# ashby probes, 2026-09-17T18:15Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.ashbyhq.com/mcp/v1
$ curl -sS -i -m 25 -X POST https://mcp.ashbyhq.com/mcp/v1 -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 18:15:07 GMT
content-type: application/json; charset=utf-8
content-length: 24
x-ashby-request-id: 01M2R98NZJ7NDPDHPCSGCK6M8D
x-content-type-options: nosniff
x-frame-options: DENY
referrer-policy: same-origin
ashby-session-expiry-alert-level: 
www-authenticate: Bearer resource_metadata="https://mcp.ashbyhq.com/.well-known/oauth-protected-resource", scope="openid mcp offline_access"
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: a3ca182c9c3c8f84-BOS
alt-svc: h3=":443"; ma=86400

{"error":"Unauthorized"}

## 2. Protected-resource metadata, GET https://mcp.ashbyhq.com/.well-known/oauth-protected-resource
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 18:15:07 GMT
content-type: application/json; charset=utf-8
content-length: 198
x-ashby-request-id: 01M2R98PM1P0EJS96BM61Z57TT
x-content-type-options: nosniff
x-frame-options: DENY
referrer-policy: same-origin
ashby-session-expiry-alert-level: 
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: a3ca1830aa8ae728-BOS
alt-svc: h3=":443"; ma=86400

{"resource":"https://mcp.ashbyhq.com/mcp/v1","authorization_servers":["https://mcp-auth.ashbyhq.com/oidc"],"scopes_supported":["openid","mcp","offline_access"],"bearer_methods_supported":["header"]}

## 3. Authorization-server metadata, GET https://mcp-auth.ashbyhq.com/.well-known/oauth-authorization-server/oidc
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 18:15:08 GMT
content-type: application/json; charset=utf-8
content-length: 1357
x-ashby-request-id: 01M2R98Q8KGHA1NTFXDBZCAWD1
x-content-type-options: nosniff
x-frame-options: DENY
referrer-policy: same-origin
ashby-session-expiry-alert-level: 
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: a3ca1834cb84cb6a-BOS
alt-svc: h3=":443"; ma=86400

{"authorization_endpoint":"https://mcp-auth.ashbyhq.com/oidc/auth","claims_parameter_supported":false,"claims_supported":["sub","email","name","sid","auth_time","iss"],"code_challenge_methods_supported":["S256"],"end_session_endpoint":"https://mcp-auth.ashbyhq.com/oidc/session/end","grant_types_supported":["implicit","authorization_code","refresh_token"],"issuer":"https://mcp-auth.ashbyhq.com/oidc","jwks_uri":"https://mcp-auth.ashbyhq.com/oidc/jwks","registration_endpoint":"https://mcp-auth.ashbyhq.com/oidc/reg","authorization_response_iss_parameter_supported":true,"response_modes_supported":["form_post","fragment","query"],"response_types_supported":["code id_token","code","id_token","none"],"scopes_supported":["openid","mcp","offline_access"],"subject_types_supported":["public"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_jwt","client_secret_post","private_key_jwt","none"],"token_endpoint_auth_signing_alg_values_supported":["HS256","RS256","PS256","ES256","Ed25519","EdDSA"],"token_endpoint":"https://mcp-auth.ashbyhq.com/oidc/token","id_token_signing_alg_values_supported":["RS256"],"pushed_authorization_request_endpoint":"https://mcp-auth.ashbyhq.com/oidc/request","request_uri_parameter_supported":false,"dpop_signing_alg_values_supported":["ES256","Ed25519","EdDSA"],"claim_types_supported":["normal"]}

## 4. REST, GET https://api.ashbyhq.com/candidate.list, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 18:15:08 GMT
content-type: text/plain; charset=utf-8
content-length: 12
x-ashby-request-id: 01M2R98QWPF661FHWX29T270SN
x-content-type-options: nosniff
x-frame-options: DENY
referrer-policy: same-origin
ashby-session-expiry-alert-level: 
vary: Origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: a3ca1838d9eec062-BOS
alt-svc: h3=":443"; ma=86400

Unauthorized