{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "subject": {
    "type": "tool",
    "id": "optimizely"
  },
  "surface": "https://support.optimizely.com/api/v2/help_center/articles/search.json?query=billing&per_page=3",
  "question": "access",
  "id": "p-20260924-optimizely-keyless-hc-search",
  "request": {
    "method": "GET",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, one IP",
    "body": "A single GET of the Help Center article search endpoint on support.optimizely.com, query 'billing', per_page 3. No credential, no cookie jar, no custom User-Agent. A second request in the same transcript searched 'plan options and costs'."
  },
  "observed": {
    "status": 200,
    "headers": {
      "content-type": "application/json; charset=utf-8",
      "x-rate-limit": "700",
      "access-control-allow-origin": "*",
      "x-rate-limit-remaining": "632"
    },
    "decoded": {
      "result": "count 164 for the query 'billing', three results returned, each with title, html_url and the article's full body HTML, including \"Manage your account's plan and invoices\" and \"Usage and billing dashboards\"",
      "why-it-matters-here": "both product surfaces this entry measures, the MCP server and the REST API, refuse a stranger with 401; this support-search surface is the one measured route by which an agent with no Optimizely account reaches the vendor's own account-administration documentation, and it is how the billing evidence in version 4 of this entry was located",
      "second-instance": "the same endpoint answered the same way on support.zendesk.com the same day; that measurement is proposed as p-20260924-zendesk-keyless-hc-search in PR #155 and was not on main when this record was filed, so it is pending evidence, not a filed record, and nothing here depends on it",
      "not-measured": "anything behind an Optimizely credential; whether an instance can turn this off; whether the rate limit is per IP or per instance",
      "user-agent": "the published command sends curl's default User-Agent; the section 1 request (server Date header 12:18:31 GMT) sent an unrecorded one, and the 18:04Z re-run with the default (section 5 of the artifact) answered the same status, count and rate-limit headers, so the observation does not depend on it",
      "correction": "version 1 of this record said x-rate-limit 10000; the artifact's section 1 says 700 and always did (the 10000 was copied from the Zendesk record); corrected 2026-09-24 on PR #156 before merge",
      "usage-articles": "sections 6 to 8 of the artifact (appended 2026-09-25, after the reviewer's second change request) locate the three usage articles the profile names ('Review impression usage', 'Monitor monthly active users (MAUs)', 'Troubleshoot MAU overages') through the same keyless search, list the 'Account administration' section that holds them beside the two billing articles, and read all three whole: none states a figure per impression, per MAU or per overage",
      "corrected": "2026-10-10 (version 2): version 1 gave `at` as 2026-09-24T12:28Z and the user-agent field called section 1 'the 12:28Z request'. 12:28Z is the minute the artifact was published, in its file name (probes-1228Z.txt), not the minute of the request: the section 1 response carries the server's Date header Thu, 24 Sep 2026 12:18:31 GMT with cache-control max-age=0 and no age header, so it was served live at that minute, and the section 2 request that followed it is dated the same second. Found by the filer's own minute-level check of `at` against the artifact (tools/atcheck.py). `at` is now 12:18Z. Nothing in the finding changes."
    }
  },
  "finding": "An agent with no Optimizely account, no key and no cookie can search Optimizely's support help centre through the Zendesk REST API it runs on and receive whole articles: 164 matches for 'billing', including the vendor's own account-administration pages. It changes nothing about access to the product: both product surfaces this entry measures, the MCP server and the REST API, answer 401. It is a documented anonymous permission of the help-centre software rather than a lapse. What it establishes is that for a vendor whose measured product surfaces refuse a stranger, the documentation of how that vendor bills is machine-readable to one.",
  "reproducibility": {
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/optimizely/2026-09-24/probes-1228Z.txt",
    "command": "curl -sS -D- 'https://support.optimizely.com/api/v2/help_center/articles/search.json?query=billing&per_page=3'"
  },
  "at": "2026-09-24T12:18Z",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-09-24",
  "updated": "2026-10-10",
  "version": 2
}