diff --git a/dhscanner-kbapi.cabal b/dhscanner-kbapi.cabal
--- a/dhscanner-kbapi.cabal
+++ b/dhscanner-kbapi.cabal
@@ -28,7 +28,7 @@
     fundamental modifications to the structure or specification
     of code facts.
 
-version:            1.0.5
+version:            1.0.6
 license:            GPL-3.0-only
 license-file:       LICENSE
 author:             OrenGitHub
diff --git a/json-schema-creator/Main.hs b/json-schema-creator/Main.hs
--- a/json-schema-creator/Main.hs
+++ b/json-schema-creator/Main.hs
@@ -43,6 +43,12 @@
 instance ToSchema FoundHttpGetHandlerRequestObject
 instance ToSchema FoundHttpGetHandlerRequestObjectMatch
 
+instance ToSchema UnauthenticatedHttpGetHandlerRequestObject
+instance ToSchema FoundUnauthenticatedHttpGetHandlerRequestObject
+instance ToSchema AuthenticatedHttpGetHandlerRequestObject
+instance ToSchema FoundAuthenticatedHttpGetHandlerRequestObject
+instance ToSchema FoundAuthenticatedHttpGetHandlerRequestObjectMatch
+
 instance ToSchema CommentsInFunction
 instance ToSchema FoundCommentsInFunction
 instance ToSchema Comment
diff --git a/src/Content.hs b/src/Content.hs
--- a/src/Content.hs
+++ b/src/Content.hs
@@ -130,6 +130,74 @@
      }
      deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
 
+-- | Symmetric GET variant of 'UnauthenticatedHttpPostHandlerRequestObject'.
+-- Enumerates HTTP GET handlers whose bodies contain /no/ call to any
+-- recognized authenticating function (per the Prolog predicate
+-- @utils_unauthenticated_http_get_handler_request_object/3@ ).
+--
+-- Together with 'AuthenticatedHttpGetHandlerRequestObject' this is the
+-- GET half of the "first fork" the LLM agent hits : auth vs pre-auth
+-- endpoints. See the OWASP-IL 2026 talk notes ("first move" bridge
+-- slide) for the harness-side story.
+data UnauthenticatedHttpGetHandlerRequestObject
+   = UnauthenticatedHttpGetHandlerRequestObject
+     {
+         unauthenticatedHttpGetHandlerRequestObjectUrlParts :: [ String ],
+         unauthenticatedHttpGetHandlerRequestObjectLimit :: Word
+     }
+     deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+
+-- | Result payload for 'UnauthenticatedHttpGetHandlerRequestObject'. The
+-- per-match shape reuses 'FoundHttpGetHandlerRequestObjectMatch' because
+-- an unauthenticated GET handler carries no auth metadata to surface --
+-- symmetric to how 'FoundUnauthenticatedHttpPostHandlerRequestObject'
+-- reuses 'FoundHttpPostHandlerRequestObjectMatch'.
+data FoundUnauthenticatedHttpGetHandlerRequestObject
+   = FoundUnauthenticatedHttpGetHandlerRequestObject
+     {
+         foundUnauthenticatedHttpGetHandlerRequestObjectTotal :: Word,
+         foundUnauthenticatedHttpGetHandlerRequestObjectMatches :: [ FoundHttpGetHandlerRequestObjectMatch ]
+     }
+     deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+
+-- | Symmetric GET variant of 'AuthenticatedHttpPostHandlerRequestObject'.
+-- Enumerates HTTP GET handlers whose bodies contain a call to a
+-- recognized authenticating function that itself satisfies the strict
+-- "early-return-null on missing request-header value" structural gate.
+-- See @utils_authenticated_http_get_handler_request_object/5@ in
+-- utils.pl and the Prolog-side notes on the corresponding POST /5
+-- predicate.
+data AuthenticatedHttpGetHandlerRequestObject
+   = AuthenticatedHttpGetHandlerRequestObject
+     {
+         authenticatedHttpGetHandlerRequestObjectUrlParts :: [ String ],
+         authenticatedHttpGetHandlerRequestObjectLimit :: Word
+     }
+     deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+
+data FoundAuthenticatedHttpGetHandlerRequestObject
+   = FoundAuthenticatedHttpGetHandlerRequestObject
+     {
+         foundAuthenticatedHttpGetHandlerRequestObjectTotal :: Word,
+         foundAuthenticatedHttpGetHandlerRequestObjectMatches :: [ FoundAuthenticatedHttpGetHandlerRequestObjectMatch ]
+     }
+     deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+
+-- | A match for an authenticated GET handler request object query. Same
+-- shape as 'FoundAuthenticatedHttpPostHandlerRequestObjectMatch', with
+-- @GetHandler@ substituted for @PostHandler@ throughout the field
+-- naming to keep POST/GET results distinguishable at the JSON layer.
+data FoundAuthenticatedHttpGetHandlerRequestObjectMatch
+   = FoundAuthenticatedHttpGetHandlerRequestObjectMatch
+     {
+         foundAuthenticatedHttpGetHandlerLocation :: Location,
+         foundAuthenticatedHttpGetHandlerRequestObjectLocation :: Location,
+         foundAuthenticatedHttpGetHandlerRequestObjectMatchUrl :: String,
+         foundAuthenticatedHttpGetHandlerAuthenticatingFunctionName :: String,
+         foundAuthenticatedHttpGetHandlerHeaderKeyName :: String
+     }
+     deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+
 data CommentsInFunction
    = CommentsInFunction
      {
diff --git a/src/Kbapi.hs b/src/Kbapi.hs
--- a/src/Kbapi.hs
+++ b/src/Kbapi.hs
@@ -53,6 +53,8 @@
 data Query
    = ConstStringsMatching Content.ConstStringsMatching
    | HttpGetHandlerRequestObject Content.HttpGetHandlerRequestObject
+   | UnauthenticatedHttpGetHandlerRequestObject Content.UnauthenticatedHttpGetHandlerRequestObject
+   | AuthenticatedHttpGetHandlerRequestObject Content.AuthenticatedHttpGetHandlerRequestObject
    | UnauthenticatedHttpPostHandlerRequestObject Content.UnauthenticatedHttpPostHandlerRequestObject
    | AuthenticatedHttpPostHandlerRequestObject Content.AuthenticatedHttpPostHandlerRequestObject
    | CommentsInFunction Content.CommentsInFunction
@@ -64,6 +66,8 @@
 data QueryResult
    = FoundConstStringsMatching Content.FoundConstStringsMatching
    | FoundHttpGetHandlerRequestObject Content.FoundHttpGetHandlerRequestObject
+   | FoundUnauthenticatedHttpGetHandlerRequestObject Content.FoundUnauthenticatedHttpGetHandlerRequestObject
+   | FoundAuthenticatedHttpGetHandlerRequestObject Content.FoundAuthenticatedHttpGetHandlerRequestObject
    | FoundUnauthenticatedHttpPostHandlerRequestObject Content.FoundUnauthenticatedHttpPostHandlerRequestObject
    | FoundAuthenticatedHttpPostHandlerRequestObject Content.FoundAuthenticatedHttpPostHandlerRequestObject
    | FoundCommentsInFunction Content.FoundCommentsInFunction