# Cybersecurity Configuration Intelligence API

> Read security headers, TLS, cookies, CORS, and CSP from a public URL or from configuration supplied by the caller. Listed paths are the only extra resources requested.

- Product: https://www.brainiac.software/api/security-configuration
- Docs: https://www.brainiac.software/api/security-configuration/docs
- OpenAPI: https://www.brainiac.software/api/security-configuration/openapi.json
- Contact: support@brainiac.software (https://www.brainiac.software/contact)

## Operations

- POST /api/v1/security-configuration/header-audit — $0.04 USDC — Audit security headers: Read security headers from a public URL or from headers supplied by the caller. A missing header is a confirmed gap only when the response was available. This does not show that the site is secure. Docs: https://www.brainiac.software/api/security-configuration/docs#security-configuration-header-audit
- POST /api/v1/security-configuration/tls-audit — $0.04 USDC — Audit TLS configuration: Read the certificate from one public HTTPS request, or from certificate fields supplied by the caller. An old protocol, an expired certificate, a name mismatch, or an untrusted certificate is confirmed. This does not show that the site is secure. Docs: https://www.brainiac.software/api/security-configuration/docs#security-configuration-tls-audit
- POST /api/v1/security-configuration/cookie-audit — $0.03 USDC — Audit cookie attributes: Check Secure, HttpOnly, and SameSite on Set-Cookie headers from one public response or from cookie lines supplied by the caller. Cookie values are not returned. Docs: https://www.brainiac.software/api/security-configuration/docs#security-configuration-cookie-audit
- POST /api/v1/security-configuration/cors-policy-audit — $0.04 USDC — Audit a CORS policy: Read CORS response headers. When an origin is supplied, it is sent once on the public GET. A wildcard, or a reflected origin with credentials, is confirmed. No other origins are tried. Docs: https://www.brainiac.software/api/security-configuration/docs#security-configuration-cors-policy-audit
- POST /api/v1/security-configuration/csp-policy-analyze — $0.04 USDC — Analyze a CSP policy: Read Content-Security-Policy from a public response or from policy text supplied by the caller. unsafe-inline, unsafe-eval, a script wildcard, and data: scripts are confirmed. This is not a full policy review. Docs: https://www.brainiac.software/api/security-configuration/docs#security-configuration-csp-policy-analyze
- POST /api/v1/security-configuration/exposed-file-check — $0.05 USDC — Check listed public paths: Request only the paths the caller lists, on the same host as the supplied URL. A non-HTML HTTP 200 is a confirmed reachable path. No common-file list is guessed and the body is not copied. Docs: https://www.brainiac.software/api/security-configuration/docs#security-configuration-exposed-file-check
- POST /api/v1/security-configuration/public-endpoint-audit — $0.05 USDC — Audit listed public endpoints: Send one GET to each listed public URL and record HTTPS, HSTS, and nosniff. Credential URLs and non-public addresses are not fetched. No login or credential test is attempted. Docs: https://www.brainiac.software/api/security-configuration/docs#security-configuration-public-endpoint-audit
- POST /api/v1/security-configuration/website-report — $0.12 USDC — Report website security configuration: Combine header, TLS, cookie, CORS, and CSP observations for one public URL or supplied configuration. Extra paths and endpoints are requested only when listed. The report does not show that the site is secure. Docs: https://www.brainiac.software/api/security-configuration/docs#security-configuration-website-report