# Infrastructure Config Hardening API

> Grade caller-supplied Dockerfiles, Kubernetes YAML, and Terraform JSON against baseline checks for root users, exposed ports, missing resource limits, and insecure defaults. The file is parsed in memory and is not applied or stored.

Each POST has a fixed USDC price on Base, paid with the x402 exact scheme. The request is validated first, and payment settles only after a successful (2xx) result. Failed calls are not charged.

1. POST JSON matching the requestBody. Invalid input returns 400 with no payment challenge.
2. A valid unpaid call returns 402 with the exact amount and payTo.
3. Pay and retry with payment-signature. Payment settles only if the operation returns 2xx. A 4xx/5xx is not charged.

- Product: https://www.brainiac.software/api/devops
- Docs: https://www.brainiac.software/api/devops/docs
- OpenAPI: https://www.brainiac.software/api/devops/openapi.json
- Contact: support@brainiac.software (https://www.brainiac.software/contact)

## Operations

### POST /api/v1/devops/config-hardening-grade

$0.04 USDC. Grade a caller-supplied Dockerfile, Kubernetes YAML document, or Terraform JSON file for root execution, exposed ports, missing resource limits, and insecure defaults. Parsing stays in memory. The file is not applied, fetched, or stored.

Inputs: config

Docs: https://www.brainiac.software/api/devops/docs#devops-config-hardening-grade

Example request:

```json
{
  "config": "FROM ubuntu:latest\nUSER root\nEXPOSE 22\nRUN curl https://example.com/install.sh | sh\nCMD [\"bash\"]\n"
}
```

Example response:

```json
{
  "security_grade": "F",
  "vulnerability_percentage": 100,
  "prioritized_findings": [
    {
      "code": "runs_as_root",
      "line": 2,
      "block": "USER root",
      "detail": "The last USER in the final stage is root.",
      "remediation": "Add a USER instruction with a non-root uid before the final command.",
      "impact_score": 34
    },
    {
      "code": "piped_remote_script",
      "line": 4,
      "block": "RUN curl https://example.com/install.sh | sh",
      "detail": "A remote script is piped into a shell. The script was not downloaded or executed.",
      "remediation": "Download a pinned script, check its checksum, and run that file.",
      "impact_score": 30
    },
    {
      "code": "exposed_sensitive_port",
      "line": 3,
      "block": "EXPOSE 22",
      "detail": "Port 22 is published by EXPOSE. This records the port in the image metadata. It does not open a host firewall.",
      "remediation": "Remove the sensitive port or publish a non-default application port instead.",
      "impact_score": 28
    },
    {
      "code": "floating_image_tag",
      "line": 1,
      "block": "FROM ubuntu:latest",
      "detail": "The base image has no pinned tag or uses latest. A later pull can change the image.",
      "remediation": "Pin the image to a version tag or a sha256 digest.",
      "impact_score": 18
    },
    {
      "code": "missing_healthcheck",
      "line": 5,
      "block": "CMD [\"bash\"]",
      "detail": "The final stage has no HEALTHCHECK. Docker will not mark the container unhealthy on its own.",
      "remediation": "Add a HEALTHCHECK that calls the process readiness endpoint.",
      "impact_score": 8
    }
  ],
  "audit_receipt": "sha256:fba37df1e56ca384b4942834c386359eab0c441bf7843afdb7f2fb7faf995c31"
}
```