generated: '2026-07-23'
method: searched
source: live probes of apis.yml + OpenAPI server hosts
notes: The SVB developer portal (developer.svb.com) is a client-rendered SPA that returns its HTML shell
  (HTTP 200) for every /.well-known/ path, so those 200s are not real discovery documents. The API host
  (api.svb.com) is partner-gated and returns 401 for all anonymous requests including /.well-known/*.
  The only genuine well-known document found is the RFC 9116 security.txt on the parent bank corporate
  host (www.firstcitizens.com).
hosts:
- host: ''
  documents:
  - path: /.well-known/security.txt
    status: 200
    file: first-citizens-bancshares-security.txt
  - path: /.well-known/security.txt
    status: 401
  - path: /.well-known/openid-configuration
    status: 401
  - path: /.well-known/oauth-authorization-server
    status: 401
  - path: /.well-known/api-catalog
    status: 401
  - path: /.well-known/openid-configuration
    status: 200
  - path: /.well-known/oauth-authorization-server
    status: 200
  - path: /.well-known/api-catalog
    status: 200
x-shape-fix:
  converted: '2026-08-20'
  from: documents
  note: Rewritten into hosts[] -> documents[], the only shape well_known_docs() in score.rb reads. A served
    .well-known surface recorded in any other shape scores as absent.