Revdoku

3 of the 42 tools listed anonymously say in their own descriptions that they need an account or a key (bucket_publish_password_protected, bucket_publication_leads, bucket_publication_recipient_links), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

The server exposes a public surface before authorization: website_preview_create, website_preview_update, website_preview_status, revdoku_status, revdoku_dashboard_link, bucket_list, bucket_get, bucket_create, bucket_template_list, bucket_create_from_template, bucket_update, bucket_archive, bucket_unarchive, bucket_delete_permanently, bucket_file_list, bucket_file_read, bucket_file_get, bucket_file_write, bucket_file_append_text, bucket_file_write_many, bucket_file_rename, bucket_file_copy, bucket_file_move, bucket_file_reorganize, bucket_lock, bucket_unlock, bucket_lock_visibility_changes, bucket_lock_files, bucket_unlock_file, bucket_publish, bucket_publish_password_protected, bucket_publish_preview, bucket_set_public_slug, bucket_update_publication_access, bucket_unpublish, bucket_publication_list, bucket_publication_get, bucket_publication_analytics, bucket_publication_leads, bucket_publication_recipient_links, bucket_env_get, bucket_env_set.