generated: '2026-09-16'
method: probed
source: live GET probes of /.well-known/* on underdog.shop, www.underdog.shop and account.underdog.shop on 2026-09-16
name: Underdog well-known probe
description: >-
  Probe of the RFC 8615 /.well-known/ namespace on every host the Underdog record knows:
  underdog.shop (storefront, every API baseURL), www.underdog.shop (redirect alias; its
  OAuth and UCP documents answer on www directly, the rest redirect to the apex) and
  account.underdog.shop (the customer-account authorization server named in
  authorization_servers). Real documents: the UCP merchant profile, OIDC discovery, RFC
  8414 authorization-server metadata and RFC 9728 protected-resource metadata. No
  security.txt, api-catalog, ai-plugin.json or A2A agent card is served on any host. A
  control probe of https://underdog.shop/zzz-nonsense-xyz.txt returned 404, so the host is
  not a soft-404 catch-all and the 200s are genuine documents.
control_probe:
  url: https://underdog.shop/zzz-nonsense-xyz.txt
  status: 404
hosts:
- host: underdog.shop
  documents:
  - path: /.well-known/ucp
    status: 200
    content_type: application/json
    file: underdog-ucp.json
    note: >-
      Universal Commerce Protocol merchant profile. Refreshed 2026-09-16: now declares UCP
      version 2026-08-25 (2026-04-08 and 2026-01-23 still resolvable at
      underdog-web.myshopify.com), the dev.ucp.shopping service over MCP and embedded
      transports, seven shopping capabilities plus dev.shopify.catalog, and Google Pay /
      Shopify card payment handlers whose merchant_name is "Underdog" and merchant_origin
      is underdog.shop — which is what establishes ownership.
  - path: /.well-known/openid-configuration
    status: 200
    content_type: application/json
    file: underdog-openid-configuration.json
    note: >-
      OIDC discovery for Underdog customer accounts. issuer
      https://shopify.com/authentication/69142905142 (Underdog's Shopify shop id); endpoints
      on account.underdog.shop.
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    file: underdog-oauth-authorization-server.json
    note: RFC 8414 metadata; byte-identical to the OIDC discovery document.
  - path: /.well-known/oauth-protected-resource
    status: 200
    content_type: application/json
    file: underdog-oauth-protected-resource.json
    note: RFC 9728 metadata; resource https://underdog.shop.
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
    note: No A2A agent card; nothing written to a2a/.
  - path: /.well-known/agent.json
    status: 404
  - path: /.well-known/mcp.json
    status: 404
  - path: /.well-known/mcp/server-card.json
    status: 404
- host: www.underdog.shop
  documents:
  - path: /.well-known/ucp
    status: 200
    content_type: application/json
    file: underdog-ucp.json
    note: Same document as the apex host.
  - path: /.well-known/openid-configuration
    status: 200
    content_type: application/json
    file: underdog-openid-configuration.json
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    file: underdog-oauth-authorization-server.json
  - path: /.well-known/oauth-protected-resource
    status: 200
    content_type: application/json
    file: underdog-oauth-protected-resource.json
  - path: /.well-known/security.txt
    status: 404
    note: 301 to the apex host, then 404.
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
- host: account.underdog.shop
  documents:
  - path: /.well-known/openid-configuration
    status: 200
    content_type: application/json
    file: underdog-account-openid-configuration.json
    note: >-
      Same issuer as the storefront copy, but jwks_uri is
      https://account.underdog.shop/.well-known/jwks.json (storefront copy names
      /authentication/.well-known/jwks.json).
  - path: /.well-known/oauth-authorization-server
    status: 200
    content_type: application/json
    file: underdog-account-oauth-authorization-server.json
    note: Byte-identical to this host's OIDC discovery document.
  - path: /.well-known/oauth-protected-resource
    status: 200
    content_type: application/json
    file: underdog-account-oauth-protected-resource.json
    note: resource https://account.underdog.shop.
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/ucp
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
related:
- url: https://underdog.shop/llms.txt
  status: 200
  file: ../llms/underdog-llms.txt
- url: https://underdog.shop/agents.md
  status: 200
  file: ../llms/underdog-agents.md
hit_count: 7