RFC 9727 has been a published IETF standard for over a year. It defines /.well-known/api-catalog as the machine entrypoint for discovering an organization’s APIs — a small, boring, eminently useful primitive. An agent (or a developer, or a tool) does a GET against that path, gets back an application/linkset+json document, and finds the URLs of every OpenAPI, AsyncAPI, or other spec the provider publishes. No HTML crawl. No “the docs are over here, the spec is over there”. One known place, one machine-readable answer. I have been writing about this pattern for the better part of two years. I added well-known-catalog as a forward-looking dimension in the agent-readiness model I shipped this week. And I noticed yesterday, while writing up Merge.dev’s pipeline refresh, that Merge had quietly added one — ten entries, one per Unified API category, with the OpenAPI YAML on each typed link. That made me wonder how many other providers I’d missed. So I ran a probe. Seventy-four providers — every company in the recent round of API Evangelist pipeline refreshes (the embedded iPaaS players, the identity providers, the cloud gateways, the docs platforms, the SDK generators, the agent infrastructure companies, the observability vendors) plus the obvious large surfaces that should have one if anyone does (Stripe, Twilio, GitHub, Salesforce, Microsoft Graph, Google, Postman, Plaid, Slack, Shopify, every API gateway). Six URL candidates per provider — bare domain, docs., developer., developers., api., platform.. Five hundred and eighteen HTTPS requests, fired in parallel. The answer is four Four providers serve a real RFC 9727 LinkSet at /.well-known/api-catalog: Provider Endpoint Entries Notable Cloudflare developers.cloudflare.com/.well-known/api-catalog 1 Returns application/linkset+json; profile=”https://www.rfc-editor.org/info/rfc9727”. Points at the bundled openapi.json. Three different host prefixes all resolve to the same content. Memesio memesio.com/.well-known/api-catalog 2 The only catalog I observed that publishes both the REST API and the MCP server endpoint as separate linkset entries. The template the other three should copy. Merge.dev docs.merge.dev/.well-known/api-catalog 10 The deepest catalog — one entry per Unified API category (HRIS, ATS, Accounting, CRM, Ticketing, File Storage, plus the newer ones). Each entry points at a category-specific OpenAPI YAML. The model for how a multi-product provider should structure their catalog. Zuplo zuplo.com/.well-known/api-catalog 1 The only catalog whose typed link explicitly declares the OpenAPI version (application/vnd.oai.openapi+json;version=3.1). A gateway company practicing what they preach. That is the entire field as of today. Four out of seventy-four. Two providers returned a clean 404. Sixty-eight returned 200 OK — but the body was HTML. They were single-page-app catch-all routes serving the homepage from the well-known path. An agent following the standard would get a 200, try to parse a LinkSet out of the body, fail, and have no useful recourse. That is worse than a 404. A 404 tells the agent the resource doesn’t exist; an HTML 200 at a well-known path lies. The four are not who I expected I expected Stripe to have one. They don’t. I expected Twilio to have one. They don’t. I expected at least one of the big docs platforms —…