# Zeus portal current application / IAM contracts
# Origin: https://zeus-portal.baloise.de
# Date: 2026-11-10

## Portal route state

GET `/` redirects to `/group/zeus`. The portal entry and mapped JSONWS, Axis, portal-upload, Gogo-shell and OSGi-console families terminate at the gateway 404 handoff rather than the authentication UI. Existing evidence remains `01a1b48a-e2c5-73e6-8759-12f24342eb79` and `01a1bebc-12d0-775f-b71a-82824799e5f9`.

## Current IAM selector state

POST `/auth/rest/public/authentication/applications/portal_zeus/access` now returns the ordinary 132-byte JSON:API 404 response on Zeus and every other tested Airlock tenant. The shorter `zeus` selector is also absent. The historical `portal_zeus` password-flow response from 2026-10-02 is retained as configuration history (`01a0f9fd-d920-72b6-95d5-28e086166d8e`), but it is not the current contract.

Current Zeus selector evidence is recorded in `recon/airlock-portal-selector-matrix-v3.txt`.

## Current location routing

POST `/auth/rest/public/authentication/location/interpret` with `{"location":"https://zeus-portal.baloise.de/group/zeus"}` still returns HTTP 200 with `location.interpretation` id 59.

POST `/auth/rest/public/authentication/location/access` with the same body recognizes the location but now starts the generic `default` flow: HTTP 401 `NOT_AUTHORIZED`, `PASSWORD_REQUIRED`, step `default-username-password`, UI path `{{SPA}}/auth/flow/default/password`.

Exact current interpret/access evidence is listed in `recon/airlock-portal-selector-matrix-v3.txt`. Thus the old portal URL remains an IAM-recognized location while its direct Liferay route is unavailable and its historical dedicated selector has been removed.