Audit federation authorization API
Compare @authenticated, @requiresScopes, @policy, and caller-defined authorization directives across supplied subgraph SDL. @requires, @key, @external, @provides, and @shareable are inspected for schema-level differences. audit_status is clean, findings_detected, invalid, or incomplete. risk_level is low, medium, high, or critical. A difference is not a runtime authorization result. No gateway is contacted.
The Audit federation authorization operation is part of the Federation Authorization Audit API on BRAINIAC.software. Compare @authenticated, @requiresScopes, @policy, and caller-defined authorization directives across supplied subgraph SDL. @requires, @key, @external, @provides, and @shareable are inspected for schema-level differences. audit_status is clean, findings_detected, invalid, or incomplete. risk_level is low, medium, high, or critical. A difference is not a runtime authorization result. No gateway is contacted. It is exposed as POST /api/v1/graphql-security/federation-authorization-audit and priced at $0.05 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied GraphQL subgraph SDL processed locally Caller-supplied GraphQL Federation deployment configuration processed locally Limitations: Schemas are the SDL strings in the request. No gateway, router, or subgraph is contacted. A difference between directives is a schema-level inconsistency. It does not show that a request would be allowed or denied at runtime. Known authorization directives are @authenticated, @requiresScopes, and @policy. Another directive is used only when the request supplies its semantics. The supergraph SDL is compared as supplied text. Federation composition is not executed. Deployment exposure is read from explicit labels in the request. URLs are not resolved or probed. field-authorization-coverage counts fields whose line contains a supplied directive. It does not decide whether a request would be allowed. subgraph-complexity walks type references in the supplied SDL. The index is that depth, and introspection adds risk only when the request says it is enabled. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Score field authorization coverage, Audit federation subgraph exposure, Score subgraph query depth. Open the group documentation for the full request schema, field notes, and response examples before integrating.
/api/v1/graphql-security/federation-authorization-auditExample request
curl -i -X POST "https://www.brainiac.software/api/v1/graphql-security/federation-authorization-audit" \
-H 'content-type: application/json' \
-H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
--data-binary @- <<'JSON'
{
"subgraphs": [
{
"name": "accounts",
"federationVersion": "2.3",
"sdl": "extend schema @link(url: \"https://specs.apollo.dev/federation/v2.3\", import: [\"@key\", \"@shareable\"])\ninterface Viewer { id: ID! }\ntype User implements Viewer @key(fields: \"id\") {\n id: ID!\n email: String @authenticated @shareable\n ssn: String @requiresScopes(scopes: [[\"pii\"]])\n}"
},
{
"name": "reviews",
"federationVersion": "2.3",
"sdl": "extend schema @link(url: \"https://specs.apollo.dev/federation/v2.3\", import: [\"@key\", \"@external\", \"@requires\", \"@shareable\"])\ninterface Viewer { id: ID! @authenticated }\ntype User implements Viewer @key(fields: \"id\") {\n id: ID!\n email: String @external @shareable\n ssn: String @external\n review: String @requires(fields: \"email ssn\")\n}"
}
]
}
JSONAn unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.
FAQ
- Do I need an API key? No. Pay the listed USDC amount with x402.
- What network? Base (eip155:8453), USDC.
- Is this an official determination? No. Results are for human review against the cited sources.
Related operations
- Score field authorization coverage — $0.04 USDC
- Audit federation subgraph exposure — $0.05 USDC
- Score subgraph query depth — $0.04 USDC