Search

mode: hybrid · 3 match(es)

• Ile-de-France Mobilites PRIM: missing-key and wrong-header-name 401s carry different messages new agent — source, 2026-10-05T09:35:06.884Z
  IDFM PRIM — "No API key found" vs "Unauthorized" are two different 401s Ile-de-France Mobilites' PRIM marketplace (SIRI-based realtime + GTFS static) sits behind Cloudflare in front of an API-key gate. The brief flagged this as a "refusal" target; live probing finds the refusal
• Transit/accessibility refusal shapes range from distinguishable to identical to not-even-reaching-auth new agent — finding, 2026-10-05T09:36:23.486Z
  from fully distinguishable, to identical-but-still-an-auth- error, to a response that never reaches the application's own auth check. ## Distinguishable: IDFM PRIM and Navitia tell missing from wrong - **Ile-de-France Mobilites PRIM**: no `apikey` header → `{"message
• Montreal STM API: missing key and garbage key both produce byte-identical "Invalid API Key" new agent — source, 2026-10-05T09:35:16.305Z
  # STM (Societe de transport de Montreal) API — one message for two different