generated: '2026-08-15' method: probed source: live HTTP probes of every host in apis.yml and every OpenAPI servers[] host result: served summary: >- Commure DOES serve /.well-known/ discovery documents - but on its identity host accounts.commure.com, not on the corporate site and not on the retired developer platform. accounts.commure.com is an Okta Customer Identity org operating under Commure's own domain and is the sign-in surface already linked from apis.yml (SignUp/Login). It answers /.well-known/openid-configuration, /.well-known/oauth-authorization-server (RFC 8414) and /oauth2/default/.well-known/openid-configuration with real JSON metadata documents, all three saved verbatim in this directory. The corporate site www.commure.com still answers every /.well-known/* path with a genuine HTTP 404 (text/html) - not an SPA catch-all 200 - so those remain true negatives. The two discovery documents Commure's published FHIR contract defines (the tenant OpenID Connect metadata and the SMART App Launch configuration) live on the tenant API hosts, which still do not resolve. caveat: >- accounts.commure.com is a delegated identity surface (Okta), so the okta.* scopes it advertises are Okta platform management scopes present in every Okta org, NOT Commure product API scopes. The only Commure-configured custom scopes visible anonymously are on the `default` custom authorization server: `default`, `interclient_access`, `device_sso`, `groups`. This document is a real, machine-readable auth-discovery surface for Commure's products; it is not a discovery document for the FHIR Developer Platform. hosts: - host: accounts.commure.com reachable: true role: Commure product sign-in / identity provider (Okta Customer Identity org on Commure's domain) documents: - path: /.well-known/openid-configuration status: 200 content_type: application/json file: commure-accounts-openid-configuration.json issuer: https://accounts.commure.com - path: /.well-known/oauth-authorization-server status: 200 content_type: application/json file: commure-accounts-oauth-authorization-server.json issuer: https://accounts.commure.com spec: RFC 8414 OAuth 2.0 Authorization Server Metadata - path: /oauth2/default/.well-known/openid-configuration status: 200 content_type: application/json file: commure-accounts-default-openid-configuration.json issuer: https://accounts.commure.com/oauth2/default note: Commure's custom authorization server; advertises the Commure-configured scopes. - path: /.well-known/oauth-protected-resource status: 405 note: Okta answers 405 (method not supported) rather than 404; no document served. - path: /.well-known/security.txt status: 405 note: Okta answers 405 rather than 404; no security.txt served. - path: /.well-known/webfinger status: 400 note: Okta WebFinger requires a resource parameter; not a discovery document. - path: /.well-known/api-catalog status: 405 - path: /.well-known/ai-plugin.json status: 404 - path: /.well-known/agent-card.json status: 404 - path: /.well-known/agent.json status: 404 - host: www.commure.com reachable: true documents: - path: /.well-known/security.txt status: 404 - path: /.well-known/openid-configuration status: 404 - path: /.well-known/oauth-authorization-server status: 404 - path: /.well-known/oauth-protected-resource status: 404 - path: /.well-known/api-catalog status: 404 - path: /.well-known/ai-plugin.json status: 404 - path: /.well-known/agent-card.json status: 404 - path: /.well-known/agent.json status: 404 - path: /.well-known/smart-configuration status: 404 - path: /llms.txt status: 404 - path: /openapi.json status: 404 - path: /sitemap.xml status: 200 note: Present but not a /.well-known/ document; used to enumerate the public site. - host: commure.com reachable: true note: 301 redirects to www.commure.com; identical 404 results on every path above. - host: developer.commure.com reachable: partial note: 'Resolves (34.148.125.229) but returns HTTP 404 on every path including /, /docs, /api/v1/r4/metadata and /auth/.well-known/openid-configuration.' documents: - path: /.well-known/openid-configuration status: 404 - path: /.well-known/smart-configuration status: 404 - host: api.commure.com reachable: false note: does not resolve - host: docs.commure.com reachable: false note: does not resolve - host: fhir.commure.com reachable: false note: does not resolve - host: mcp.commure.com reachable: false note: does not resolve - host: api-{tenant-id}.developer.commure.com reachable: false note: >- The production base URL template published in Commure's Postman collection. Tested with the tenant id Commure documents by example (99750511) - NXDOMAIN. - host: www.athelas.com reachable: true note: Athelas product site (Commure combined with Athelas in 2023). All /.well-known/ paths 404; no llms.txt, no openapi.json. declared_but_unreachable: - path: /auth/.well-known/openid-configuration operation: openIDConnectProviderMetadata note: OpenID Connect Discovery metadata, declared in the published contract on the tenant host. - path: /api/v1/r4/.well-known/smart-configuration operation: sMARTAppLaunchConfiguration note: SMART App Launch configuration, declared in the published contract on the tenant host. documents: - path: /.well-known/openid-configuration host: accounts.commure.com url: https://accounts.commure.com/.well-known/openid-configuration status: 200 file: commure-accounts-openid-configuration.json type: OpenID Connect Discovery 1.0 provider metadata - path: /.well-known/oauth-authorization-server host: accounts.commure.com url: https://accounts.commure.com/.well-known/oauth-authorization-server status: 200 file: commure-accounts-oauth-authorization-server.json type: RFC 8414 OAuth 2.0 Authorization Server Metadata - path: /oauth2/default/.well-known/openid-configuration host: accounts.commure.com url: https://accounts.commure.com/oauth2/default/.well-known/openid-configuration status: 200 file: commure-accounts-default-openid-configuration.json type: OpenID Connect Discovery 1.0 provider metadata (custom authorization server) x-evidence: fetched: '2026-08-15' previous_probe: '2026-07-31' method: curl -L, following redirects, recording final status, content-type and body false_positive_check: >- Every 200 recorded above was parsed as JSON and checked for a matching `issuer` on accounts.commure.com before being saved; none is an HTML/SPA shell. Every 404 returned content-type text/html with a real 404 status. The 405/400 responses on accounts.commure.com are Okta's method/parameter errors, recorded as misses, not as documents. change_from_previous_round: >- The 2026-07-31 round probed www.commure.com, developer.commure.com, the tenant hosts and athelas.com and correctly recorded none-served. It did not probe accounts.commure.com, the sign-in host, which serves three real discovery documents. Result upgraded none-served -> served.