{"openapi":"3.1.0","info":{"title":"Domain Security API","version":"1.0.0","description":"Compare caller-supplied DNS, certificate, address, ASN, and RPKI snapshots, and review custom-domain onboarding evidence. No network lookups are made. Paid with x402 exact USDC on Base. No account is required.","contact":{"email":"support@brainiac.software"},"x-guidance":"BRAINIAC.software is a pay-per-call API for software agents. No account or API key is required.\nPayment uses the x402 protocol with exact USDC on Base (chain id 8453). Each POST operation has a fixed USD price.\nHow to call an operation:\n1. POST JSON matching the requestBody. Invalid input returns 400 with no payment challenge.\n2. A valid unpaid call returns 402 with the exact amount and payTo.\n3. Pay and retry with payment-signature. Payment settles only if the operation returns 2xx. A 4xx/5xx is not charged.\nInclude an Idempotency-Key header of 64 hex characters from 32 random bytes. Reuse that key only for retries of the same operation and request body.\nAll outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Verify time-sensitive or official data with the cited source before acting."},"servers":[{"url":"https://www.brainiac.software"}],"paths":{"/api/v1/domain-security/domain-infrastructure-consistency-audit":{"post":{"operationId":"audit_domain_infrastructure_consistency","summary":"Audit domain infrastructure consistency","description":"Compare caller-supplied DNS answers, certificate names, addresses, prefixes, and RPKI results for one domain. audit_status is consistent, inconsistencies_detected, warnings, or incomplete. risk_level is low, medium, high, or critical. No DNS, TLS, WHOIS, or BGP lookup is performed.","tags":["domain-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253},"checkedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"snapshot":{"type":"object","properties":{"records":{"maxItems":128,"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["A","AAAA","CNAME","MX","NS","TXT"]},"name":{"type":"string","minLength":1,"maxLength":253},"value":{"type":"string","minLength":1,"maxLength":1024},"preference":{"type":"integer","minimum":0,"maximum":65535}},"required":["type","name","value"],"additionalProperties":false}},"certificates":{"maxItems":8,"type":"array","items":{"type":"object","properties":{"sans":{"maxItems":64,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"issuer":{"type":"string","minLength":1,"maxLength":200},"notBefore":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"notAfter":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"fingerprint":{"type":"string","minLength":32,"maxLength":95}},"required":["sans"],"additionalProperties":false}},"addresses":{"maxItems":64,"type":"array","items":{"type":"object","properties":{"ip":{"type":"string","minLength":2,"maxLength":45},"source":{"type":"string","enum":["dns","observed","origin"]}},"required":["ip"],"additionalProperties":false}},"prefixes":{"maxItems":64,"type":"array","items":{"type":"object","properties":{"prefix":{"type":"string","minLength":3,"maxLength":49},"asn":{"type":"integer","minimum":0,"maximum":4294967295},"rpki":{"type":"string","enum":["valid","invalid","not_found"]}},"required":["prefix"],"additionalProperties":false}},"owners":{"maxItems":64,"type":"array","items":{"type":"object","properties":{"ip":{"type":"string","minLength":2,"maxLength":45},"asn":{"type":"integer","minimum":0,"maximum":4294967295},"provider":{"type":"string","minLength":1,"maxLength":80}},"required":["ip"],"additionalProperties":false}}},"required":["records","certificates","addresses","prefixes"],"additionalProperties":false},"previous":{"type":"object","properties":{"records":{"maxItems":128,"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["A","AAAA","CNAME","MX","NS","TXT"]},"name":{"type":"string","minLength":1,"maxLength":253},"value":{"type":"string","minLength":1,"maxLength":1024},"preference":{"type":"integer","minimum":0,"maximum":65535}},"required":["type","name","value"],"additionalProperties":false}},"certificates":{"maxItems":8,"type":"array","items":{"type":"object","properties":{"sans":{"maxItems":64,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"issuer":{"type":"string","minLength":1,"maxLength":200},"notBefore":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"notAfter":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"fingerprint":{"type":"string","minLength":32,"maxLength":95}},"required":["sans"],"additionalProperties":false}},"addresses":{"maxItems":64,"type":"array","items":{"type":"object","properties":{"ip":{"type":"string","minLength":2,"maxLength":45},"source":{"type":"string","enum":["dns","observed","origin"]}},"required":["ip"],"additionalProperties":false}},"prefixes":{"maxItems":64,"type":"array","items":{"type":"object","properties":{"prefix":{"type":"string","minLength":3,"maxLength":49},"asn":{"type":"integer","minimum":0,"maximum":4294967295},"rpki":{"type":"string","enum":["valid","invalid","not_found"]}},"required":["prefix"],"additionalProperties":false}},"owners":{"maxItems":64,"type":"array","items":{"type":"object","properties":{"ip":{"type":"string","minLength":2,"maxLength":45},"asn":{"type":"integer","minimum":0,"maximum":4294967295},"provider":{"type":"string","minLength":1,"maxLength":80}},"required":["ip"],"additionalProperties":false}}},"required":["records","certificates","addresses","prefixes"],"additionalProperties":false},"expected":{"type":"object","properties":{"providers":{"maxItems":16,"type":"array","items":{"type":"string","minLength":1,"maxLength":80}},"asns":{"maxItems":32,"type":"array","items":{"type":"integer","minimum":0,"maximum":4294967295}},"ranges":{"maxItems":32,"type":"array","items":{"type":"string","minLength":3,"maxLength":49}},"names":{"maxItems":32,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"issuers":{"maxItems":8,"type":"array","items":{"type":"string","minLength":1,"maxLength":200}},"nameservers":{"maxItems":16,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"mailHosts":{"maxItems":16,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}}},"additionalProperties":false},"edge":{"type":"object","properties":{"providers":{"maxItems":16,"type":"array","items":{"type":"string","minLength":1,"maxLength":80}},"asns":{"maxItems":32,"type":"array","items":{"type":"integer","minimum":0,"maximum":4294967295}},"ranges":{"maxItems":32,"type":"array","items":{"type":"string","minLength":3,"maxLength":49}},"hosts":{"maxItems":32,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}}},"additionalProperties":false}},"required":["domain","snapshot"],"additionalProperties":false},"example":{"domain":"app.example.com","checkedAt":"2026-11-05T00:00:00.000Z","snapshot":{"records":[{"type":"A","name":"app.example.com","value":"198.51.100.8"},{"type":"A","name":"app.example.com","value":"203.0.113.10"},{"type":"CNAME","name":"www.app.example.com","value":"gone.example.net"},{"type":"TXT","name":"gone.example.net","value":"left"},{"type":"NS","name":"example.com","value":"ns1.expected.net"},{"type":"MX","name":"example.com","value":"mail.expected.net","preference":10}],"certificates":[{"sans":["other.example.com"],"issuer":"Other CA","notBefore":"2026-01-01T00:00:00.000Z","notAfter":"2026-02-01T00:00:00.000Z","fingerprint":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"}],"addresses":[{"ip":"198.51.100.8","source":"dns"},{"ip":"203.0.113.10","source":"dns"},{"ip":"192.0.2.50","source":"observed"}],"prefixes":[{"prefix":"198.51.100.0/24","asn":64501,"rpki":"invalid"},{"prefix":"203.0.113.0/24","asn":64500,"rpki":"valid"}],"owners":[{"ip":"198.51.100.8","asn":64501,"provider":"Other Net"},{"ip":"203.0.113.10","asn":64500,"provider":"Example Host"}]},"previous":{"records":[{"type":"A","name":"app.example.com","value":"203.0.113.10"},{"type":"NS","name":"example.com","value":"ns1.expected.net"},{"type":"MX","name":"example.com","value":"mail.expected.net","preference":10}],"certificates":[],"addresses":[{"ip":"203.0.113.10","source":"dns"}],"prefixes":[{"prefix":"203.0.113.0/24","asn":64500,"rpki":"valid"}],"owners":[{"ip":"203.0.113.10","asn":64500,"provider":"Example Host"}]},"expected":{"providers":["Example Host"],"asns":[64500],"ranges":["203.0.113.0/24"],"names":["app.example.com"],"issuers":["Example CA"],"nameservers":["ns1.expected.net"],"mailHosts":["mail.expected.net"]},"edge":{"providers":["Example Host"],"asns":[64500],"ranges":["203.0.113.0/24"],"hosts":["cdn.example.net"]}}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"audit_status":{"type":"string"},"risk_level":{"type":"string"},"dns_consistency":{"type":"object","properties":{"status":{"type":"string"},"names":{"type":"array","items":{"type":"string"}},"addresses":{"type":"array","items":{"type":"string"}},"detail":{"type":"string"}},"additionalProperties":true},"certificate_consistency":{"type":"object","properties":{"status":{"type":"string"},"matched":{"type":"boolean"},"names":{"type":"array","items":{"type":"string"}},"detail":{"type":"string"}},"additionalProperties":true},"ip_asn_consistency":{"type":"object","properties":{"status":{"type":"string"},"rows":{"type":"array","items":{"type":"object","properties":{"ip":{"type":"string"},"prefix":{"type":"string"},"asn":{"type":"number"},"rpki":{"type":"string"},"provider":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}}},"additionalProperties":true},"routing_consistency":{"type":"object","properties":{"status":{"type":"string"},"nameservers":{"type":"array","items":{"type":"string"}},"mailHosts":{"type":"array","items":{"type":"string"}},"detail":{"type":"string"}},"additionalProperties":true},"infrastructure_changes":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"name":{"type":"string"},"previous":{"type":"string"},"current":{"type":"string"},"impact":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"unexpected_assets":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"value":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"findings":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"severity":{"type":"string"},"name":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"audit_status":"inconsistencies_detected","risk_level":"critical","dns_consistency":{"status":"inconsistent","names":["app.example.com"],"addresses":["198.51.100.8","203.0.113.10"],"detail":"app.example.com has 2 supplied address answers. More than one address is not an inconsistency by itself."},"certificate_consistency":{"status":"inconsistent","matched":false,"names":["other.example.com"],"detail":"No supplied certificate name matches the domain. This compares the supplied names only."},"ip_asn_consistency":{"status":"inconsistent","rows":[{"ip":"198.51.100.8","prefix":"198.51.100.0/24","asn":64501,"rpki":"invalid","provider":"Other Net","detail":"198.51.100.8 uses supplied prefix 198.51.100.0/24. The result was not looked up."},{"ip":"203.0.113.10","prefix":"203.0.113.0/24","asn":64500,"rpki":"valid","provider":"Example Host","detail":"203.0.113.10 uses supplied prefix 203.0.113.0/24. The result was not looked up."},{"ip":"192.0.2.50","prefix":"","detail":"192.0.2.50 is not inside a supplied prefix."}]},"routing_consistency":{"status":"consistent","nameservers":["ns1.expected.net"],"mailHosts":["mail.expected.net"],"detail":"Nameserver and mail-host comparisons use the supplied records. They are not a live delegation lookup."},"infrastructure_changes":[{"kind":"address","name":"app.example.com","previous":"203.0.113.10","current":"198.51.100.8","impact":"unexplained","detail":"198.51.100.8 is in the current supplied answers and not in the previous answers. An address change is not by itself malicious."}],"unexpected_assets":[{"kind":"address","value":"192.0.2.50","detail":"192.0.2.50 is an unexplained address in the supplied snapshot. This is not a claim about who operates it."}],"findings":[{"code":"cname_dangling","severity":"high","name":"www.app.example.com","detail":"www.app.example.com aliases to gone.example.net, and the supplied records for that name do not provide an address. This is not a live lookup."},{"code":"address_outside_expected","severity":"high","name":"198.51.100.8","detail":"198.51.100.8 is outside the supplied expected ranges and edge ranges. This is not by itself malicious."},{"code":"address_not_in_dns","severity":"high","name":"192.0.2.50","detail":"192.0.2.50 is in the supplied address list and is not a supplied DNS answer for app.example.com. It is not covered by the supplied edge configuration."},{"code":"certificate_name_mismatch","severity":"high","name":"app.example.com","detail":"No supplied certificate name matches app.example.com. This is not a live TLS check."},{"code":"certificate_name_unexpected","severity":"high","name":"app.example.com","detail":"app.example.com is an expected certificate name and is not in the supplied names."},{"code":"issuer_unexpected","severity":"high","name":"Other CA","detail":"Other CA is not one of the supplied expected issuers. This is not a trust-anchor lookup."},{"code":"certificate_expired","severity":"critical","name":"app.example.com","detail":"The supplied certificate end 2026-02-01T00:00:00.000Z is before 2026-11-05T00:00:00.000Z. This uses the supplied timestamps only."},{"code":"asn_unexpected","severity":"high","name":"198.51.100.8","detail":"ASN 64501 for 198.51.100.8 is outside the supplied expected and edge ASNs. This is not a live ownership check."},{"code":"provider_unexpected","severity":"high","name":"198.51.100.8","detail":"Other Net is not one of the supplied expected or edge providers for 198.51.100.8."},{"code":"rpki_invalid","severity":"critical","name":"198.51.100.8","detail":"The supplied RPKI result for 198.51.100.0/24 is invalid. This is not a live BGP check."},{"code":"prefix_unmatched","severity":"high","name":"192.0.2.50","detail":"192.0.2.50 is not inside a supplied prefix. This is not a live routing lookup."},{"code":"snapshot_only","severity":"low","detail":"These records were supplied in the request. No DNS lookup, TLS connection, WHOIS query, or BGP lookup was performed. An address change is not by itself malicious."}],"limitations":["The audit compares the DNS, certificate, address, prefix, and RPKI values in the request. It does not query DNS, TLS, WHOIS, or BGP.","Missing evidence is incomplete. It is not a confirmed inconsistency.","An address or ASN change is not by itself malicious.","A CDN, proxy, load balancer, or multi-region address is expected only when the request supplies its host, range, ASN, or provider.","A supplied RPKI result is not a live routing validation, and a matching name is not current ownership.","Several addresses for one name are not an inconsistency by themselves."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment required. The JSON body is the x402 PaymentRequired object: x402Version, resource with the operation description, accepts with the price and network, and extensions.bazaar with the input schema, input example, output schema, and output example."},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed before settlement, so no payment is taken. Reuse the same idempotency key to retrieve the stored error without paying again."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}],"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}},"/api/v1/domain-security/infrastructure-health":{"post":{"operationId":"grade_domain_snapshot_health","summary":"Grade domain snapshot health","description":"Look through the supplied DNS records, certificate names, expiry date, and cipher names. A CNAME whose target has no A or AAAA in the snapshot, a certificate that omits the domain, an expiry before the supplied date, a weak cipher name, or a missing NS record raises the exposure. The grade follows that percentage. No DNS or TLS lookup is performed.","tags":["domain-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253},"as_of":{"type":"string","pattern":"^\\d{4}-\\d{2}-\\d{2}$"},"records":{"minItems":1,"maxItems":50,"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["A","AAAA","CNAME","TXT","NS","MX"]},"name":{"type":"string","minLength":1,"maxLength":253},"value":{"type":"string","minLength":1,"maxLength":512}},"required":["type","name","value"],"additionalProperties":false}},"certificate":{"type":"object","properties":{"names":{"maxItems":20,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"not_after":{"type":"string","pattern":"^\\d{4}-\\d{2}-\\d{2}$"},"ciphers":{"maxItems":20,"type":"array","items":{"type":"string","minLength":1,"maxLength":80}}},"required":["names","not_after","ciphers"],"additionalProperties":false}},"required":["domain","as_of","records","certificate"],"additionalProperties":false},"example":{"domain":"app.example.com","as_of":"2026-11-05","records":[{"type":"A","name":"app.example.com","value":"203.0.113.10"},{"type":"CNAME","name":"www.app.example.com","value":"gone.example.net"},{"type":"NS","name":"example.com","value":"ns1.expected.net"}],"certificate":{"names":["other.example.com"],"not_after":"2026-02-01","ciphers":["TLS_RSA_WITH_AES_128_CBC_SHA"]}}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"infrastructure_health_grade":{"type":"string"},"security_exposure_percentage":{"type":"number"}},"additionalProperties":true},"example":{"infrastructure_health_grade":"F","security_exposure_percentage":85}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment required. The JSON body is the x402 PaymentRequired object: x402Version, resource with the operation description, accepts with the price and network, and extensions.bazaar with the input schema, input example, output schema, and output example."},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed before settlement, so no payment is taken. Reuse the same idempotency key to retrieve the stored error without paying again."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}],"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}},"/api/v1/domain-security/custom-domain-onboarding-audit":{"post":{"operationId":"audit_custom_domain_onboarding","summary":"Audit custom domain onboarding","description":"Compare a custom domain, tenant, ownership TXT records, DNS targets, and platform assignment status. A dangling name is a potential condition only when the supplied assignment is unassigned or deleted. The audit does not query DNS or claim the domain.","tags":["domain-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253},"tenant":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$"},"verification":{"maxItems":16,"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["TXT","CNAME"]},"name":{"type":"string","minLength":1,"maxLength":253},"value":{"type":"string","minLength":1,"maxLength":1024}},"required":["type","name","value"],"additionalProperties":false}},"records":{"maxItems":64,"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["A","AAAA","CNAME","TXT"]},"name":{"type":"string","minLength":1,"maxLength":253},"value":{"type":"string","minLength":1,"maxLength":1024}},"required":["type","name","value"],"additionalProperties":false}},"token":{"type":"string","minLength":8,"maxLength":200},"targets":{"minItems":1,"maxItems":16,"type":"array","items":{"type":"object","properties":{"kind":{"type":"string","enum":["A","AAAA","CNAME"]},"value":{"type":"string","minLength":1,"maxLength":253}},"required":["kind","value"],"additionalProperties":false}},"assignments":{"maxItems":32,"type":"array","items":{"type":"object","properties":{"hostname":{"type":"string","minLength":1,"maxLength":253},"tenant":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$"},"status":{"type":"string","enum":["assigned","unassigned","deleted"]}},"required":["hostname","status"],"additionalProperties":false}},"previous":{"type":"object","properties":{"tenant":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$"},"domain":{"type":"string","minLength":1,"maxLength":253},"status":{"type":"string","enum":["pending","active","removed"]}},"required":["tenant","domain","status"],"additionalProperties":false},"certificates":{"maxItems":4,"type":"array","items":{"type":"object","properties":{"sans":{"maxItems":64,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"issuer":{"type":"string","minLength":1,"maxLength":200},"notBefore":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"notAfter":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"fingerprint":{"type":"string","minLength":32,"maxLength":95}},"required":["sans"],"additionalProperties":false}},"checkedAt":{"type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"},"status":{"type":"string","enum":["pending","active","removed"]}},"required":["domain","tenant","verification","records","token","targets"],"additionalProperties":false},"example":{"domain":"shop.example.com","tenant":"tenant-a","token":"platform-verify-token-shop","status":"removed","checkedAt":"2026-11-05T00:00:00.000Z","verification":[{"type":"TXT","name":"_verify.shop.example.com","value":"platform-verify-token-shop"}],"records":[{"type":"TXT","name":"shop.example.com","value":"platform-verify-token-shop"},{"type":"CNAME","name":"shop.example.com","value":"sites.platform.test"}],"targets":[{"kind":"CNAME","value":"sites.platform.test"}],"assignments":[{"hostname":"sites.platform.test","tenant":"tenant-a","status":"deleted"}],"previous":{"tenant":"tenant-b","domain":"shop.example.com","status":"active"},"certificates":[{"sans":["other.example.com"],"issuer":"Example CA","notBefore":"2026-01-01T00:00:00.000Z","notAfter":"2026-02-01T00:00:00.000Z","fingerprint":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"audit_status":{"type":"string"},"risk_level":{"type":"string"},"ownership_verification":{"type":"object","properties":{"status":{"type":"string"},"records":{"type":"number"},"detail":{"type":"string"}},"additionalProperties":true},"tenant_binding_status":{"type":"object","properties":{"status":{"type":"string"},"tenant":{"type":"string"},"previous_tenant":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true},"dns_target_status":{"type":"object","properties":{"status":{"type":"string"},"targets":{"type":"array","items":{"type":"string"}},"detail":{"type":"string"}},"additionalProperties":true},"dangling_target_findings":{"type":"array","items":{"type":"object","properties":{"hostname":{"type":"string"},"status":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"certificate_findings":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"name":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"potential_takeover_conditions":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"hostname":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"recommended_actions":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"audit_status":"takeover_risk","risk_level":"high","ownership_verification":{"status":"matched","records":2,"detail":"A supplied TXT value matches the expected verification token. The token is not repeated here."},"tenant_binding_status":{"status":"conflict","tenant":"tenant-a","previous_tenant":"tenant-b","detail":"A removed domain is still associated with a different active tenant in the supplied records."},"dns_target_status":{"status":"dangling","targets":["sites.platform.test"],"detail":"A supplied CNAME points at a platform hostname the caller marked unassigned or deleted. This is not proof of a takeover."},"dangling_target_findings":[{"hostname":"sites.platform.test","status":"deleted","detail":"The supplied assignment says this platform hostname is not in use. A dangling name is not proof that the domain can be taken over."}],"certificate_findings":[{"code":"certificate_name_mismatch","name":"shop.example.com","detail":"The supplied certificate names do not include this domain. This is an identity mismatch, not a takeover condition."},{"code":"certificate_expired","name":"shop.example.com","detail":"The supplied certificate was expired at checkedAt. This is not a takeover condition."}],"potential_takeover_conditions":[{"code":"reusable_binding","hostname":"sites.platform.test","detail":"DNS still points at a platform hostname the caller marked unassigned or deleted. Live platform verification was not performed, so this is a potential condition, not a confirmed takeover."}],"recommended_actions":[{"code":"verify_assignment","detail":"Confirm the platform assignment before reusing or repointing the hostname. A dangling DNS target is not proof of a takeover, and this audit did not claim the domain."},{"code":"review_certificate","detail":"Review the supplied certificate name and validity. This comparison does not connect to the domain."},{"code":"review_tenants","detail":"Review the supplied tenant associations before treating the domain as bound to one customer."}],"limitations":["The audit compares caller-supplied records only. It does not query DNS, HTTP, or TLS, and it does not claim or change a domain.","A dangling DNS target is a potential condition only when the supplied assignment status is unassigned or deleted. It is not proof of a takeover.","A missing TXT record is missing evidence. A TXT record that does not match is a verification failure. Neither one is a takeover condition by itself.","The verification token is not repeated in this result.","Certificate names are compared only when certificate metadata is supplied."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment required. The JSON body is the x402 PaymentRequired object: x402Version, resource with the operation description, accepts with the price and network, and extensions.bazaar with the input schema, input example, output schema, and output example."},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed before settlement, so no payment is taken. Reuse the same idempotency key to retrieve the stored error without paying again."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}],"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}},"/api/v1/domain-security/onboarding-readiness":{"post":{"operationId":"score_custom_domain_readiness","summary":"Score custom domain readiness","description":"Compare the supplied TXT name and token, the CNAME target, and a certificate flag. Readiness drops when the token is missing from the expected name, the CNAME does not match the target, or the certificate flag is false. The hijacking index rises when a CNAME points elsewhere, the token sits on another name, or the certificate does not cover the domain. No DNS lookup is performed.","tags":["domain-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253},"token":{"type":"string","minLength":8,"maxLength":200},"txt_name":{"type":"string","minLength":1,"maxLength":253},"cname_target":{"type":"string","minLength":1,"maxLength":253},"certificate_covers_domain":{"type":"boolean"},"records":{"minItems":1,"maxItems":20,"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["TXT","CNAME"]},"name":{"type":"string","minLength":1,"maxLength":253},"value":{"type":"string","minLength":1,"maxLength":512}},"required":["type","name","value"],"additionalProperties":false}}},"required":["domain","token","txt_name","cname_target","certificate_covers_domain","records"],"additionalProperties":false},"example":{"domain":"shop.example.com","token":"platform-verify-token-shop","txt_name":"_verify.shop.example.com","cname_target":"sites.platform.test","certificate_covers_domain":false,"records":[{"type":"TXT","name":"shop.example.com","value":"platform-verify-token-shop"},{"type":"CNAME","name":"shop.example.com","value":"other.platform.test"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"onboarding_readiness_score":{"type":"number"},"hijacking_risk_index":{"type":"number"}},"additionalProperties":true},"example":{"onboarding_readiness_score":10,"hijacking_risk_index":90}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment required. The JSON body is the x402 PaymentRequired object: x402Version, resource with the operation description, accepts with the price and network, and extensions.bazaar with the input schema, input example, output schema, and output example."},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed before settlement, so no payment is taken. Reuse the same idempotency key to retrieve the stored error without paying again."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}],"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}}},"components":{"schemas":{"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}}}}}