generated: '2026-09-02'
method: probed
source: >-
  https://mcp.unified.com/.well-known/oauth-authorization-server,
  https://mcp.unified.com/.well-known/oauth-protected-resource/mcp, and the RFC 6750 challenge
  returned by an anonymous POST to https://mcp.unified.com/mcp. Probed 2026-09-02.
note: >-
  Derived from live discovery documents rather than from the OpenAPI, because the published
  OpenAPI (openapi/unified-mcp-service-openapi.json) declares NO securitySchemes at all — it
  describes only unauthenticated root and health probes. Unified's real authentication surface is
  the OAuth authorization server fronting the MCP endpoint. Unified publishes no anonymous
  developer authentication page; docs.unified.com is behind SSO.
schemes:
- name: mcp_oauth_bearer
  type: oauth2
  standard: OAuth 2.0 with PKCE; discovery per RFC 8414, protected resource per RFC 9728,
    bearer usage and challenge per RFC 6750, dynamic registration per RFC 7591
  in: header
  parameter: Authorization
  format: Bearer <token>
  issuer: https://mcp.unified.com/
  flows:
    authorizationCode:
      authorizationUrl: https://mcp.unified.com/authorize
      tokenUrl: https://mcp.unified.com/token
      refreshUrl: https://mcp.unified.com/token
      scopes:
        openid: The only scope advertised by the authorization server metadata.
  code_challenge_methods:
  - S256
  grant_types:
  - authorization_code
  - refresh_token
  token_endpoint_auth_methods:
  - client_secret_post
  - client_secret_basic
  revocation_endpoint: https://mcp.unified.com/revoke
  registration_endpoint: https://mcp.unified.com/register
  dynamic_client_registration: true
  applies_to:
  - https://mcp.unified.com/mcp
- name: none
  type: none
  applies_to:
  - https://api.unified.com/
  - https://api.unified.com/health
  - https://api.unified.com/health/ready
  - https://api.unified.com/health/live
  - https://api.unified.com/openapi.json
  note: >-
    The root, health and description endpoints answer 200 anonymously; they carry no security
    requirement in the spec and none was observed.
customer_application:
  url: https://get.unified.com/login
  model: session sign-in to the Unified web application; every /.well-known/ path on that host
    302s into the login flow.
  observed_status: 200
documentation:
  url: https://docs.unified.com/
  observed_status: 200
  effective: >-
    307/redirect chain into https://iheartmedia.unified.com/login — a GitBook space behind single
    sign-on. No anonymous authentication reference could be read.
x-evidence:
- fetched: '2026-09-02'
  url: https://mcp.unified.com/.well-known/oauth-authorization-server
  http_status: 200
- fetched: '2026-09-02'
  url: https://mcp.unified.com/.well-known/oauth-protected-resource/mcp
  http_status: 200
- fetched: '2026-09-02'
  url: https://mcp.unified.com/mcp
  http_status: 401
- fetched: '2026-09-02'
  url: https://docs.unified.com/
  http_status: 200
  effective_url: https://iheartmedia.unified.com/login?next=%2Fiheartmedia%2Fidentity%2Fauth%2Fgitbook%2Fsso