# datadog probes, 2026-09-17T18:15Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.datadoghq.com/v1/mcp
$ curl -sS -i -m 25 -X POST https://mcp.datadoghq.com/v1/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
content-length: 27
date: Thu, 17 Sep 2026 18:15:02 GMT

{"errors":["Unauthorized"]}

## 2. Protected-resource metadata, GET https://mcp.datadoghq.com/.well-known/oauth-protected-resource/v1/mcp (not named in the challenge; the RFC 9728 default path)
HTTP/1.1 200 Connection Established

HTTP/2 200 
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors 'self'; report-uri https://logs.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pube4f163c23bbf91c16b8f57f56af9fc58&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=site%3Adatadoghq.com
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-length: 147
date: Thu, 17 Sep 2026 18:15:03 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload

{"resource":"https://mcp.datadoghq.com/v1/mcp","authorization_servers":["https://mcp.datadoghq.com/v1/mcp"],"bearer_methods_supported":["header"]}


## 3. Authorization-server metadata, GET https://mcp.datadoghq.com/.well-known/oauth-authorization-server/v1/mcp
HTTP/1.1 200 Connection Established

HTTP/2 200 
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors 'self'; report-uri https://logs.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pube4f163c23bbf91c16b8f57f56af9fc58&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=site%3Adatadoghq.com
content-type: application/json
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-length: 659
date: Thu, 17 Sep 2026 18:15:03 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload

{"issuer":"https://mcp.datadoghq.com/v1/mcp","authorization_endpoint":"https://app.datadoghq.com/oauth2/v1/authorize","token_endpoint":"https://app.datadoghq.com/api/v2/oauth2/token","oauth_version":"2.1","response_types_supported":["code"],"grant_types_supported":["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:jwt-bearer"],"authorization_grant_profiles_supported":["urn:ietf:params:oauth:grant-profile:id-jag"],"scopes_supported":["mcp_all"],"code_challenge_methods_supported":["S256"],"pkce_required":true,"registration_endpoint":"https://app.datadoghq.com/api/v2/oauth2/register","token_endpoint_auth_methods_supported":["none"]}


## 4. REST, GET https://api.datadoghq.com/api/v1/validate, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/1.1 403 Forbidden
content-type: application/json
content-length: 24
date: Thu, 17 Sep 2026 18:15:04 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload

{"errors":["Forbidden"]}