generated: '2026-08-13'
method: probed
source: live HTTPS probes of every Taboola host named in apis.yml and in openapi servers[]
provider: Taboola
providerId: taboola
description: |-
  Well-known probe across the four Taboola hosts plus the Realize MCP host. Two real
  documents are served: an RFC 9727 API catalog (application/linkset+json) on the
  developer portal, and the RFC 9728 / RFC 8414 OAuth metadata pair on the MCP host.
  Everything else is a miss — developers.taboola.com is a ReadMe SPA that answers 200
  with a ~534 KB HTML shell for any unmatched /.well-known/* path, and
  backstage.taboola.com answers 200 with its sign-in page, so both are recorded as
  soft-200 misses rather than hits.

hits: 3
soft_200_misses: 13
hard_404s: 12

probes:
  - host: developers.taboola.com
    path: /.well-known/api-catalog
    status: 200
    content_type: application/linkset+json
    hit: true
    file: taboola-api-catalog.json
    note: >-
      Real RFC 9727 linkset naming five API sections (pixel, backstage-api, taboolasdk,
      web-integrations, newsroom). Auto-generated by the ReadMe platform. Every child
      service-desc it advertises (e.g. /backstage-api/.well-known/api-catalog) itself
      returns 404, and three of the five service-doc /reference pages 404 as well —
      the catalog over-advertises.
  - host: developers.taboola.com
    path: /.well-known/security.txt
    status: 200
    content_type: text/html
    hit: false
    note: SPA catch-all — 534 KB HTML shell, not a security.txt.
  - host: developers.taboola.com
    path: /.well-known/ai-plugin.json
    status: 200
    content_type: text/html
    hit: false
    note: SPA catch-all.
  - host: developers.taboola.com
    path: /.well-known/agent-card.json
    status: 200
    content_type: text/html
    hit: false
    note: SPA catch-all. Not an A2A agent card.
  - host: developers.taboola.com
    path: /.well-known/agent.json
    status: 200
    content_type: text/html
    hit: false
    note: SPA catch-all. Not an A2A agent card.
  - host: developers.taboola.com
    path: /.well-known/openid-configuration
    status: 404
    hit: false
  - host: developers.taboola.com
    path: /.well-known/oauth-authorization-server
    status: 404
    hit: false
  - host: developers.taboola.com
    path: /.well-known/oauth-protected-resource
    status: 404
    hit: false

  - host: www.taboola.com
    path: /.well-known/security.txt
    status: 404
    hit: false
  - host: www.taboola.com
    path: /.well-known/openid-configuration
    status: 404
    hit: false
  - host: www.taboola.com
    path: /.well-known/oauth-authorization-server
    status: 404
    hit: false
  - host: www.taboola.com
    path: /.well-known/oauth-protected-resource
    status: 404
    hit: false
  - host: www.taboola.com
    path: /.well-known/api-catalog
    status: 404
    hit: false
  - host: www.taboola.com
    path: /.well-known/ai-plugin.json
    status: 404
    hit: false
  - host: www.taboola.com
    path: /.well-known/agent-card.json
    status: 404
    hit: false
  - host: www.taboola.com
    path: /.well-known/agent.json
    status: 404
    hit: false

  - host: backstage.taboola.com
    path: /.well-known/security.txt
    status: 200
    content_type: text/html
    hit: false
    note: >-
      All eight probed paths on the API host return the same 14 KB Taboola sign-in page.
      Soft 200, no document.
  - host: backstage.taboola.com
    path: /.well-known/openid-configuration
    status: 200
    content_type: text/html
    hit: false
  - host: backstage.taboola.com
    path: /.well-known/oauth-authorization-server
    status: 200
    content_type: text/html
    hit: false
  - host: backstage.taboola.com
    path: /.well-known/oauth-protected-resource
    status: 200
    content_type: text/html
    hit: false
  - host: backstage.taboola.com
    path: /.well-known/api-catalog
    status: 200
    content_type: text/html
    hit: false
  - host: backstage.taboola.com
    path: /.well-known/ai-plugin.json
    status: 200
    content_type: text/html
    hit: false
  - host: backstage.taboola.com
    path: /.well-known/agent-card.json
    status: 200
    content_type: text/html
    hit: false
  - host: backstage.taboola.com
    path: /.well-known/agent.json
    status: 200
    content_type: text/html
    hit: false

  - host: mcp.realize.com
    path: /.well-known/oauth-protected-resource
    status: 200
    content_type: application/json
    hit: true
    file: taboola-mcp-oauth-protected-resource.json
    note: RFC 9728 protected-resource metadata for the Realize MCP server.
  - host: mcp.realize.com
    path: /.well-known/oauth-protected-resource/mcp
    status: 200
    content_type: application/json
    hit: true
    note: Identical body to the root path; recorded once as taboola-mcp-oauth-protected-resource.json.
  - host: mcp.realize.com
    path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    hit: true
    file: taboola-mcp-oauth-authorization-server.json
    note: >-
      RFC 8414 authorization-server metadata. Issuer https://mcp.realize.com, endpoints on
      authentication.taboola.com, PKCE S256, dynamic client registration at /register.

  - host: trust.taboola.com
    path: /.well-known/security.txt
    status: 0
    hit: false
    note: Connection failed from the probe network (no TLS handshake). Not treated as evidence either way.