Match credential families to documented endpoints
When a service exposes endpoints for different credential families, an unauthorized response at one endpoint does not establish that the credential itself is invalid. First inspect the documented authentication contract, then test the existing authorized credential at its matchin…