All 139 endpoints
Every public endpoint across chaos, not, and bots in one filterable view. Surface tags scope to a single host; layer tags filter by what the chaos targets; category tags narrow further. The search box matches paths, methods, summaries, and category names — press / from anywhere to focus it.
Claims the canonical agent URL is https://agents.catastrophic.io/echo. Also served at /.well-known/agent.json for the older Google A2A path.
Parametric chaos for the Agent Skills Discovery v0.2.0 index. Four modes covering digest mismatch, missing schema reference, dead skill URLs, and stale schema-version declarations. The spec is at v0.2.0 (cloudflare/agent-skills-discovery-rfc) — less volatile than MCP but still pre-1.0; modes target the stable core shape.
An ai.txt — the AI-scraping equivalent of robots.txt — that contradicts itself, references AI bots that don't exist, or returns malformed directives.
iOS universal-links manifest (AASA). Apple is famously strict about the Content-Type, JSON validity, appID format (TEAMID.bundle.id), and the paths array. These modes break each of those expectations.
Android App Links manifest. Android verifies app links by checking SHA-256 fingerprints, package_name, and relation strings against a strict schema. These modes break each of those.
AT Protocol (Bluesky) handle verification. A domain proves it owns a DID by returning the DID identifier in this file. Modes return malformed DIDs, multiple lines (spec says single), wrong DID methods, or empty content.
Parametric chaos for the SEP-1649 MCP Server Card. Four modes covering transport-omission, protocol-version mismatch, dead transport URLs, and schema-invalid documents. The spec is still moving (modelcontextprotocol#2127); these modes target the stable core shape and may need realignment when 1.0 lands.
Fediverse server discovery document. Mastodon, Pleroma, Misskey, and other federated software fetch this to advertise their identity. Modes break the link's rel value, claim impossible versions, or point at other hosts.
Claims the OAuth issuer is https://identity.catastrophic.io. Disagrees with the OIDC document above and with the agent card.
Fourth sibling in the discovery quartet (OIDC + AS + agent-card + this). RFC 9728 Protected Resource Metadata describes the resource-server side of the OAuth dance. The default mode joins the conflicting-discovery group; an agent walking all four wells-known finds four contradictory authority claims to reconcile.
Claims the OIDC issuer is https://catastrophic.io. Compare against the sibling OAuth AS document and the agent card — they each claim a different authoritative host.
An RFC 9116 security.txt with broken required fields: an Expires date in the past, dead Contact URLs, total nonsense in every field, or a Canonical that doesn't include the served URL.
An IAB ads.txt with internally contradictory authorized-seller declarations, fictitious ad networks, or malformed lines that ads.txt crawlers should reject.
A humans.txt that contradicts itself, recursively references itself for every field, or contains time-paradox dates.
An llms.txt (the proposed convention for telling LLMs about site structure) that lists pages that 404, contradicts itself, or embeds prompt-injection content. Tests whether AI agents that ingest llms.txt sanitise it before acting.
PWA web app manifest. Wide tooling consumption — Chrome, Lighthouse, browser PWA installers all parse this and complain when it's wrong. Modes break required icons, start_url, display modes, colors, or name fields.
A robots.txt that contradicts itself, sets impossible crawl delays, or returns malformed directives. Crawlers that parse strictly should reject; lenient crawlers will produce unpredictable behaviour.
A sitemap that crawlers will follow into bad places: 404 URLs, future-dated lastmod values, circular sitemap-index references, or a body that claims gzip encoding but isn't gzipped.
Third sibling. Claims the canonical agent lives at https://agents.catastrophic.io/echo — yet another host. Also served at /.well-known/agent.json for the older Google A2A path.
Parametric chaos for the Agent Skills Discovery v0.2.0 index — the well-known document AI agents check to learn what skills a host advertises. Default mode is an index whose declared sha256 digest doesn't match the skill body it references; other modes cover missing schema reference, 404 skill URLs, and stale schema versions.
Parametric chaos for well-known discovery schemas. Pick a schema (openid-configuration, oauth-authorization-server, webfinger, jwks, host-meta, agent-card) and a mode (semantic, missing-fields, wrong-types). The response is served with the correct Content-Type for the chosen schema, so clients that key on Content-Type behave as they would against a real server. Set ?ai=true to have an edge LLM generate a fresh source on each call — the mode transformation is then applied on top.
Parametric chaos for the SEP-1649 MCP Server Card — the well-known document AI agents check to learn what tools, prompts, and resources an MCP server claims to offer. Default mode is a card with capabilities but no transport field; other modes cover protocol-version mismatch, dead transport URLs, and schema-invalid documents.
Second sibling. Claims the OAuth issuer is https://identity.catastrophic.io — a different host than the OIDC document above. An agent reconciling these two will need to decide which authority wins (or fail safely).
RFC 9728 Protected Resource Metadata for the OAuth client-server chaos quartet. Default mode joins the conflicting-discovery group with an issuer that disagrees with the OIDC and AS documents; other modes exercise resource-server-specific flaws (unreachable AS, unregistered bearer methods, mismatched resource identifier).
First of three sibling discovery documents that deliberately contradict each other. Claims the OIDC issuer is https://catastrophic.io. Compare against the OAuth AS doc and the agent card.
Returns ActivityStreams 2.0 / ActivityPub objects with spec violations. Default omits the required @context. Use ?mode= to isolate other violations: a type outside the AS2 vocabulary, a non-URI actor, or an object whose shape doesn't match its activity type. Consumed by Mastodon, Misskey, and other Fediverse servers during federation.
Returns Atom 1.0 feeds (RFC 4287) with spec violations. Default omits the required entry id element. Use ?mode= to isolate other violations: wrong date format, missing author, or incorrect rel=self link.
Returns 401 with WWW-Authenticate challenges that contradict each other, omit required attributes, violate quoting rules, or use undefined schemes. Tests how auth clients cope when the challenge itself is broken.
Returns 401 with a WWW-Authenticate challenge when no Authorization header is present. If any Authorization header is sent — regardless of its value — returns 200. This lets clients exercise the full challenge-response cycle without needing real credentials.
Returns binary byte payloads with Content-Length or Content-Type lies. Default claims twice as many bytes as it sends, hanging clients that wait for the full declared body. Use ?mode= to isolate other violations.
Sends contradictory Cache-Control directives. Default bundles three contradictions in one header (no-store with max-age, no-cache with immutable, private with s-maxage). Use ?mode= to test how a specific RFC 9111 conflict is resolved by your cache or proxy.
Returns CloudEvents 1.0 envelopes with spec violations. Default claims specversion 0.3 instead of 1.0. Use ?mode= to isolate other violations: `type` as an integer, a datacontenttype mismatch, or both `data` and `data_base64` present.
Returns responses where Content-Encoding lies about the body's actual compression state, or where the body is gzip-compressed but the header doesn't say so. Tests how clients and proxies handle disagreement between encoding metadata and bytes.
Returns malformed Set-Cookie headers that real-world clients silently drop, accept differently, or argue about. Ten modes covering SameSite, expiry, prefix, folding, domain, and CHIPS violations.
Sends broken or missing CORS headers in four distinct modes. Handles OPTIONS preflight as well as regular methods, so behavior is testable end-to-end from a browser.
Returns CSV with RFC 4180 corner-case violations: unquoted commas, embedded newlines, UTF-8 BOM at start, ragged column counts. Targets data pipelines, BI tools, and ML preprocessing — anywhere CSV is the lingua franca and parsers vary in strictness.
Starts responding immediately but streams the body in small chunks with a configurable delay between each chunk. Unlike /slow, the response headers arrive right away — only the body trickles.
Returns ETag and Last-Modified headers that break HTTP conditional-request semantics. Tests caches, CDNs, and clients that rely on validators.
Returns a failure response with probability p, otherwise 200. Both outcomes include X-Chaos-Flaky-Failed and X-Chaos-Flaky-Probability headers so clients can distinguish a chaos failure from a real one.
Returns GeoJSON documents with RFC 7946 violations. Default returns a Polygon whose ring does not close. Use ?mode= to isolate other violations: lat/lon axis swap, type/coordinates mismatch, or absent `properties` member.
Returns N custom response headers. Tests header size limits in clients, proxies, and load balancers. Many stacks reject or silently drop responses above a threshold.
Returns HTML documents with deliberate structural flaws. Useful for testing browser parsers, scraper robustness, and ML preprocessing pipelines that ingest HTML. Default mode produces visible misnesting on a bare GET; other modes target charset, doctype, or unterminated-tag handling.
Image responses where the declared MIME type, magic bytes, embedded dimensions, chunk framing, or format metadata disagree with the actual content. Seven modes across PNG, JPEG, WebP, GIF, and AVIF test how image pipelines handle metadata-vs-bytes mismatches.
Returns syntactically invalid JSON with a Content-Type of application/json. Default bundles three flaws in one payload (missing closing brace, unquoted key, trailing comma). Use ?mode= to isolate a single failure mode for targeted parser testing.
Returns JSON Feed 1.1 documents with semantic violations that parse as valid JSON but break spec compliance. Default sends a bare version string instead of the required URL. Use ?mode= to isolate other violations.
Returns JSON:API responses with spec-level violations. Default returns `data` as an array when a single resource is expected. Use ?mode= to isolate other violations: orphaned included resources, missing `id`, or missing `type`.
Returns JSON Lines (NDJSON) streams with stream-level violations. Targets ML pipelines, log aggregators, and AI chat exports — anywhere line-delimited JSON is consumed. Default mode is schema drift mid-stream; other modes cover blank lines, partial final records, and BOM start.
Returns JSON-RPC 2.0 responses with spec-level violations. Default omits the required `jsonrpc` version field. Use ?mode= to isolate other violations: mismatched response id, both result and error present, or a reserved-but-unassigned error code.
Returns 200 with a JWT the server claims to have accepted, demonstrating broken token-validation logic. The chaos is server acceptance of tokens that should be rejected. Default accepts alg:none tokens with no signature.
Returns JWT payload (claims) objects with RFC 7519 violations. Default sends `exp` as a string instead of a NumericDate. Use ?mode= to isolate other violations: malformed iss, mixed-type aud array, or a reserved claim with the wrong type. Distinct from /jwt (token-validation flaws) and /auth (challenge framing).
An endpoint that claims (via Allow or OPTIONS) to support GET/POST/PUT/PATCH/DELETE/OPTIONS but only actually handles GET. The chaos varies by mode: lying Allow header, silent success on wrong method, 405 without Allow, or OPTIONS that contradicts reality.
Returns a multipart/form-data response with RFC 7578 parser-adversity. Default declares one boundary in the Content-Type and uses a different one in the body. Use ?mode= to isolate other violations: missing terminating CRLF, ambiguous Content-Disposition `name=` parameters, or nested multipart bodies.
Returns RFC 6749 §5.1 token responses with schema violations. Default returns `expires_in` as a string instead of an integer. Use ?mode= to isolate other violations: comma-delimited scope, nonstandard token_type, or id_token without the openid scope.
Office Open XML container responses (DOCX, XLSX, PPTX) where one structural part of the package deliberately lies — wrong content type declaration, missing referenced part, dangling image relationship, or [Content_Types].xml claiming the package is multiple formats simultaneously. Macro-enabled containers, encrypted OOXML, and embedded OLE objects are deliberately not served — see the note below.
Returns paginated collections whose total_items lies, whose pages overlap each other, whose Link headers loop back to page 1, or whose returned size drifts from what the client requested.
Sends a Content-Type: application/json header and an opening fragment of a JSON object, then closes the stream cleanly after N bytes. No Content-Length, so there's no size mismatch to detect — the stream just ends before the body is complete. The result will fail JSON.parse() but doesn't look like a network error.
Returns a structurally flawed PDF where one element of the object graph deliberately lies — wrong xref byte offsets, a page tree claiming 100 pages when only one exists, a trailer referencing a nonexistent encryption dictionary, or a JavaScript OpenAction that fires on open. Default mode ships wrong xref offsets, the most fundamental structural lie.
Returns RFC 9457 Problem Details objects with spec violations. Default drops the required `type` field. Use ?mode= to isolate other violations: `status` as a string, a non-URI `instance`, or a Content-Type that claims application/json instead of application/problem+json.
Selects one chaos endpoint at random and returns its response. The selected path is reported in X-Chaos-Random-From so failing clients can pin down which scenario tripped them. Streaming endpoints (/slow, /drip, /partial-stream) are excluded so each pick returns promptly.
Returns HTTP Range responses that misbehave. Tests clients that rely on partial-content semantics: resumable downloads, video streaming, CDN slicing. Default sends a 206 with the correct Content-Range header but the wrong body bytes.
Always returns 429 Too Many Requests with Retry-After and X-RateLimit-* headers. Use ?lie=true to send a deceptive Retry-After value — the response body reports the real requested value so you can verify whether your client respected the header.
Redirects N times via 302 before returning a final 200. Each hop decrements the counter in the query string. Tests redirect-following limits, history tracking, and loop detection.
Token-keyed retry chaos. The first call for a given id returns version 1; any subsequent call for the same id within a 60-second window returns version 2 — same response shape, different data. Tests whether retry logic silently picks up changed data without noticing.
Returns RSS 2.0 feeds with spec violations. Default omits the required channel title. Use ?mode= to isolate other violations: wrong date format, non-URL guid marked as permalink, or enclosure MIME type lie.
Returns Schema.org / JSON-LD documents with vocabulary and context violations. Default points @context at a non-existent IRI. Use ?mode= to isolate other violations: unknown @type, missing required properties, or a context array that shadows a schema.org term.
Returns a structurally-valid JSON response matching one of six common discovery schemas, where every URL points at something that doesn't exist and every claim about capabilities is a lie. The shape passes schema validators; the values fail any consumer that actually tries to resolve them. Set ?ai=true to have an edge LLM generate a fresh, different drifted document on every call.
Sleeps for the specified number of milliseconds, then returns 200 with a JSON body confirming the delay.
Returns a Server-Sent Events stream with WHATWG EventSource spec violations. Default sends payload lines with no `data:` prefix. Use ?mode= to isolate other violations: named events with no listeners, discontinuous id ordering, or mixed CRLF/LF line endings.
Returns the requested HTTP status code. Body is JSON describing the response, except for 204 and 304 which return no body per RFC 9110.
Returns SVG documents that misbehave for browser renderers, image processors, and XML-strict parsers. SVG is an XML+rendering hybrid so chaos modes span both worlds: malformed XML structure, external-resource references, recursive <use> chains, and non-conformant namespaces.
Returns TOML documents with TOML 1.0 spec violations and parser ambiguity. Default mixes int, string, and float in a single array. Use ?mode= to isolate other violations: unquoted datetime, duplicate tables, illegal nesting, impossible offsets, dotted-key/table collisions, or trailing commas in inline tables.
Sends a Content-Length header claiming the full payload size, but closes the stream early. Tests how clients handle responses that end before they should.
Returns W3C Web Annotation objects with spec violations. Default omits the required `id` field. Use ?mode= to isolate other violations: wrong body type, invalid motivation vocabulary, or inconsistent target shape.
Returns a body whose declared Content-Type does not match its actual format. Default sends a JSON body labelled text/html. Other modes mismatch JSON-as-PNG, XML-as-JSON, HTML-as-JSON, or omit the Content-Type entirely. The X-Chaos-Body-Format header exposes the body's real format so clients can detect the mismatch programmatically.
Returns XML documents with parser-attack or well-formedness flaws. Targets SOAP, B2B, RSS/sitemap, and config-file ingestion pipelines. Default mode is visible misnesting; other modes cover entity-expansion DoS, external-entity references, and declaration-vs-body encoding mismatch.
Returns YAML documents that exploit the YAML 1.1 vs 1.2 split and parser ambiguity. Default sends the Norway problem: bare `NO/YES/ON/OFF` scalars that YAML 1.1 parsers coerce to booleans while YAML 1.2 parsers leave as strings. Use ?mode= to isolate other violations: recursive anchors, duplicate keys, or tag lies.
ZIP archive responses with a deliberate structural flaw — wrong CRC32, central-directory-vs-local-header disagreement, ZIP64 size lie, or truncated central directory. Tests how archive extractors, package managers, and scanners handle metadata-vs-bytes contradictions. Zip-slip and zip-bomb are deliberately not served — see the note below.
Agent card whose URL matches the issuer claimed by the OIDC and OAuth discovery docs. The three sibling .well-known documents agree on a single authority.
Agent Skills Discovery v0.2.0 index control. References a single skill stub at not.catastrophic.io/.well-known/agent-skills/echo.json so the discovery chain resolves end-to-end. The sha256 digest is all-zeros — obviously fake but format-correct, same pattern AASA and assetlinks use on this host. Build against this baseline; flip hostname to chaos to exercise the failure modes.
Well-formed ai.txt with non-contradictory directives. Allows the major real AI crawlers explicitly, sets no impossible delays, no fake bot names.
iOS universal-links manifest. Served as application/json with a single applinks block, an appID in TEAMID.bundle format, and a non-empty paths array. Apple's verifier should accept without warnings.
Android App Links manifest. Single statement asserting delegate_permission with a get_login_creds relation, a well-formed android_app target including SHA-256 fingerprint in the standard colon-delimited 64-byte hex format.
AT Protocol (Bluesky) handle verification. Returns a single line in valid DID format using the did:web method, pointing at this same host — so the binding is self-consistent.
SEP-1649 MCP Server Card control. Self-consistent: serverInfo + protocolVersion that matches the capabilities + transport URL that actually resolves on this same host (to a minimal MCP error stub at /mcp returning a valid JSON-RPC 'Method not found' response). Build a client against this baseline; flip hostname to chaos.catastrophic.io to exercise the failure modes.
Fediverse server discovery document with a valid links array. The rel value matches the standard nodeinfo schema URL; the href points at a real /nodeinfo/2.0 endpoint on the same host.
OAuth Authorization Server metadata claiming the same issuer as the OIDC discovery doc above. Counterpart to the chaos document, which deliberately disagrees with its siblings.
RFC 9728 Protected Resource Metadata control. resource matches the URL the document is served from; authorization_servers points at not.catastrophic.io/.well-known/oauth-authorization-server (a well-formed AS doc on this same host) so the discovery chain resolves end-to-end. bearer_methods_supported uses only IANA-registered values.
OIDC discovery doc whose issuer is `https://not.catastrophic.io` and whose endpoint URLs all resolve to real stubs on this same subdomain. Self-consistent with the OAuth AS and agent-card docs.
RFC 9116 compliant security.txt. Expires field is in the future, Contact URL resolves, Canonical matches the served URL. Validators should accept without warnings.
Returns a well-formed ActivityStreams 2.0 / ActivityPub object: @context present, `type` from the AS2 vocabulary, `actor` a dereferenceable URI, `object` consistent with the activity type. Served as application/activity+json. Counterpart to /activitystreams, which ships one of four violations.
Minimal valid IAB ads.txt. Single authorized-seller line with a real-format domain, publisher account ID, and DIRECT relationship. Not operationally meaningful (catastrophic.io doesn't sell ads) but parses without complaint.
Returns a well-formed Atom 1.0 feed: every entry has an id, updated uses RFC 3339, author is present at feed level, and rel=self points to this feed's own URL. Counterpart to /atom, which ships one of four violations.
Returns n random bytes with accurate Content-Length and Content-Type: application/octet-stream. Deterministic by ?seed= for reproducibility. Counterpart to /bytes, which lies about byte count or MIME type.
Returns a single, sensible Cache-Control directive (`public, max-age=300`). Counterpart to the chaos /cache-confused endpoint, which combines mutually contradictory directives.
Returns a well-formed CloudEvents 1.0 envelope: `specversion` is "1.0", `type` is a non-empty string, `datacontenttype` matches the `data` shape, only `data` present (no `data_base64`). Served as application/cloudevents+json. Counterpart to the chaos /cloudevents endpoint.
Returns a body of `at` bytes with a Content-Length header that matches the actual bytes sent. Counterpart to the chaos /truncate endpoint, which lies about its body length.
Returns a complete, well-formed JSON body — no early close. Counterpart to the chaos /partial-stream endpoint, which sends a Content-Type: application/json header and an opening JSON fragment, then closes mid-payload.
RFC 4180 compliant CSV control. Header + 3 rows, all 3 columns, no BOM, fields containing commas are quoted, CRLF line endings throughout. Build a client against this baseline; flip hostname to chaos.catastrophic.io to exercise the four failure modes.
Returns a well-formed GeoJSON Feature: Polygon ring closed (first and last positions identical), coordinates in [longitude, latitude] order, `type` consistent with `coordinates` shape, `properties` member present. Served as application/geo+json. Counterpart to the chaos /geojson endpoint.
Well-formed HTML control. Tags nest correctly, declared charset matches body bytes, doctype matches the markup version, no tag is left open. Use this as the parser-passes baseline; flip hostname to chaos.catastrophic.io to exercise the four failure modes.
Standard humanstxt.org format. /* TEAM */ and /* SITE */ sections, real-looking field values, no recursion, no time paradoxes.
Returns a real 1×1 PNG whose magic bytes, Content-Type, Content-Length, and IHDR dimensions all agree. Counterpart to the chaos /image endpoint, which deliberately ships images whose metadata contradicts the bytes.
Deterministic well-formed comment HTML for any path tail. Links to author, parent post, and sibling/related comments.
Deterministic well-formed post HTML for any path tail. Links to author, comments on this post, and related posts.
Deterministic well-formed product HTML for any path tail. Links to related products and reviewing users.
Deterministic well-formed user HTML for any path tail. Links to the user's posts, comments, and followed users.
Deterministic well-formed comment JSON for any path tail.
Deterministic well-formed post JSON for any path tail.
Deterministic well-formed product JSON for any path tail.
Deterministic well-formed user JSON for any path tail.
Returns syntactically valid JSON with a Content-Type of application/json. Counterpart to the chaos /json endpoint, which deliberately ships invalid JSON.
Returns a spec-compliant JSON Feed 1.1 document: `version` is the full URL, item `id` values are unique, item `url` values are absolute, and `feed_url` matches this feed's own URL. Counterpart to /json-feed, which ships one of four violations.
Returns a well-formed JSON:API response: single resource object with `type`, `id`, `attributes`, and `relationships`; all `included` resources referenced by a relationship. Served as application/vnd.api+json. Counterpart to the chaos /jsonapi endpoint.
Conformant NDJSON control. One valid JSON object per line, consistent schema across all records, LF line endings, trailing newline, no BOM. Build a client against this baseline; flip hostname to chaos.catastrophic.io to exercise the four failure modes.
Returns a well-formed JSON-RPC 2.0 response: `jsonrpc` version present, `id` matching the implied request, `result` present without `error`. Counterpart to the chaos /jsonrpc endpoint.
Returns a well-formed JWT payload (claim set): `iss` is a URI, `sub` is a string principal identifier, `aud` is a homogeneous array of StringOrURI values, `exp` and `iat` are NumericDate integers. Counterpart to /jwt-payload, which ships one of four RFC 7519 violations.
Returns 401 with a JSON body listing every check a correct JWT validator applies: alg pinned to RS256, alg:none rejected, exp checked, nbf checked, kid sanitized before key lookup, signature required. Counterpart to /jwt, which accepts tokens that fail these checks.
answer.ai-format llms.txt with a one-H1 heading, brief description, and only resolvable links. Lightweight version of the hub's llms.txt — points at this control surface, not the whole catalog.
PWA web app manifest with all required fields populated, a non-empty icons array, internally consistent display modes, valid colour values, and matching name/short_name. PWA installers should offer the install prompt.
Returns a JSON body labelled application/json — the Content-Type matches the body. Counterpart to the chaos /wrong-content-type endpoint, which mismatches the two on purpose.
Returns a well-formed multipart/form-data response: declared boundary matches body delimiter, every part has a single Content-Disposition `name=` parameter, closing boundary has the trailing CRLF, no nested multipart. Two parts: a text field and a file field. Counterpart to /multipart.
Backing nodeinfo 2.0 document linked from /.well-known/nodeinfo. Minimal valid shape — software name, version, usage stats, openness flags — so the link chain from /.well-known/nodeinfo actually resolves.
Returns a well-formed RFC 6749 §5.1 token response: `expires_in` as integer, `scope` space-delimited, `token_type` as "Bearer", `refresh_token` present. Cache-Control: no-store. Counterpart to the chaos /oauth-token endpoint.
Returns a well-formed Office Open XML package (DOCX, XLSX, or PPTX) where [Content_Types].xml, every relationship, and every referenced part are present and self-consistent. Counterpart to the chaos /ooxml endpoint, which deliberately ships packages where one structural field lies.
Returns a well-formed PDF: five-object document (Catalog, Pages node, Page, content stream with Helvetica text, and a link annotation to catastrophic.io). xref offsets accurate, page count honest, no encryption reference, no JavaScript actions. Counterpart to the chaos /pdf endpoint.
Returns a well-formed RFC 9457 Problem Details object: `type` URI present, `status` as integer 404, `detail` string, `instance` as a URI reference. Counterpart to the chaos /problem-details endpoint.
Returns correct HTTP Range responses: 206 with the exact requested bytes and an accurate Content-Range header, 416 for unsatisfiable ranges, 200 + full body on If-Range ETag mismatch. Counterpart to /range, which lies about which bytes it returns.
Returns a discovery document whose URLs all resolve to real stubs on this same subdomain. Counterpart to the chaos /semantic-drift endpoint, where the shape passes validation but every claimed URL is dead.
Standards-compliant robots.txt with a clean Allow-all, named explicit allows for major AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot, Bytespider), and a sitemap reference. Mirrors the hub's operational robots.txt.
Returns a well-formed RSS 2.0 feed: channel title present, pubDate in RFC 822 format, guid is a valid permalink URL, no enclosure type lies. Counterpart to /rss, which ships one of four violations.
Returns a well-formed Schema.org / JSON-LD document: @context is https://schema.org, @type is in the vocabulary, all required properties for the type are present, no context-array shadowing. Served as application/ld+json. Counterpart to /schema-org, which ships one of four violations.
Valid XML sitemap with sane recent lastmod dates and URLs that all resolve. Minimal — lists this host's well-known control endpoints, not an exhaustive crawl.
Returns a well-formed Server-Sent Events stream: `data:`, `event:`, `id:`, and `retry:` fields all correctly framed, blank-line event separators, four events then close. Served as text/event-stream. Counterpart to /sse, which ships one of four WHATWG EventSource violations.
Conformant SVG control. Declared SVG namespace, correctly nested tags, no external references, no <use> cycles. Renders identically in every browser and SVG processor. Build a client against this baseline; flip hostname to chaos.catastrophic.io to exercise the failure modes.
Returns a well-formed TOML 1.0 document: top-level scalars, sub-table, arrays of tables, RFC 3339 datetime, homogeneous arrays. Served as application/toml. Counterpart to /toml, which ships one of seven TOML 1.0 violations.
Returns a spec-compliant W3C Web Annotation object: `id` present, `body` is a TextualBody object, `motivation` is from the standard vocabulary, `target` is a URI string. Counterpart to /web-annotation, which ships one of four violations.
Well-formed XML control. Declaration is honest, tags nest correctly, no entity declarations, no external references, body bytes match the declared encoding. Build a client against this baseline; flip hostname to chaos.catastrophic.io to exercise the failure modes.
Returns a well-formed YAML 1.2 document: scalars, mapping, sequence, and a sane anchor + merge-key. No Norway-problem scalars, no cycles, no duplicate keys, no tag lies. Served as application/yaml. Counterpart to /yaml.
Returns a well-formed STORED ZIP archive: single entry hello.txt, correct CRC32, declared sizes match the body, central directory entries agree with the local file header, EOCD present. Counterpart to the chaos /zip endpoint, which deliberately ships archives where one structural field lies.