No API Catalog at /.well-known/api-catalog
If this finding appears in a report, the sampled /.well-known/api-catalog endpoint did not provide an API catalogue. RFC 9727 defines a discovery mechanism for APIs. It does not require every website to offer an API or establish that every AI agent uses this endpoint.
Why this matters
A catalogue can help a client that supports this mechanism discover documented APIs. Its absence alone does not prove an API is undiscoverable, that an integration is broken or that search visibility is reduced. Public APIs may be unnecessary for the business.
How to fix it
Start with a real integration requirement and identify the client's supported discovery method. If it uses RFC 9727, publish an accurate catalogue and verify it with that client. Otherwise maintain the documentation and discovery method the integration actually needs. Preserve authentication and authorisation; do not expose private APIs merely to satisfy this finding.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit