api.univie.ac.at (authenticated gateway)
An API gateway on the university's apex domain. Probed 2026-08-30 on /, /v1, /api, /docs, /openapi.json, /swagger.json, /health and /.well-known/openapi: every path returns an identical structured JSON 400 - {"httpStatusNumber":400,"httpStatusCode":"Bad Request","errorMessage":"Could not parse Authorization header"} - with HSTS, X-Frame-Options DENY and a session cookie. That is a real, uniformly authenticated gateway, not a soft-200 or a parked host. No public documentation, no discoverable OpenAPI and no unauthenticated surface was located, so no contract is claimed for it. Recorded because it is a genuine institution-operated programmable surface that the June 2026 profile missed entirely.