generated: '2026-07-26'
method: searched
source: live probes of the Zoopla website, developer-portal and API hosts
note: >-
  Only the consumer website serves a /.well-known/ document. The documented API
  host (services.zoopla.co.uk), the docsify developer portal
  (developers.zoopla.co.uk, GitHub Pages) and the Cognito-backed token host
  (services-auth.services.zoopla.co.uk) return 404 for every well-known path
  probed, including OIDC discovery and RFC 8414 OAuth authorization-server
  metadata — Zoopla's OAuth 2.0 client-credentials setup is documented in prose
  only, with no machine-readable discovery document.
hosts:
- host: https://www.zoopla.co.uk
  documents:
  - path: /.well-known/security.txt
    status: 200
    file: zoopla-security.txt
    standard: RFC 9116
    note: >-
      Served through Cloudflare as text/plain. Carries Canonical and Contact
      only; the Expires field is 2026-02-04T02:00:00Z, which is in the past as
      of this harvest, so the file is stale by RFC 9116's own rule.
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/api-catalog
    status: 404
- host: https://services.zoopla.co.uk
  documents:
  - path: /.well-known/security.txt
    status: 404
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/oauth-protected-resource
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
- host: https://services-auth.services.zoopla.co.uk
  documents:
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
- host: https://developers.zoopla.co.uk
  documents:
  - path: /.well-known/security.txt
    status: 404
documents:
- path: /.well-known/security.txt
  host: https://www.zoopla.co.uk
  status: 200
  file: zoopla-security.txt