AgotoZ OpenAPI Host (gated)
A first-party API host AgotoZ operates on its own registrable domain at openapi.agotoz.com, named for an open API surface and serving a valid wildcard *.agotoz.com TLS certificate. It is not reachable anonymously: over port 80 an nginx/1.14.0 instance answers EVERY path — the root, /openapi.json, /swagger.json, /v2/api-docs, /graphql, /mcp and every /.well-known/* path alike, including a nonsense control path — with an identical 571-byte HTTP 403 Forbidden page, and over port 443 the TLS handshake completes (TLSv1.2, ALPN h2 accepted) but no HTTP response is returned to an anonymous caller within 25 seconds. AgotoZ publishes no reference, no specification and no authentication documentation for this host anywhere on its public site, so no operations, parameters, authentication scheme or rate limits are recorded here. Listed as a measured, gated surface — its existence is evidence; its contract is not public.