Well-Known URIs

Well-Known URIs, standardized as RFC 8615, define the /.well-known/ path prefix — a reserved, predictable place on any web origin where a site can publish metadata and discovery documents. The idea is deceptively small: instead of every standard inventing its own location for its configuration file, they all agree to live under one directory, so a client can find them by construction rather than by guessing or crawling.

• A reserved path prefix - Everything under /.well-known/ is registered with IANA, so names don’t collide across standards.
• Predictable discovery - A client can fetch /.well-known/<name> on any origin without prior knowledge of the site’s layout.
• A registry of suffixes - Entries like openid-configuration, oauth-authorization-server, security.txt, and api-catalog are each governed by their own spec.
• Machine-first metadata - The pattern exists to be read by software, which makes it the backbone of automated configuration and discovery.

Across API operations, Well-Known URIs are the quiet plumbing beneath much of modern discovery and security. OAuth and OpenID Connect publish their configuration at well-known endpoints, security.txt tells researchers how to report vulnerabilities, and /.well-known/api-catalog (RFC 9727) is emerging as the place an organization lists its APIs. For the agentic turn this matters enormously: an automated client that knows only a domain can probe well-known locations to bootstrap authentication, find an API catalog, and understand a provider’s posture without a human in the loop.