{"openapi":"3.1.0","info":{"title":"Infrastructure Config Hardening API","version":"1.0.0","description":"Grade caller-supplied Dockerfiles, Kubernetes YAML, and Terraform JSON against baseline checks for root users, exposed ports, missing resource limits, and insecure defaults. The file is parsed in memory and is not applied or stored. Paid with x402 exact USDC on Base. No account is required.","contact":{"email":"support@brainiac.software"},"x-guidance":"BRAINIAC.software is a pay-per-call API for software agents. No account or API key is required.\nPayment uses the x402 protocol with exact USDC on Base (chain id 8453). Each POST operation has a fixed USD price.\nHow to call an operation:\n1. POST JSON matching the requestBody. Invalid input returns 400 with no payment challenge.\n2. A valid unpaid call returns 402 with the exact amount and payTo.\n3. Pay and retry with payment-signature. Payment settles only if the operation returns 2xx. A 4xx/5xx is not charged.\nInclude an Idempotency-Key header of 64 hex characters from 32 random bytes. Reuse that key only for retries of the same operation and request body.\nAll outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Verify time-sensitive or official data with the cited source before acting."},"servers":[{"url":"https://www.brainiac.software"}],"paths":{"/api/v1/devops/config-hardening-grade":{"post":{"operationId":"grade_infrastructure_config_hardening","summary":"Grade infrastructure config hardening","description":"Grade a caller-supplied Dockerfile, Kubernetes YAML document, or Terraform JSON file for root execution, exposed ports, missing resource limits, and insecure defaults. Parsing stays in memory. The file is not applied, fetched, or stored.","tags":["devops"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"config":{"type":"string","minLength":1,"maxLength":200000}},"required":["config"],"additionalProperties":false},"example":{"config":"FROM ubuntu:latest\nUSER root\nEXPOSE 22\nRUN curl https://example.com/install.sh | sh\nCMD [\"bash\"]\n"}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"security_grade":{"type":"string"},"vulnerability_percentage":{"type":"number"},"prioritized_findings":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"line":{"type":"number"},"block":{"type":"string"},"detail":{"type":"string"},"remediation":{"type":"string"},"impact_score":{"type":"number"}},"additionalProperties":true}},"audit_receipt":{"type":"string"}},"additionalProperties":true},"example":{"security_grade":"F","vulnerability_percentage":100,"prioritized_findings":[{"code":"runs_as_root","line":2,"block":"USER root","detail":"The last USER in the final stage is root.","remediation":"Add a USER instruction with a non-root uid before the final command.","impact_score":34},{"code":"piped_remote_script","line":4,"block":"RUN curl https://example.com/install.sh | sh","detail":"A remote script is piped into a shell. The script was not downloaded or executed.","remediation":"Download a pinned script, check its checksum, and run that file.","impact_score":30},{"code":"exposed_sensitive_port","line":3,"block":"EXPOSE 22","detail":"Port 22 is published by EXPOSE. This records the port in the image metadata. It does not open a host firewall.","remediation":"Remove the sensitive port or publish a non-default application port instead.","impact_score":28},{"code":"floating_image_tag","line":1,"block":"FROM ubuntu:latest","detail":"The base image has no pinned tag or uses latest. A later pull can change the image.","remediation":"Pin the image to a version tag or a sha256 digest.","impact_score":18},{"code":"missing_healthcheck","line":5,"block":"CMD [\"bash\"]","detail":"The final stage has no HEALTHCHECK. Docker will not mark the container unhealthy on its own.","remediation":"Add a HEALTHCHECK that calls the process readiness endpoint.","impact_score":8}],"audit_receipt":"sha256:fba37df1e56ca384b4942834c386359eab0c441bf7843afdb7f2fb7faf995c31"}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment required. The JSON body is the x402 PaymentRequired object: x402Version, resource with the operation description, accepts with the price and network, and extensions.bazaar with the input schema, input example, output schema, and output example."},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed before settlement, so no payment is taken. Reuse the same idempotency key to retrieve the stored error without paying again."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}],"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}}},"components":{"schemas":{"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}}}}}