generated: '2026-07-26'
method: searched
source: live anonymous probes of every RE/MAX host in apis.yml, 2026-07-26
summary: >-
  RE/MAX serves no RFC 9116 security.txt, no OIDC or RFC 8414 authorization-server
  metadata and no RFC 9727 api-catalog on any host. The one machine-readable
  discovery document in the entire estate is not under /.well-known at all: it is
  the WordPress REST API route descriptor at https://www.remax.eu/wp-json/, which
  publishes 42 namespaces and 791 routes anonymously - including an MCP endpoint.
  It is saved verbatim here because it is the only self-describing contract RE/MAX
  publishes.
hosts:
- host: https://www.remax.com
  note: AWS WAF; many paths answer 202 with a zero-byte body rather than a real status
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/api-catalog
    status: 403
  - path: /.well-known/openid-configuration
    status: 202
    note: WAF challenge, zero-byte body
  - path: /llms.txt
    status: 404
  - path: /robots.txt
    status: 200
    note: disallows /api/, /v2/, /feature-flags/; lists 15 sitemap index files
- host: https://www.remax.eu
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /llms.txt
    status: 200
    bytes: 39691
    file: ../llms/re-max-eu-site-llms.txt
    note: generated by Rank Math SEO; a marketing-site index, not a developer index
  - path: /wp-json/
    status: 200
    bytes: 635534
    file: re-max-eu-wp-json.json
    kind: WordPress REST API route descriptor
    note: >-
      non-standard discovery path, but a genuine machine-readable API catalog -
      42 namespaces, 791 routes, each with methods and argument definitions
- host: https://oauth.datahub.remax.eu
  documents:
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/security.txt
    status: 404
- host: https://api.datahub.remax.eu
  documents:
  - path: /.well-known/security.txt
    status: 400
    note: 'the auth gate answers ahead of routing: {"status":[{"code":4007,"message":"Login parameter Required"}]}'
  - path: /.well-known/oauth-protected-resource
    status: 400
    note: same auth-gate response; no RFC 9728 metadata
- host: https://datahub.remax.eu
  documents:
  - path: /.well-known/security.txt
    status: 200
    note: >-
      NOT a security.txt - the SPA returns its HTML shell for unknown paths.
      Recorded as absent.
- host: https://listing-api-remaxeu.bwscloud.tech
  documents:
  - path: /.well-known/*
    status: 403
    note: nginx 403 to every anonymous path on the staging origin
- host: https://oauth.pre-prod.remaxeu-datahub.bwscloud.tech
  documents:
  - path: /.well-known/openid-configuration
    status: 403
  - path: /.well-known/oauth-authorization-server
    status: 403
wp_json_catalog:
  url: https://www.remax.eu/wp-json/
  file: re-max-eu-wp-json.json
  site_name: REMAX Europe
  namespaces: 42
  routes: 791
  anonymous_read: true
  agent_relevant_namespaces:
  - mcp
  - jet-engine/v1
  - wp-abilities/v1
  public_content_routes:
  - GET /wp/v2/posts
  - GET /wp/v2/pages
  - GET /wp/v2/media
  - GET /wp/v2/search
  - GET /wp/v2/regions
  - GET /wp/v2/events
  - GET /wp/v2/newsroom-post
  - GET /wp/v2/our-people-posts
  - GET /wp/v2/banner-news
  - GET /wp/v2/types
  - GET /wp/v2/taxonomies
  verified:
  - url: https://www.remax.eu/wp-json/wp/v2/posts?per_page=1
    status: 200
  - url: https://www.remax.eu/wp-json/wp/v2/regions?per_page=2
    status: 200
  note: >-
    This is a WordPress platform default rather than a RE/MAX API product, and it
    is recorded as such - but it is nonetheless the only anonymously callable,
    self-describing RE/MAX endpoint family that exists.