Physical & IoT Security API Documentation

POSThttps://www.brainiac.software/api/v1/physical-security/sensor-event-anomaly-detect$0.04 USDC

Detect sensor-event anomalies

Detect anomalies in caller-supplied sensor telemetry using thresholds, baselines, and local standard-deviation rules. Anomalies are not confirmed physical incidents.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`anomalyStdev`	No	number
`doorWindowMinutes`	No	number
`tailgateSeconds`	No	number
`correlationWindowMinutes`	No	number
`offlineMinutes`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "anomalyStdev": 3,
  "events": [
    {
      "id": "S1",
      "at": "2026-11-04T20:00:00.000Z",
      "category": "sensor",
      "deviceId": "temp-1",
      "eventType": "temperature",
      "value": 21,
      "baseline": 21,
      "unit": "C",
      "source": "Caller-supplied"
    },
    {
      "id": "S2",
      "at": "2026-11-04T20:05:00.000Z",
      "category": "sensor",
      "deviceId": "temp-1",
      "eventType": "temperature",
      "value": 22,
      "baseline": 21,
      "unit": "C",
      "source": "Caller-supplied"
    },
    {
      "id": "S3",
      "at": "2026-11-04T20:10:00.000Z",
      "category": "sensor",
      "deviceId": "temp-1",
      "eventType": "temperature",
      "value": 21.5,
      "baseline": 21,
      "unit": "C",
      "source": "Caller-supplied"
    },
    {
      "id": "S4",
      "at": "2026-11-04T20:15:00.000Z",
      "category": "sensor",
      "deviceId": "temp-1",
      "eventType": "temperature",
      "value": 48,
      "baseline": 21,
      "threshold": 30,
      "unit": "C",
      "labels": [
        "anomaly"
      ],
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "anomalyStdev": 3,
  "items": [
    {
      "id": "sensor-anomaly-temp_1",
      "detector": "sensor-event-anomaly-detect",
      "title": "Sensor telemetry anomaly",
      "status": "signal",
      "observedFacts": [
        "Device temp_1 value 48 met/exceeded threshold 30.",
        "Value 48 deviates ≥50% from baseline 21.",
        "Event S4 carries anomaly/fault wording or labels."
      ],
      "inferredThreat": "Unusual sensor values may indicate equipment fault, environmental change, or security-relevant disturbance.",
      "confidence": "medium",
      "relatedEventIds": [
        "S4"
      ],
      "firstAt": "2026-11-04T20:15:00.000Z",
      "lastAt": "2026-11-04T20:15:00.000Z",
      "reasons": [
        "threshold_exceeded",
        "baseline_deviation",
        "explicit_anomaly_label"
      ],
      "evidence": [
        {
          "eventId": "S4",
          "at": "2026-11-04T20:15:00.000Z",
          "fact": "temperature; device=temp-1; value=48C",
          "inference": "Sensor anomaly is a telemetry indicator, not a confirmed physical incident.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied sensor telemetry; local anomaly rules",
      "confirmedIncident": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "physicalSystemConnected": false,
  "deviceControlled": false,
  "networkAccessed": false,
  "confirmedIncidentClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "sensor_anomaly",
      "subject": "temp_1",
      "detail": "Sensor anomalies: threshold_exceeded, baseline_deviation, explicit_anomaly_label (confirmedIncident=false)."
    }
  ],
  "limitations": [
    "Physical/IoT event logs and telemetry are copied only from caller-supplied fields. Physical security systems are not contacted and devices are never controlled.",
    "Temporal correlation and anomaly rules run locally over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Anomalies are not labeled confirmed physical incidents without sufficient multi-signal evidence.",
    "Configurable windows/thresholds apply only when supplied; otherwise documented defaults are used.",
    "No paid physical-security feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/physical-security/sensor-event-anomaly-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "anomalyStdev": 3,
  "events": [
    {
      "id": "S1",
      "at": "2026-11-04T20:00:00.000Z",
      "category": "sensor",
      "deviceId": "temp-1",
      "eventType": "temperature",
      "value": 21,
      "baseline": 21,
      "unit": "C",
      "source": "Caller-supplied"
    },
    {
      "id": "S2",
      "at": "2026-11-04T20:05:00.000Z",
      "category": "sensor",
      "deviceId": "temp-1",
      "eventType": "temperature",
      "value": 22,
      "baseline": 21,
      "unit": "C",
      "source": "Caller-supplied"
    },
    {
      "id": "S3",
      "at": "2026-11-04T20:10:00.000Z",
      "category": "sensor",
      "deviceId": "temp-1",
      "eventType": "temperature",
      "value": 21.5,
      "baseline": 21,
      "unit": "C",
      "source": "Caller-supplied"
    },
    {
      "id": "S4",
      "at": "2026-11-04T20:15:00.000Z",
      "category": "sensor",
      "deviceId": "temp-1",
      "eventType": "temperature",
      "value": 48,
      "baseline": 21,
      "threshold": 30,
      "unit": "C",
      "labels": [
        "anomaly"
      ],
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/physical-security/door-access-pattern-detect$0.04 USDC

Detect unusual door-access patterns

Identify unusual access patterns from caller-supplied door-entry logs (denials, forced doors, held-open, after-hours). Not a confirmed intrusion.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`anomalyStdev`	No	number
`doorWindowMinutes`	No	number
`tailgateSeconds`	No	number
`correlationWindowMinutes`	No	number
`offlineMinutes`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "doorWindowMinutes": 60,
  "events": [
    {
      "id": "D1",
      "at": "2026-11-04T20:00:00.000Z",
      "category": "door",
      "doorId": "door-a",
      "eventType": "access",
      "outcome": "denied",
      "badgeId": "B1",
      "source": "Caller-supplied"
    },
    {
      "id": "D2",
      "at": "2026-11-04T20:01:00.000Z",
      "category": "door",
      "doorId": "door-a",
      "eventType": "access",
      "outcome": "denied",
      "badgeId": "B1",
      "source": "Caller-supplied"
    },
    {
      "id": "D3",
      "at": "2026-11-04T20:02:00.000Z",
      "category": "door",
      "doorId": "door-a",
      "eventType": "access",
      "outcome": "denied",
      "badgeId": "B2",
      "source": "Caller-supplied"
    },
    {
      "id": "D4",
      "at": "2026-11-04T20:03:00.000Z",
      "category": "door",
      "doorId": "door-a",
      "eventType": "forced_open",
      "outcome": "forced",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "windowMinutes": 60,
  "items": [
    {
      "id": "door-pattern-door_a-D1",
      "detector": "door-access-pattern-detect",
      "title": "Unusual door-access pattern",
      "observedFacts": [
        "3 denied access attempts within 60 minutes.",
        "1 forced-door indicator(s)."
      ],
      "inferredThreat": "Unusual door activity can indicate unauthorized access attempts or propped doors.",
      "confidence": "high",
      "relatedEventIds": [
        "D1",
        "D2",
        "D3",
        "D4"
      ],
      "firstAt": "2026-11-04T20:00:00.000Z",
      "lastAt": "2026-11-04T20:03:00.000Z",
      "reasons": [
        "repeated_denials",
        "forced_door"
      ],
      "evidence": [
        {
          "eventId": "D1",
          "at": "2026-11-04T20:00:00.000Z",
          "fact": "access; door=door-a; outcome=denied",
          "inference": "Door-pattern indicator only; not a confirmed physical incident.",
          "confidence": "medium"
        },
        {
          "eventId": "D2",
          "at": "2026-11-04T20:01:00.000Z",
          "fact": "access; door=door-a; outcome=denied",
          "inference": "Door-pattern indicator only; not a confirmed physical incident.",
          "confidence": "medium"
        },
        {
          "eventId": "D3",
          "at": "2026-11-04T20:02:00.000Z",
          "fact": "access; door=door-a; outcome=denied",
          "inference": "Door-pattern indicator only; not a confirmed physical incident.",
          "confidence": "medium"
        },
        {
          "eventId": "D4",
          "at": "2026-11-04T20:03:00.000Z",
          "fact": "forced_open; door=door-a; outcome=forced",
          "inference": "Door-pattern indicator only; not a confirmed physical incident.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied door/access logs; local rules",
      "status": "signal",
      "confirmedIncident": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "physicalSystemConnected": false,
  "deviceControlled": false,
  "networkAccessed": false,
  "confirmedIncidentClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "door_access_pattern",
      "subject": "door_a",
      "detail": "Door-access indicators: repeated_denials, forced_door (confirmedIncident=false)."
    }
  ],
  "limitations": [
    "Physical/IoT event logs and telemetry are copied only from caller-supplied fields. Physical security systems are not contacted and devices are never controlled.",
    "Temporal correlation and anomaly rules run locally over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Anomalies are not labeled confirmed physical incidents without sufficient multi-signal evidence.",
    "Configurable windows/thresholds apply only when supplied; otherwise documented defaults are used.",
    "No paid physical-security feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/physical-security/door-access-pattern-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "doorWindowMinutes": 60,
  "events": [
    {
      "id": "D1",
      "at": "2026-11-04T20:00:00.000Z",
      "category": "door",
      "doorId": "door-a",
      "eventType": "access",
      "outcome": "denied",
      "badgeId": "B1",
      "source": "Caller-supplied"
    },
    {
      "id": "D2",
      "at": "2026-11-04T20:01:00.000Z",
      "category": "door",
      "doorId": "door-a",
      "eventType": "access",
      "outcome": "denied",
      "badgeId": "B1",
      "source": "Caller-supplied"
    },
    {
      "id": "D3",
      "at": "2026-11-04T20:02:00.000Z",
      "category": "door",
      "doorId": "door-a",
      "eventType": "access",
      "outcome": "denied",
      "badgeId": "B2",
      "source": "Caller-supplied"
    },
    {
      "id": "D4",
      "at": "2026-11-04T20:03:00.000Z",
      "category": "door",
      "doorId": "door-a",
      "eventType": "forced_open",
      "outcome": "forced",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/physical-security/access-tailgating-signal-detect$0.05 USDC

Detect tailgating signals

Identify possible tailgating using caller-supplied access grants correlated with nearby motion/occupancy or unbadged second passages. Not visually confirmed.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`anomalyStdev`	No	number
`doorWindowMinutes`	No	number
`tailgateSeconds`	No	number
`correlationWindowMinutes`	No	number
`offlineMinutes`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "tailgateSeconds": 8,
  "events": [
    {
      "id": "A1",
      "at": "2026-11-04T20:00:00.000Z",
      "category": "door",
      "doorId": "lobby",
      "zone": "lobby",
      "eventType": "access",
      "outcome": "granted",
      "badgeId": "B9",
      "direction": "in",
      "source": "Caller-supplied"
    },
    {
      "id": "A2",
      "at": "2026-11-04T20:00:04.000Z",
      "category": "door",
      "doorId": "lobby",
      "zone": "lobby",
      "eventType": "passage",
      "outcome": "unknown",
      "source": "Caller-supplied"
    },
    {
      "id": "M1",
      "at": "2026-11-04T20:00:05.000Z",
      "category": "sensor",
      "deviceId": "pir-lobby",
      "zone": "lobby",
      "eventType": "motion",
      "value": 2,
      "unit": "people",
      "labels": [
        "motion"
      ],
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "tailgateSeconds": 8,
  "items": [
    {
      "id": "tailgate-lobby-A1",
      "detector": "access-tailgating-signal-detect",
      "title": "Possible tailgating signal",
      "status": "signal",
      "observedFacts": [
        "Second door passage within 8s without badge/user id.",
        "1 motion/occupancy event(s) near a single badge grant.",
        "Occupancy/people-count ≥2 near a single grant."
      ],
      "inferredThreat": "Access plus nearby motion/second passage may indicate tailgating.",
      "confidence": "medium",
      "relatedEventIds": [
        "A1",
        "A2",
        "M1"
      ],
      "firstAt": "2026-11-04T20:00:00.000Z",
      "lastAt": "2026-11-04T20:00:05.000Z",
      "reasons": [
        "ungated_second_passage",
        "motion_after_single_badge",
        "people_count_gt_badges"
      ],
      "evidence": [
        {
          "eventId": "A1",
          "at": "2026-11-04T20:00:00.000Z",
          "fact": "access; door=lobby; zone=lobby; outcome=granted",
          "inference": "Tailgating is inferred from timing correlation, not visually confirmed.",
          "confidence": "medium"
        },
        {
          "eventId": "A2",
          "at": "2026-11-04T20:00:04.000Z",
          "fact": "passage; door=lobby; zone=lobby",
          "inference": "Tailgating is inferred from timing correlation, not visually confirmed.",
          "confidence": "medium"
        },
        {
          "eventId": "M1",
          "at": "2026-11-04T20:00:05.000Z",
          "fact": "motion; device=pir-lobby; zone=lobby; value=2people",
          "inference": "Tailgating is inferred from timing correlation, not visually confirmed.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied access/sensor events; local timing rules",
      "confirmedIncident": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "physicalSystemConnected": false,
  "deviceControlled": false,
  "networkAccessed": false,
  "confirmedIncidentClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "tailgating",
      "subject": "lobby",
      "detail": "Tailgating indicators: ungated_second_passage, motion_after_single_badge, people_count_gt_badges (confirmedIncident=false)."
    }
  ],
  "limitations": [
    "Physical/IoT event logs and telemetry are copied only from caller-supplied fields. Physical security systems are not contacted and devices are never controlled.",
    "Temporal correlation and anomaly rules run locally over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Anomalies are not labeled confirmed physical incidents without sufficient multi-signal evidence.",
    "Configurable windows/thresholds apply only when supplied; otherwise documented defaults are used.",
    "No paid physical-security feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/physical-security/access-tailgating-signal-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "tailgateSeconds": 8,
  "events": [
    {
      "id": "A1",
      "at": "2026-11-04T20:00:00.000Z",
      "category": "door",
      "doorId": "lobby",
      "zone": "lobby",
      "eventType": "access",
      "outcome": "granted",
      "badgeId": "B9",
      "direction": "in",
      "source": "Caller-supplied"
    },
    {
      "id": "A2",
      "at": "2026-11-04T20:00:04.000Z",
      "category": "door",
      "doorId": "lobby",
      "zone": "lobby",
      "eventType": "passage",
      "outcome": "unknown",
      "source": "Caller-supplied"
    },
    {
      "id": "M1",
      "at": "2026-11-04T20:00:05.000Z",
      "category": "sensor",
      "deviceId": "pir-lobby",
      "zone": "lobby",
      "eventType": "motion",
      "value": 2,
      "unit": "people",
      "labels": [
        "motion"
      ],
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/physical-security/perimeter-breach-signal-detect$0.04 USDC

Detect perimeter-breach signals

Analyze caller-supplied perimeter sensor events for possible breaches. Multi-sensor alarms raise confidence; still not a confirmed physical breach.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`anomalyStdev`	No	number
`doorWindowMinutes`	No	number
`tailgateSeconds`	No	number
`correlationWindowMinutes`	No	number
`offlineMinutes`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "P1",
      "at": "2026-11-04T20:10:00.000Z",
      "category": "perimeter",
      "zone": "north-fence",
      "deviceId": "beam-1",
      "eventType": "intrusion_alarm",
      "outcome": "alarm",
      "severity": "high",
      "message": "beam trip",
      "source": "Caller-supplied"
    },
    {
      "id": "P2",
      "at": "2026-11-04T20:10:20.000Z",
      "category": "perimeter",
      "zone": "north-fence",
      "deviceId": "pir-2",
      "eventType": "intrusion_alarm",
      "outcome": "alarm",
      "severity": "high",
      "message": "climb suspected",
      "labels": [
        "breach"
      ],
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "perimeter-north_fence-P1",
      "detector": "perimeter-breach-signal-detect",
      "title": "Possible perimeter breach signal",
      "status": "signal",
      "observedFacts": [
        "2 perimeter alarm/breach-style event(s).",
        "2 devices alarmed in zone north_fence.",
        "Event message/labels include breach/cut/climb/tamper wording."
      ],
      "inferredThreat": "Perimeter sensor alarms may indicate intrusion attempts; not a confirmed breach by themselves.",
      "confidence": "medium",
      "relatedEventIds": [
        "P1",
        "P2"
      ],
      "firstAt": "2026-11-04T20:10:00.000Z",
      "lastAt": "2026-11-04T20:10:20.000Z",
      "reasons": [
        "perimeter_alarm",
        "multi_sensor_zone",
        "breach_wording"
      ],
      "evidence": [
        {
          "eventId": "P1",
          "at": "2026-11-04T20:10:00.000Z",
          "fact": "intrusion_alarm; device=beam-1; zone=north-fence; outcome=alarm; msg=beam trip",
          "inference": "Perimeter signal only; physical confirmation not performed.",
          "confidence": "medium"
        },
        {
          "eventId": "P2",
          "at": "2026-11-04T20:10:20.000Z",
          "fact": "intrusion_alarm; device=pir-2; zone=north-fence; outcome=alarm; msg=climb suspected",
          "inference": "Perimeter signal only; physical confirmation not performed.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied perimeter events; local correlation",
      "confirmedIncident": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "physicalSystemConnected": false,
  "deviceControlled": false,
  "networkAccessed": false,
  "confirmedIncidentClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "perimeter_breach",
      "subject": "north_fence",
      "detail": "Perimeter indicators: perimeter_alarm, multi_sensor_zone, breach_wording (confirmedIncident=false)."
    }
  ],
  "limitations": [
    "Physical/IoT event logs and telemetry are copied only from caller-supplied fields. Physical security systems are not contacted and devices are never controlled.",
    "Temporal correlation and anomaly rules run locally over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Anomalies are not labeled confirmed physical incidents without sufficient multi-signal evidence.",
    "Configurable windows/thresholds apply only when supplied; otherwise documented defaults are used.",
    "No paid physical-security feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/physical-security/perimeter-breach-signal-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "P1",
      "at": "2026-11-04T20:10:00.000Z",
      "category": "perimeter",
      "zone": "north-fence",
      "deviceId": "beam-1",
      "eventType": "intrusion_alarm",
      "outcome": "alarm",
      "severity": "high",
      "message": "beam trip",
      "source": "Caller-supplied"
    },
    {
      "id": "P2",
      "at": "2026-11-04T20:10:20.000Z",
      "category": "perimeter",
      "zone": "north-fence",
      "deviceId": "pir-2",
      "eventType": "intrusion_alarm",
      "outcome": "alarm",
      "severity": "high",
      "message": "climb suspected",
      "labels": [
        "breach"
      ],
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/physical-security/camera-tampering-signal-detect$0.04 USDC

Detect camera-tampering signals

Identify camera tampering indicators from caller-supplied telemetry (covered/moved/signal-loss). Scene content is not visually verified.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`anomalyStdev`	No	number
`doorWindowMinutes`	No	number
`tailgateSeconds`	No	number
`correlationWindowMinutes`	No	number
`offlineMinutes`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "C1",
      "at": "2026-11-04T19:55:00.000Z",
      "category": "camera",
      "cameraId": "cam-12",
      "eventType": "video_loss",
      "outcome": "alarm",
      "message": "signal loss",
      "source": "Caller-supplied"
    },
    {
      "id": "C2",
      "at": "2026-11-04T19:56:00.000Z",
      "category": "camera",
      "cameraId": "cam-12",
      "eventType": "tamper",
      "message": "lens covered",
      "value": 2,
      "threshold": 5,
      "unit": "luminance",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "items": [
    {
      "id": "camera-tamper-cam_12",
      "detector": "camera-tampering-signal-detect",
      "title": "Camera tampering indicators",
      "status": "signal",
      "observedFacts": [
        "Camera cam_12 event C1 indicates tamper/obstruction/signal loss.",
        "Camera cam_12 event C2 indicates tamper/obstruction/signal loss."
      ],
      "inferredThreat": "Camera telemetry anomalies can indicate tampering or obstruction.",
      "confidence": "medium",
      "relatedEventIds": [
        "C1",
        "C2"
      ],
      "firstAt": "2026-11-04T19:55:00.000Z",
      "lastAt": "2026-11-04T19:56:00.000Z",
      "reasons": [
        "tamper_indicator",
        "camera_alarm"
      ],
      "evidence": [
        {
          "eventId": "C1",
          "at": "2026-11-04T19:55:00.000Z",
          "fact": "video_loss; camera=cam-12; outcome=alarm; msg=signal loss",
          "inference": "Tampering indicator from supplied telemetry only; scene not visually verified.",
          "confidence": "medium"
        },
        {
          "eventId": "C2",
          "at": "2026-11-04T19:56:00.000Z",
          "fact": "tamper; camera=cam-12; value=2luminance; msg=lens covered",
          "inference": "Tampering indicator from supplied telemetry only; scene not visually verified.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied camera telemetry; local rules",
      "confirmedIncident": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "physicalSystemConnected": false,
  "deviceControlled": false,
  "networkAccessed": false,
  "confirmedIncidentClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "camera_tamper",
      "subject": "cam_12",
      "detail": "Camera-tamper indicators: tamper_indicator, camera_alarm (confirmedIncident=false)."
    }
  ],
  "limitations": [
    "Physical/IoT event logs and telemetry are copied only from caller-supplied fields. Physical security systems are not contacted and devices are never controlled.",
    "Temporal correlation and anomaly rules run locally over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Anomalies are not labeled confirmed physical incidents without sufficient multi-signal evidence.",
    "Configurable windows/thresholds apply only when supplied; otherwise documented defaults are used.",
    "No paid physical-security feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/physical-security/camera-tampering-signal-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "C1",
      "at": "2026-11-04T19:55:00.000Z",
      "category": "camera",
      "cameraId": "cam-12",
      "eventType": "video_loss",
      "outcome": "alarm",
      "message": "signal loss",
      "source": "Caller-supplied"
    },
    {
      "id": "C2",
      "at": "2026-11-04T19:56:00.000Z",
      "category": "camera",
      "cameraId": "cam-12",
      "eventType": "tamper",
      "message": "lens covered",
      "value": 2,
      "threshold": 5,
      "unit": "luminance",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/physical-security/alarm-correlation-analyze$0.05 USDC

Correlate multi-sensor alarms

Correlate alarms from multiple caller-supplied sensors into possible incident groups using time windows. Correlation is not confirmation of a physical incident.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`anomalyStdev`	No	number
`doorWindowMinutes`	No	number
`tailgateSeconds`	No	number
`correlationWindowMinutes`	No	number
`offlineMinutes`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "correlationWindowMinutes": 15,
  "events": [
    {
      "id": "A1",
      "at": "2026-11-04T20:00:00.000Z",
      "category": "alarm",
      "deviceId": "panel-1",
      "zone": "lobby",
      "eventType": "intrusion_alarm",
      "outcome": "alarm",
      "severity": "high",
      "source": "Caller-supplied"
    },
    {
      "id": "A2",
      "at": "2026-11-04T20:01:00.000Z",
      "category": "door",
      "deviceId": "door-lobby",
      "zone": "lobby",
      "eventType": "forced_open",
      "outcome": "forced",
      "severity": "high",
      "source": "Caller-supplied"
    },
    {
      "id": "A3",
      "at": "2026-11-04T20:02:00.000Z",
      "category": "camera",
      "cameraId": "cam-lobby",
      "eventType": "motion_alarm",
      "outcome": "alarm",
      "severity": "medium",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "windowMinutes": 15,
  "items": [
    {
      "id": "alarm-corr-A1",
      "detector": "alarm-correlation-analyze",
      "title": "Correlated multi-sensor alarms",
      "observedFacts": [
        "3 alarm-severity events within 15 minutes.",
        "Alarms across devices: panel-1, door-lobby, cam-lobby.",
        "Categories involved: alarm, door, camera."
      ],
      "inferredThreat": "Temporally clustered alarms may represent one incident spanning sensors.",
      "confidence": "high",
      "relatedEventIds": [
        "A1",
        "A2",
        "A3"
      ],
      "firstAt": "2026-11-04T20:00:00.000Z",
      "lastAt": "2026-11-04T20:02:00.000Z",
      "reasons": [
        "multi_device_alarms",
        "cross_category_alarms"
      ],
      "evidence": [
        {
          "eventId": "A1",
          "at": "2026-11-04T20:00:00.000Z",
          "fact": "intrusion_alarm; device=panel-1; zone=lobby; outcome=alarm",
          "inference": "Correlation groups alarms; does not confirm a physical incident.",
          "confidence": "medium"
        },
        {
          "eventId": "A2",
          "at": "2026-11-04T20:01:00.000Z",
          "fact": "forced_open; device=door-lobby; zone=lobby; outcome=forced",
          "inference": "Correlation groups alarms; does not confirm a physical incident.",
          "confidence": "medium"
        },
        {
          "eventId": "A3",
          "at": "2026-11-04T20:02:00.000Z",
          "fact": "motion_alarm; camera=cam-lobby; outcome=alarm",
          "inference": "Correlation groups alarms; does not confirm a physical incident.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied alarms; local time-window correlation",
      "status": "signal",
      "confirmedIncident": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "physicalSystemConnected": false,
  "deviceControlled": false,
  "networkAccessed": false,
  "confirmedIncidentClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "alarm_correlation",
      "subject": "A1",
      "detail": "Correlated alarms via multi_device_alarms, cross_category_alarms (confirmedIncident=false)."
    }
  ],
  "limitations": [
    "Physical/IoT event logs and telemetry are copied only from caller-supplied fields. Physical security systems are not contacted and devices are never controlled.",
    "Temporal correlation and anomaly rules run locally over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Anomalies are not labeled confirmed physical incidents without sufficient multi-signal evidence.",
    "Configurable windows/thresholds apply only when supplied; otherwise documented defaults are used.",
    "No paid physical-security feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/physical-security/alarm-correlation-analyze" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "correlationWindowMinutes": 15,
  "events": [
    {
      "id": "A1",
      "at": "2026-11-04T20:00:00.000Z",
      "category": "alarm",
      "deviceId": "panel-1",
      "zone": "lobby",
      "eventType": "intrusion_alarm",
      "outcome": "alarm",
      "severity": "high",
      "source": "Caller-supplied"
    },
    {
      "id": "A2",
      "at": "2026-11-04T20:01:00.000Z",
      "category": "door",
      "deviceId": "door-lobby",
      "zone": "lobby",
      "eventType": "forced_open",
      "outcome": "forced",
      "severity": "high",
      "source": "Caller-supplied"
    },
    {
      "id": "A3",
      "at": "2026-11-04T20:02:00.000Z",
      "category": "camera",
      "cameraId": "cam-lobby",
      "eventType": "motion_alarm",
      "outcome": "alarm",
      "severity": "medium",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/physical-security/iot-device-behavior-analyze$0.04 USDC

Analyze IoT device behaviour

Identify unusual IoT device behaviour from caller-supplied telemetry (reporting gaps, outliers, unexpected reboot/config events). Devices are never contacted or controlled.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`anomalyStdev`	No	number
`doorWindowMinutes`	No	number
`tailgateSeconds`	No	number
`correlationWindowMinutes`	No	number
`offlineMinutes`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "offlineMinutes": 30,
  "events": [
    {
      "id": "I1",
      "at": "2026-11-04T18:00:00.000Z",
      "category": "iot",
      "deviceId": "lock-7",
      "deviceType": "lock",
      "eventType": "heartbeat",
      "value": 1,
      "source": "Caller-supplied"
    },
    {
      "id": "I2",
      "at": "2026-11-04T19:00:00.000Z",
      "category": "iot",
      "deviceId": "lock-7",
      "deviceType": "lock",
      "eventType": "heartbeat",
      "value": 1,
      "source": "Caller-supplied"
    },
    {
      "id": "I3",
      "at": "2026-11-04T20:30:00.000Z",
      "category": "iot",
      "deviceId": "lock-7",
      "deviceType": "lock",
      "eventType": "reboot",
      "message": "unexpected reboot",
      "labels": [
        "unexpected_behavior"
      ],
      "source": "Caller-supplied"
    },
    {
      "id": "I4",
      "at": "2026-11-04T20:31:00.000Z",
      "category": "iot",
      "deviceId": "lock-7",
      "deviceType": "lock",
      "eventType": "config_change",
      "message": "unauthorized config change",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "detected",
  "itemCount": 1,
  "offlineMinutes": 30,
  "items": [
    {
      "id": "iot-behavior-lock_7",
      "detector": "iot-device-behavior-analyze",
      "title": "Unusual IoT device behaviour",
      "status": "signal",
      "observedFacts": [
        "Gap of ≈60 minutes between I1 and I2 (threshold 30m).",
        "Gap of ≈90 minutes between I2 and I3 (threshold 30m).",
        "Device event I3 indicates reboot/offline/config/unexpected behaviour.",
        "Device event I4 indicates reboot/offline/config/unexpected behaviour."
      ],
      "inferredThreat": "Unusual IoT reporting or control patterns can indicate misconfiguration, fault, or misuse.",
      "confidence": "medium",
      "relatedEventIds": [
        "I1",
        "I2",
        "I3",
        "I4"
      ],
      "firstAt": "2026-11-04T18:00:00.000Z",
      "lastAt": "2026-11-04T20:31:00.000Z",
      "reasons": [
        "reporting_gap",
        "unexpected_device_event"
      ],
      "evidence": [
        {
          "eventId": "I1",
          "at": "2026-11-04T18:00:00.000Z",
          "fact": "heartbeat; device=lock-7; value=1",
          "inference": "IoT behaviour anomaly only; device was not contacted or controlled.",
          "confidence": "medium"
        },
        {
          "eventId": "I2",
          "at": "2026-11-04T19:00:00.000Z",
          "fact": "heartbeat; device=lock-7; value=1",
          "inference": "IoT behaviour anomaly only; device was not contacted or controlled.",
          "confidence": "medium"
        },
        {
          "eventId": "I3",
          "at": "2026-11-04T20:30:00.000Z",
          "fact": "reboot; device=lock-7; msg=unexpected reboot",
          "inference": "IoT behaviour anomaly only; device was not contacted or controlled.",
          "confidence": "medium"
        },
        {
          "eventId": "I4",
          "at": "2026-11-04T20:31:00.000Z",
          "fact": "config_change; device=lock-7; msg=unauthorized config change",
          "inference": "IoT behaviour anomaly only; device was not contacted or controlled.",
          "confidence": "medium"
        }
      ],
      "source": "Caller-supplied IoT telemetry; local behavioural rules",
      "confirmedIncident": false
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "physicalSystemConnected": false,
  "deviceControlled": false,
  "networkAccessed": false,
  "confirmedIncidentClaimed": false,
  "findings": [
    {
      "kind": "conflict",
      "code": "iot_behavior",
      "subject": "lock_7",
      "detail": "IoT behaviour indicators: reporting_gap, unexpected_device_event (confirmedIncident=false)."
    }
  ],
  "limitations": [
    "Physical/IoT event logs and telemetry are copied only from caller-supplied fields. Physical security systems are not contacted and devices are never controlled.",
    "Temporal correlation and anomaly rules run locally over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Anomalies are not labeled confirmed physical incidents without sufficient multi-signal evidence.",
    "Configurable windows/thresholds apply only when supplied; otherwise documented defaults are used.",
    "No paid physical-security feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/physical-security/iot-device-behavior-analyze" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "offlineMinutes": 30,
  "events": [
    {
      "id": "I1",
      "at": "2026-11-04T18:00:00.000Z",
      "category": "iot",
      "deviceId": "lock-7",
      "deviceType": "lock",
      "eventType": "heartbeat",
      "value": 1,
      "source": "Caller-supplied"
    },
    {
      "id": "I2",
      "at": "2026-11-04T19:00:00.000Z",
      "category": "iot",
      "deviceId": "lock-7",
      "deviceType": "lock",
      "eventType": "heartbeat",
      "value": 1,
      "source": "Caller-supplied"
    },
    {
      "id": "I3",
      "at": "2026-11-04T20:30:00.000Z",
      "category": "iot",
      "deviceId": "lock-7",
      "deviceType": "lock",
      "eventType": "reboot",
      "message": "unexpected reboot",
      "labels": [
        "unexpected_behavior"
      ],
      "source": "Caller-supplied"
    },
    {
      "id": "I4",
      "at": "2026-11-04T20:31:00.000Z",
      "category": "iot",
      "deviceId": "lock-7",
      "deviceType": "lock",
      "eventType": "config_change",
      "message": "unauthorized config change",
      "source": "Caller-supplied"
    }
  ]
}
JSON

POSThttps://www.brainiac.software/api/v1/physical-security/building-security-timeline$0.05 USDC

Build building-security timeline

Generate a chronological security timeline from caller-supplied building events. Timeline entries are observed events, not confirmed incidents.

Body

Field	Required	Notes
`text`	No	string
`json`	No	string
`csv`	No	string
`file`	No	object; Object
`files`	No	array; Array
`events`	No	array; Array
`asOf`	No	string
`anomalyStdev`	No	number
`doorWindowMinutes`	No	number
`tailgateSeconds`	No	number
`correlationWindowMinutes`	No	number
`offlineMinutes`	No	number

Request exampleJSON

{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T19:50:00.000Z",
      "building": "HQ",
      "zone": "lobby",
      "category": "door",
      "doorId": "lobby",
      "eventType": "access",
      "outcome": "denied",
      "severity": "medium",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T19:55:00.000Z",
      "building": "HQ",
      "zone": "lobby",
      "category": "camera",
      "cameraId": "cam-lobby",
      "eventType": "tamper",
      "message": "lens covered",
      "severity": "high",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T20:00:00.000Z",
      "building": "HQ",
      "zone": "lobby",
      "category": "alarm",
      "deviceId": "panel-1",
      "eventType": "intrusion_alarm",
      "outcome": "alarm",
      "severity": "high",
      "source": "Caller-supplied"
    }
  ]
}

Response exampleJSON

{
  "checkedAt": "2026-11-04T21:00:00.000Z",
  "status": "reported",
  "eventCount": 3,
  "sections": [
    {
      "building": "hq",
      "eventCount": 3,
      "firstAt": "2026-11-04T19:50:00.000Z",
      "lastAt": "2026-11-04T20:00:00.000Z",
      "categories": [
        "door",
        "camera",
        "alarm"
      ]
    }
  ],
  "timeline": [
    {
      "sequence": 1,
      "eventId": "E1",
      "at": "2026-11-04T19:50:00.000Z",
      "building": "HQ",
      "zone": "lobby",
      "category": "door",
      "eventType": "access",
      "deviceId": "lobby",
      "outcome": "denied",
      "severity": "medium",
      "summary": "access; door=lobby; zone=lobby; outcome=denied",
      "confirmedIncident": false,
      "source": "Caller-supplied"
    },
    {
      "sequence": 2,
      "eventId": "E2",
      "at": "2026-11-04T19:55:00.000Z",
      "building": "HQ",
      "zone": "lobby",
      "category": "camera",
      "eventType": "tamper",
      "deviceId": "cam-lobby",
      "outcome": "unknown",
      "severity": "high",
      "summary": "tamper; camera=cam-lobby; zone=lobby; msg=lens covered",
      "confirmedIncident": false,
      "source": "Caller-supplied"
    },
    {
      "sequence": 3,
      "eventId": "E3",
      "at": "2026-11-04T20:00:00.000Z",
      "building": "HQ",
      "zone": "lobby",
      "category": "alarm",
      "eventType": "intrusion_alarm",
      "deviceId": "panel-1",
      "outcome": "alarm",
      "severity": "high",
      "summary": "intrusion_alarm; device=panel-1; zone=lobby; outcome=alarm",
      "confirmedIncident": false,
      "source": "Caller-supplied"
    }
  ],
  "paidProviderUsed": false,
  "apiKeyRequired": false,
  "physicalSystemConnected": false,
  "deviceControlled": false,
  "networkAccessed": false,
  "confirmedIncidentClaimed": false,
  "findings": [
    {
      "kind": "observation",
      "code": "timeline_built",
      "subject": "",
      "detail": "Timeline includes 3 security-relevant event(s); none are confirmed incidents."
    }
  ],
  "limitations": [
    "Physical/IoT event logs and telemetry are copied only from caller-supplied fields. Physical security systems are not contacted and devices are never controlled.",
    "Temporal correlation and anomaly rules run locally over supplied records. Missing values are not invented.",
    "Observed facts are separated from inferred threat hypotheses. Anomalies are not labeled confirmed physical incidents without sufficient multi-signal evidence.",
    "Configurable windows/thresholds apply only when supplied; otherwise documented defaults are used.",
    "No paid physical-security feed is used and no API key is required."
  ]
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/physical-security/building-security-timeline" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "asOf": "2026-11-04T21:00:00.000Z",
  "events": [
    {
      "id": "E1",
      "at": "2026-11-04T19:50:00.000Z",
      "building": "HQ",
      "zone": "lobby",
      "category": "door",
      "doorId": "lobby",
      "eventType": "access",
      "outcome": "denied",
      "severity": "medium",
      "source": "Caller-supplied"
    },
    {
      "id": "E2",
      "at": "2026-11-04T19:55:00.000Z",
      "building": "HQ",
      "zone": "lobby",
      "category": "camera",
      "cameraId": "cam-lobby",
      "eventType": "tamper",
      "message": "lens covered",
      "severity": "high",
      "source": "Caller-supplied"
    },
    {
      "id": "E3",
      "at": "2026-11-04T20:00:00.000Z",
      "building": "HQ",
      "zone": "lobby",
      "category": "alarm",
      "deviceId": "panel-1",
      "eventType": "intrusion_alarm",
      "outcome": "alarm",
      "severity": "high",
      "source": "Caller-supplied"
    }
  ]
}
JSON