generated: '2026-08-12'
method: probed
source: >-
  Direct anonymous HTTP probes of every Blueshift host named in apis.yml, the
  harvested OpenAPI servers[] block, and the developer/docs host.
description: >-
  Blueshift serves no security.txt, no api-catalog and no OpenID Connect
  discovery document on any host. It DOES serve a complete pair of OAuth 2.0
  discovery documents — RFC 8414 authorization-server metadata and RFC 9728
  protected-resource metadata — on all four API/app hosts. Those documents exist
  to support the Blueshift MCP Server's OAuth flow, and they are the reason the
  WellKnown pointer is emitted: they are real, parseable, machine-readable
  documents, not an SPA shell.

hosts:
  - host: api.getblueshift.com
    role: REST API host (US and rest of world)
  - host: api.eu.getblueshift.com
    role: REST API host (EU)
  - host: app.getblueshift.com
    role: application + MCP server host (US and rest of world)
  - host: app.eu.getblueshift.com
    role: application + MCP server host (EU)
  - host: developer.blueshift.com
    role: developer portal / API reference (ReadMe)
  - host: blueshift.com
    role: marketing site

probes:
  - host: api.getblueshift.com
    path: /.well-known/oauth-authorization-server
    status: 200
    file: blueshift-oauth-authorization-server.json
    document: RFC 8414 OAuth 2.0 Authorization Server Metadata
    note: >-
      Real JSON. Declares authorization_code, client_credentials and
      refresh_token grants, PKCE S256, dynamic client registration, and eight
      scopes.
  - host: api.getblueshift.com
    path: /.well-known/oauth-protected-resource
    status: 200
    file: blueshift-oauth-protected-resource.json
    document: RFC 9728 OAuth 2.0 Protected Resource Metadata
  - host: app.getblueshift.com
    path: /.well-known/oauth-authorization-server
    status: 200
    file: blueshift-app-oauth-authorization-server.json
    document: RFC 8414 OAuth 2.0 Authorization Server Metadata
  - host: app.getblueshift.com
    path: /.well-known/oauth-protected-resource
    status: 200
    file: blueshift-app-oauth-protected-resource.json
    document: RFC 9728 OAuth 2.0 Protected Resource Metadata
    note: >-
      This is the document the MCP server's 401 WWW-Authenticate challenge
      points at. Verified end to end.
  - host: api.eu.getblueshift.com
    path: /.well-known/oauth-authorization-server
    status: 200
    document: RFC 8414 — EU mirror, same shape as the US document
  - host: api.eu.getblueshift.com
    path: /.well-known/oauth-protected-resource
    status: 200
    document: RFC 9728 — EU mirror
  - host: app.eu.getblueshift.com
    path: /.well-known/oauth-authorization-server
    status: 200
    document: RFC 8414 — EU mirror
  - host: app.eu.getblueshift.com
    path: /.well-known/oauth-protected-resource
    status: 200
    document: RFC 9728 — EU mirror
  - host: api.getblueshift.com
    path: /.well-known/security.txt
    status: 404
  - host: api.getblueshift.com
    path: /.well-known/openid-configuration
    status: 404
  - host: api.getblueshift.com
    path: /.well-known/api-catalog
    status: 404
  - host: api.getblueshift.com
    path: /.well-known/ai-plugin.json
    status: 404
  - host: api.getblueshift.com
    path: /.well-known/agent-card.json
    status: 404
  - host: api.getblueshift.com
    path: /.well-known/agent.json
    status: 404
  - host: developer.blueshift.com
    path: /.well-known/security.txt
    status: 404
  - host: developer.blueshift.com
    path: /.well-known/openid-configuration
    status: 404
  - host: developer.blueshift.com
    path: /.well-known/api-catalog
    status: 404
  - host: developer.blueshift.com
    path: /.well-known/agent-card.json
    status: 404
  - host: developer.blueshift.com
    path: /.well-known/agent.json
    status: 404
  - host: blueshift.com
    path: /.well-known/security.txt
    status: 404
  - host: blueshift.com
    path: /.well-known/agent-card.json
    status: 404
    note: >-
      Marketing site answers 404 with the full HTML shell; treated as a miss on
      body shape, not on status alone.
  - host: blueshift.com
    path: /.well-known/api-catalog
    status: 404

findings:
  security_txt: absent on every host probed
  api_catalog: absent on every host probed
  openid_configuration: absent on every host probed
  agent_card: >-
    absent on every host probed, at both the A2A 1.0 path
    (/.well-known/agent-card.json) and the pre-0.3 legacy path
    (/.well-known/agent.json). No a2a/ artifact was written.
  oauth_discovery: >-
    present and complete on all four API/app hosts, US and EU.