generated: '2026-07-20'
method: searched
source: https://palmhr.net/.well-known/
host: https://palmhr.net
documents:
  - path: /.well-known/security.txt          # RFC 9116
    status: 200
    file: palmhr-security.txt
  - path: /.well-known/openid-configuration   # OIDC discovery
    status: 307                                # 307 -> /en/... SPA soft-404, not a real document
  - path: /.well-known/oauth-authorization-server  # RFC 8414
    status: 307                                # 307 -> /en/... SPA soft-404, not a real document
  - path: /.well-known/api-catalog             # RFC 9727
    status: 307                                # 307 -> /en/... SPA soft-404, not a real document
  - path: /.well-known/ai-plugin.json
    status: 200                                # returns HTML "Page Not Found" SPA soft-404, not a real plugin manifest
notes: >-
  Only /.well-known/security.txt is a genuine document. The api host api.palm.hr
  returns 404 for all /.well-known/ paths. openid-configuration, oauth-authorization-server,
  api-catalog and ai-plugin.json all resolve to the SPA soft-404 page rather than real payloads.