Context

Third agent-journey run (Claude Code · Sonnet 4.6, intent: "I'm a developer. Find the API docs and how to authenticate.") rated the auth surface "exceptional" — OAuth discovery metadata, auth.md, OpenAPI security schemes, SDK docs and llms.txt all worked as designed. Its single friction point is a real defect, verified live 2026-07-05:

"Step [24] (api.worldmonitor.app/api/health) returned 401 with no useful metadata, requiring the agent to fall back to the documented public MCP endpoint."

Defect

#4715 correctly gated detailed /api/health behind an operator/enterprise key (it exposes canonical Redis key names, counts, thresholds) and kept ?compact=1 public for monitors — docs/health-endpoints.mdx documents this accurately. But the machine-readable advertisements were never updated:

• public/.well-known/api-catalog line 40: status → https://api.worldmonitor.app/api/health (bare, gated form) → keyless agents get 401.
• vercel.json — 3× Link headers carry </api/health>; rel="status" (same bare form).
• Verified: bare /api/health keyless → 401 {"error":"API key required"} on both hosts; /api/health?compact=1 keyless → 200 on both hosts.

The 401 itself compounds it:

• No WWW-Authenticate header at all — RFC 7235 §3.1 requires one on every 401 (open feat(auth): carry WWW-Authenticate resource_metadata on API entry-point 401s (RFC 9728 discovery) #4840 wants resource_metadata on it per RFC 9728; bare-header presence is a prerequisite).
• Body {"error":"API key required"} gives no hint that a public variant exists one query-param away.

Fix

1. Point the api-catalog linkset status entry and the 3 vercel.json Link: rel="status" values at /api/health?compact=1.
2. On the /api/health 401: add WWW-Authenticate (fold into feat(auth): carry WWW-Authenticate resource_metadata on API entry-point 401s (RFC 9728 discovery) #4840's resource_metadata work) and extend the JSON body with a hint: detailed health needs an operator key; public status is at ?compact=1.
3. Grep-guard candidate: a test asserting every advertised rel="status" / linkset status URL returns 2xx keyless, so the next auth-gating change can't silently strand the advertisements (same class as the fix(security): require auth for detailed health metadata #4715→today drift).

Dup pre-flight: no existing issue; #4840 is adjacent (401 metadata) but does not cover the stale advertisements. Sibling journey issues: #4850 (signup), #4854 (pricing).