-07-31; Aescape does not serve an llms.txt of its own.

## What Aescape publishes

Aescape is a consumer and hospitality hardware company, not an API provider. Sessions are booked through a mobile and web application; there is no public developer program, no published specification, and no client SDK.

- [Website](https://www.aescape.com/): company site
- [About](https://www.aescape.com/about): the "Intelligent Recovery" category, team and mission
- [Technology](https://www.aescape.com/technology): sensors, 3D body mapping and robotic arms
- [Sessions and pricing](https://www.aescape.com/sessions): 15, 30, 45 and 60 minute session types
- [Business and partners](https://www.aescape.com/business): hospitality, spa, fitness and corporate deployment
- [Become a partner](https://www.aescape.com/partner)
- [Operations manual](https://www.aescape.com/manual)
- [FAQs](https://www.aescape.com/faqs)
- [News](https://www.aescape.com/news) and [Press](https://www.aescape.com/press)
- [Locations](https://app.aescape.com/map)
- [Book a session](https://app.aescape.com/): the consumer application
- [Store](https://store.aescape.com/): gifts and packages
- [Terms of Service](https://www.aescape.com/terms)
- [Privacy Policy](https://www.aescape.com/privacy)
- [GitHub organization](https://github.com/aescape-inc): nine public repositories, all forks of third-party projects — no Aescape SDK

## Machine-readable contracts

Only one anonymously reachable machine-readable contract exists in the Aescape estate.

- [OpenID Connect discovery](https://aescape-8ocoec.zitadel.cloud/.well-known/openid-configuration): the discovery document for Aescape's production Zitadel identity tenant. Advertises authorization_code with PKCE S256, refresh_token, client_credentials, device_code and jwt-bearer grants, and the six standard OIDC scopes (openid, profile, email, phone, address, offline_access).

## Hosts and what they actually serve

- `api.aescape.com` — AWS API Gateway serving the consumer application. Every probed path returns HTTP 404 `{"message":"Not Found"}`. No OpenAPI, no Swagger, no GraphQL, no public routes.
- `developer.aescape.com` — a developer documentation site gated behind HTTP Basic auth (`WWW-Authenticate: Basic realm="Developer Docs"`). Every path returns 401. Nothing here is publicly readable.
- `app.aescape.com` — a Flutter web single-page app. It returns HTTP 200 with the same HTML shell for every path, including every `/.well-known/*` path. Those 200s are catch-all false positives, not documents.

## What does not exist

- No OpenAPI or Swagger specification
- No AsyncAPI specification and no publicly documented webhook or event surface
- No GraphQL endpoint
- No Model Context Protocol (MCP) server
- No A2A Agent Card at `/.well-known/agent-card.json` or `/.well-known/agent.json` on any host
- No `/.well-known/security.txt`, no vulnerability disclosure policy, no bug bounty program
- No trust center and no published SOC 2, ISO 27001, HIPAA, PCI DSS or FedRAMP certification
- No status page, no changelog, no deprecation or versioning policy
- No first-party SDK, CLI or client library on npm, PyPI, RubyGems or GitHub

## API Evangelist artifacts

- [apis.yml](apis.yml): the APIs.json profile for Aescape
- [well-known/aescape-well-known.yml](well-known/aescape-well-known.yml): every `/.well-known/` path probed, with status
- [well-known/aescape-openid-configuration.json](well-known/aescape-openid-configuration.json): the OIDC discovery document, saved verbatim
- [authentication/aescape-authentication.yml](authentication/aescape-authentication.yml): the identity profile read from that document
- [scopes/aescape-scopes.yml](scopes/aescape-scopes.yml): the six advertised OIDC scopes
- [conformance/aescape-conformance.yml](conformance/aescape-conformance.yml): standards conformance plus the full contract-discovery record
- [security/aescape-domain-security.yml](security/aescape-domain-security.yml): TLS, HSTS, DNSSEC, CAA, SPF and DMARC posture

generated: 2026-07-31
method: generated
source: apis.yml + live probes (no llms.txt is served at https://www.aescape.com/llms.txt — HTTP 404)