# ironclad probes, 2026-09-17T18:15Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.na1.ironcladapp.com/mcp
$ curl -sS -i -m 25 -X POST https://mcp.na1.ironcladapp.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
server: nginx/1.27.5
date: Thu, 17 Sep 2026 18:15:09 GMT
content-type: application/json
content-length: 69
www-authenticate: Bearer resource_metadata="https://mcp.na1.ironcladapp.com/.well-known/oauth-protected-resource"
x-request-id: 3416865f-cee8-4cbe-8151-0376cb3bb0bc
via: 1.1 google
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=2592000

{ "code": "UNAUTHORIZED", "message": "invalid authentication token" }

## 2. Protected-resource metadata, GET https://mcp.na1.ironcladapp.com/.well-known/oauth-protected-resource
HTTP/1.1 200 Connection Established

HTTP/2 200 
x-powered-by: Express
access-control-allow-origin: *
content-type: application/json; charset=utf-8
content-length: 562
etag: W/"232-UctpDOUsXmJpzVKNHOxOluNTeOM"
date: Thu, 17 Sep 2026 18:15:10 GMT
via: 1.1 google
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=2592000

{"resource":"https://mcp.na1.ironcladapp.com","authorization_servers":["https://ironcladapp.com"],"scopes_supported":["public.workflows.readWorkflows","public.workflows.readSchemas","public.workflows.createWorkflows","public.workflows.readSignStatus","public.workflows.readDocuments","public.records.readRecords","public.entities.readRelationshipTypes","public.entities.readEntities","public.obligations.readObligations","public.obligations.createObligations","public.obligations.updateObligations","public.obligations.readTypes","public.search.conversational"]}

## 3. Authorization-server metadata, GET https://ironcladapp.com/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 18:15:11 GMT
content-type: application/json; charset=utf-8
content-length: 3362
vary: Accept-Encoding,Accept-Encoding
x-pod-name: app-69964c74cd-g9cmx
x-version: 2026.37.359.38-08883024daf
x-response-id: 1e23916a-75c2-4e0d-af51-56a49d57fcc2
cache-control: public, max-age=300
content-security-policy: default-src 'self';frame-ancestors 'self' https://*.salesforce.com https://*.lightning.force.com https://*.visual.force.com https://*.visualforce.com https://green-harvest-experience.my.site.com https://*.officeapps.live.com https://*.sharepoint.com;report-to https://o196550.ingest.sentry.io/api/1303389/security/?sentry_key=e702537f252d4783a7f53bc39e9b1e77&sentry_environment=&release=;report-uri https://o196550.ingest.sentry.io/api/1303389/security/?sentry_key=e702537f252d4783a7f53bc39e9b1e77&sentry_environment=&release=;base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-dns-prefetch-control: off
expect-ct: max-age=0
x-download-options: noopen
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
x-xss-protection: 0
x-ironclad-requestid: 1e23916a-75c2-4e0d-af51-56a49d57fcc2
access-control-allow-origin: *
via: 1.1 google
strict-transport-security: max-age=15552000; includeSubDomains,max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=2592000

{"issuer":"https://ironcladapp.com","authorization_endpoint":"https://ironcladapp.com/oauth/authorize","token_endpoint":"https://ironcladapp.com/oauth/token","userinfo_endpoint":"https://ironcladapp.com/oauth/userinfo","response_types_supported":["code"],"grant_types_supported":["authorization_code","refresh_token","client_credentials"],"scopes_supported":["public.records.createRecords","public.records.readRecords","public.records.updateRecords","public.records.deleteRecords","public.records.readSchemas","public.records.createAttachments","public.records.readAttachments","public.records.deleteAttachments","public.records.createSmartImportRecords","public.records.readSmartImportRecords","public.records.applyContractActions","public.records.createMetadataImports","public.records.readMetadataImports","public.records.runMetadataImports","public.webhooks.createWebhooks","public.webhooks.readWebhooks","public.webhooks.updateWebhooks","public.webhooks.deleteWebhooks","public.workflows.createWorkflows","public.workflows.readWorkflows","public.workflows.updateWorkflows","public.workflows.readApprovals","public.workflows.updateApprovals","public.workflows.readSignatures","public.workflows.createSignatureRecipientUrls","public.workflows.createEmbeddableSignerUrls","public.workflows.readSignStatus","public.workflows.sendSignatureRequests","public.workflows.scheduleSendSignatureRequest","public.workflows.updateScheduledSignatureRequest","public.workflows.deleteScheduledSignatureRequest","public.workflows.cancelSignatureRequests","public.workflows.deleteSigners","public.workflows.remindSigners","public.workflows.updateSigners","public.workflows.uploadSignedDocuments","public.workflows.readParticipants","public.workflows.readRoleAssignees","public.workflows.updateRoleAssignment","public.workflows.revertToReview","public.workflows.cancel","public.workflows.pauseAndResume","public.workflows.createComments","public.workflows.readComments","public.workflows.createDocuments","public.workflows.readDocuments","public.workflows.updateSignaturePacket","public.workflows.readSchemas","public.workflows.createFromSource","public.workflows.updateFromSource","public.workflows.readTurnHistory","public.workflows.readEmailCommunications","public.export.createReports","public.export.readReports","public.entities.readRelationshipTypes","public.entities.readEntities","public.entities.updateEntities","public.entities.deleteEntities","public.entities.createEntities","public.entities.createMetadataImports","public.entities.readMetadataImports","public.entities.runMetadataImports","public.obligations.readTypes","public.obligations.readObligations","public.obligations.createObligations","public.obligations.updateObligations","public.obligations.deleteObligations","public.search.conversational","public.jurist.uploadFiles","public.jurist.redlineWithPlaybook","public.agents.runIntakeAgent","public.signatureRequests.updateRequest","scim.groups.createGroups","scim.groups.readGroups","scim.groups.updateGroups","scim.groups.deleteGroups","scim.users.createUsers","scim.users.readUsers","scim.users.updateUsers","scim.users.deleteUsers","scim.schemas.readSchemas","openid"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","none"],"client_id_metadata_document_supported":true,"code_challenge_methods_supported":["S256"]}

## 4. REST, GET https://ironcladapp.com/public/api/v1/records, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 401 
server: nginx/1.27.5
date: Thu, 17 Sep 2026 18:15:11 GMT
content-type: application/json
content-length: 69
x-request-id: 0ae55a76-acb6-4ee0-929c-281cdc54af5b
via: 1.1 google
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=2592000

{ "code": "UNAUTHORIZED", "message": "invalid authentication token" }