{"openapi":"3.1.0","info":{"title":"Cybersecurity Configuration Intelligence API","version":"1.0.0","description":"Read security headers, TLS, cookies, CORS, and CSP from a public URL or from configuration supplied by the caller. Listed paths are the only extra resources requested. Paid with x402 exact USDC on Base. No account is required.","contact":{"email":"support@brainiac.software"},"x-guidance":"BRAINIAC.software is a pay-per-call API for software agents. No account or API key is required.\nPayment uses the x402 protocol with exact USDC on Base (chain id 8453). Each POST operation has a fixed USD price.\nHow to call an operation:\n1. POST a JSON body matching the operation's requestBody schema to the operation path. Include an Idempotency-Key header (64 hex characters, 32 random bytes).\n2. If you have not paid, the server responds 402 with payment requirements in the body. Pay the exact amount to the payTo address on Base.\n3. Retry the identical request with the same Idempotency-Key and add a payment-signature header containing the x402 payment payload. On success (200) the operation result is returned.\n4. Reuse the same Idempotency-Key only for retries of the same operation and request body; it will not be charged twice.\nAll outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Verify time-sensitive or official data with the cited source before acting."},"servers":[{"url":"https://www.brainiac.software"}],"paths":{"/api/v1/security-configuration/header-audit":{"post":{"operationId":"audit_security_headers","summary":"Audit security headers","description":"Read security headers from a public URL or from headers supplied by the caller. A missing header is a confirmed gap only when the response was available. This does not show that the site is secure.","tags":["security-configuration"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"url":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"},"origin":{"type":"string","minLength":8,"maxLength":200},"transport":{"type":"string","enum":["http","https"]},"headers":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80},"value":{"type":"string","maxLength":4000}},"required":["name","value"],"additionalProperties":false}},"setCookies":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":2000}},"contentSecurityPolicy":{"type":"string","maxLength":8000},"contentSecurityPolicyReportOnly":{"type":"string","maxLength":8000},"tls":{"type":"object","properties":{"protocol":{"type":"string","maxLength":40},"issuer":{"type":"string","maxLength":200},"subject":{"type":"string","maxLength":200},"validFrom":{"type":"string","maxLength":80},"validTo":{"type":"string","maxLength":80},"authorized":{"type":"boolean"},"hostnameMatches":{"type":"boolean"}},"additionalProperties":false},"paths":{"maxItems":4,"type":"array","items":{"type":"string","minLength":1,"maxLength":200}},"endpoints":{"maxItems":4,"type":"array","items":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"}}},"additionalProperties":false},"example":{"transport":"https","headers":[{"name":"Strict-Transport-Security","value":"max-age=0"},{"name":"Content-Security-Policy","value":"default-src 'none'"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"websiteSecure":{"type":"boolean"},"securityDetermined":{"type":"boolean"},"requestsSent":{"type":"number"},"confirmedCount":{"type":"number"},"unavailableCount":{"type":"number"},"recommendationCount":{"type":"number"},"status":{"type":"string"},"requestedUrl":{"type":"string"},"finalUrl":{"type":"string"},"httpStatus":{"type":"number"},"transport":{"type":"string"},"present":{"type":"array","items":{"type":"string"}},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-03T16:00:00.000Z","websiteSecure":false,"securityDetermined":false,"requestsSent":0,"confirmedCount":3,"unavailableCount":0,"recommendationCount":2,"status":"checked","requestedUrl":"","finalUrl":"","httpStatus":0,"transport":"https","present":["content-security-policy","strict-transport-security"],"findings":[{"kind":"confirmed","code":"hsts_disabled","subject":"strict-transport-security","detail":"Strict-Transport-Security sets max-age to 0."},{"kind":"confirmed","code":"content_type_options_missing","subject":"x-content-type-options","detail":"X-Content-Type-Options was absent."},{"kind":"confirmed","code":"framing_control_missing","subject":"x-frame-options","detail":"Neither X-Frame-Options nor CSP frame-ancestors was present."},{"kind":"recommendation","code":"referrer_policy_missing","subject":"referrer-policy","detail":"Referrer-Policy was absent."},{"kind":"recommendation","code":"permissions_policy_missing","subject":"permissions-policy","detail":"Permissions-Policy was absent."}],"limitations":["These checks do not show that a website is secure.","Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.","A path or endpoint is requested only when the caller lists it.","Cookie values are not copied into the response.","An unavailable check means that configuration was not in the response."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/security-configuration/tls-audit":{"post":{"operationId":"audit_tls_configuration","summary":"Audit TLS configuration","description":"Read the certificate from one public HTTPS request, or from certificate fields supplied by the caller. An old protocol, an expired certificate, a name mismatch, or an untrusted certificate is confirmed. This does not show that the site is secure.","tags":["security-configuration"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"url":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"},"origin":{"type":"string","minLength":8,"maxLength":200},"transport":{"type":"string","enum":["http","https"]},"headers":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80},"value":{"type":"string","maxLength":4000}},"required":["name","value"],"additionalProperties":false}},"setCookies":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":2000}},"contentSecurityPolicy":{"type":"string","maxLength":8000},"contentSecurityPolicyReportOnly":{"type":"string","maxLength":8000},"tls":{"type":"object","properties":{"protocol":{"type":"string","maxLength":40},"issuer":{"type":"string","maxLength":200},"subject":{"type":"string","maxLength":200},"validFrom":{"type":"string","maxLength":80},"validTo":{"type":"string","maxLength":80},"authorized":{"type":"boolean"},"hostnameMatches":{"type":"boolean"}},"additionalProperties":false},"paths":{"maxItems":4,"type":"array","items":{"type":"string","minLength":1,"maxLength":200}},"endpoints":{"maxItems":4,"type":"array","items":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"}}},"additionalProperties":false},"example":{"tls":{"protocol":"TLSv1.0","issuer":"Example","subject":"example.com","validFrom":"Jan 1 00:00:00 2020 GMT","validTo":"Jan 1 00:00:00 2024 GMT","authorized":false,"hostnameMatches":false}}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"websiteSecure":{"type":"boolean"},"securityDetermined":{"type":"boolean"},"requestsSent":{"type":"number"},"confirmedCount":{"type":"number"},"unavailableCount":{"type":"number"},"recommendationCount":{"type":"number"},"status":{"type":"string"},"requestedUrl":{"type":"string"},"finalUrl":{"type":"string"},"httpStatus":{"type":"number"},"protocol":{"type":"string"},"issuer":{"type":"string"},"subject":{"type":"string"},"validFrom":{"type":"string"},"validTo":{"type":"string"},"authorized":{"type":"boolean"},"hostnameMatches":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-03T16:00:00.000Z","websiteSecure":false,"securityDetermined":false,"requestsSent":0,"confirmedCount":4,"unavailableCount":0,"recommendationCount":0,"status":"checked","requestedUrl":"","finalUrl":"","httpStatus":0,"protocol":"TLSv1.0","issuer":"Example","subject":"example.com","validFrom":"Jan 1 00:00:00 2020 GMT","validTo":"Jan 1 00:00:00 2024 GMT","authorized":false,"hostnameMatches":false,"findings":[{"kind":"confirmed","code":"tls_name_mismatch","subject":"example.com","detail":"The supplied certificate information says the host name does not match."},{"kind":"confirmed","code":"tls_untrusted","subject":"Example","detail":"The supplied certificate information says the certificate is not authorized."},{"kind":"confirmed","code":"tls_expired","subject":"example.com","detail":"The certificate end date is in the past."},{"kind":"confirmed","code":"tls_protocol_old","subject":"TLSv1.0","detail":"The negotiated protocol is older than TLS 1.2."}],"limitations":["These checks do not show that a website is secure.","Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.","A path or endpoint is requested only when the caller lists it.","Cookie values are not copied into the response.","An unavailable check means that configuration was not in the response."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/security-configuration/cookie-audit":{"post":{"operationId":"audit_cookie_attributes","summary":"Audit cookie attributes","description":"Check Secure, HttpOnly, and SameSite on Set-Cookie headers from one public response or from cookie lines supplied by the caller. Cookie values are not returned.","tags":["security-configuration"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"url":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"},"origin":{"type":"string","minLength":8,"maxLength":200},"transport":{"type":"string","enum":["http","https"]},"headers":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80},"value":{"type":"string","maxLength":4000}},"required":["name","value"],"additionalProperties":false}},"setCookies":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":2000}},"contentSecurityPolicy":{"type":"string","maxLength":8000},"contentSecurityPolicyReportOnly":{"type":"string","maxLength":8000},"tls":{"type":"object","properties":{"protocol":{"type":"string","maxLength":40},"issuer":{"type":"string","maxLength":200},"subject":{"type":"string","maxLength":200},"validFrom":{"type":"string","maxLength":80},"validTo":{"type":"string","maxLength":80},"authorized":{"type":"boolean"},"hostnameMatches":{"type":"boolean"}},"additionalProperties":false},"paths":{"maxItems":4,"type":"array","items":{"type":"string","minLength":1,"maxLength":200}},"endpoints":{"maxItems":4,"type":"array","items":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"}}},"additionalProperties":false},"example":{"transport":"https","setCookies":["session=sessionsecret; Path=/"]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"websiteSecure":{"type":"boolean"},"securityDetermined":{"type":"boolean"},"requestsSent":{"type":"number"},"confirmedCount":{"type":"number"},"unavailableCount":{"type":"number"},"recommendationCount":{"type":"number"},"status":{"type":"string"},"requestedUrl":{"type":"string"},"finalUrl":{"type":"string"},"httpStatus":{"type":"number"},"transport":{"type":"string"},"cookies":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"secure":{"type":"boolean"},"httpOnly":{"type":"boolean"},"sameSite":{"type":"string"}},"additionalProperties":true}},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-03T16:00:00.000Z","websiteSecure":false,"securityDetermined":false,"requestsSent":0,"confirmedCount":1,"unavailableCount":0,"recommendationCount":2,"status":"checked","requestedUrl":"","finalUrl":"","httpStatus":0,"transport":"https","cookies":[{"name":"session","secure":false,"httpOnly":false,"sameSite":""}],"findings":[{"kind":"confirmed","code":"cookie_secure_missing","subject":"session","detail":"This cookie was set on HTTPS without the Secure attribute."},{"kind":"recommendation","code":"cookie_httponly_missing","subject":"session","detail":"This cookie does not set HttpOnly. Not every cookie needs that attribute."},{"kind":"recommendation","code":"cookie_samesite_missing","subject":"session","detail":"SameSite was not set."}],"limitations":["These checks do not show that a website is secure.","Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.","A path or endpoint is requested only when the caller lists it.","Cookie values are not copied into the response.","An unavailable check means that configuration was not in the response."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.03"},"protocols":[{"x402":{}}]}}},"/api/v1/security-configuration/cors-policy-audit":{"post":{"operationId":"audit_a_cors_policy","summary":"Audit a CORS policy","description":"Read CORS response headers. When an origin is supplied, it is sent once on the public GET. A wildcard, or a reflected origin with credentials, is confirmed. No other origins are tried.","tags":["security-configuration"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"url":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"},"origin":{"type":"string","minLength":8,"maxLength":200},"transport":{"type":"string","enum":["http","https"]},"headers":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80},"value":{"type":"string","maxLength":4000}},"required":["name","value"],"additionalProperties":false}},"setCookies":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":2000}},"contentSecurityPolicy":{"type":"string","maxLength":8000},"contentSecurityPolicyReportOnly":{"type":"string","maxLength":8000},"tls":{"type":"object","properties":{"protocol":{"type":"string","maxLength":40},"issuer":{"type":"string","maxLength":200},"subject":{"type":"string","maxLength":200},"validFrom":{"type":"string","maxLength":80},"validTo":{"type":"string","maxLength":80},"authorized":{"type":"boolean"},"hostnameMatches":{"type":"boolean"}},"additionalProperties":false},"paths":{"maxItems":4,"type":"array","items":{"type":"string","minLength":1,"maxLength":200}},"endpoints":{"maxItems":4,"type":"array","items":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"}}},"additionalProperties":false},"example":{"headers":[{"name":"Access-Control-Allow-Origin","value":"*"},{"name":"Access-Control-Allow-Credentials","value":"true"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"websiteSecure":{"type":"boolean"},"securityDetermined":{"type":"boolean"},"requestsSent":{"type":"number"},"confirmedCount":{"type":"number"},"unavailableCount":{"type":"number"},"recommendationCount":{"type":"number"},"status":{"type":"string"},"requestedUrl":{"type":"string"},"finalUrl":{"type":"string"},"httpStatus":{"type":"number"},"allowOrigin":{"type":"string"},"allowCredentials":{"type":"string"},"allowMethods":{"type":"string"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-03T16:00:00.000Z","websiteSecure":false,"securityDetermined":false,"requestsSent":0,"confirmedCount":2,"unavailableCount":1,"recommendationCount":0,"status":"checked","requestedUrl":"","finalUrl":"","httpStatus":0,"allowOrigin":"*","allowCredentials":"true","allowMethods":"","findings":[{"kind":"confirmed","code":"cors_wildcard","subject":"access-control-allow-origin","detail":"The response allows any origin."},{"kind":"confirmed","code":"cors_wildcard_credentials","subject":"access-control-allow-credentials","detail":"The response allows any origin and also allows credentials."},{"kind":"unavailable","code":"cors_origin_untested","subject":"","detail":"No origin was supplied, so reflection was not tested."}],"limitations":["These checks do not show that a website is secure.","Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.","A path or endpoint is requested only when the caller lists it.","Cookie values are not copied into the response.","An unavailable check means that configuration was not in the response."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/security-configuration/csp-policy-analyze":{"post":{"operationId":"analyze_a_csp_policy","summary":"Analyze a CSP policy","description":"Read Content-Security-Policy from a public response or from policy text supplied by the caller. unsafe-inline, unsafe-eval, a script wildcard, and data: scripts are confirmed. This is not a full policy review.","tags":["security-configuration"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"url":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"},"origin":{"type":"string","minLength":8,"maxLength":200},"transport":{"type":"string","enum":["http","https"]},"headers":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80},"value":{"type":"string","maxLength":4000}},"required":["name","value"],"additionalProperties":false}},"setCookies":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":2000}},"contentSecurityPolicy":{"type":"string","maxLength":8000},"contentSecurityPolicyReportOnly":{"type":"string","maxLength":8000},"tls":{"type":"object","properties":{"protocol":{"type":"string","maxLength":40},"issuer":{"type":"string","maxLength":200},"subject":{"type":"string","maxLength":200},"validFrom":{"type":"string","maxLength":80},"validTo":{"type":"string","maxLength":80},"authorized":{"type":"boolean"},"hostnameMatches":{"type":"boolean"}},"additionalProperties":false},"paths":{"maxItems":4,"type":"array","items":{"type":"string","minLength":1,"maxLength":200}},"endpoints":{"maxItems":4,"type":"array","items":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"}}},"additionalProperties":false},"example":{"contentSecurityPolicy":"default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' *"}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"websiteSecure":{"type":"boolean"},"securityDetermined":{"type":"boolean"},"requestsSent":{"type":"number"},"confirmedCount":{"type":"number"},"unavailableCount":{"type":"number"},"recommendationCount":{"type":"number"},"status":{"type":"string"},"requestedUrl":{"type":"string"},"finalUrl":{"type":"string"},"httpStatus":{"type":"number"},"enforced":{"type":"boolean"},"directives":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"value":{"type":"string"}},"additionalProperties":true}},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-03T16:00:00.000Z","websiteSecure":false,"securityDetermined":false,"requestsSent":0,"confirmedCount":3,"unavailableCount":0,"recommendationCount":0,"status":"checked","requestedUrl":"","finalUrl":"","httpStatus":0,"enforced":true,"directives":[{"name":"default-src","value":"'self'"},{"name":"script-src","value":"'unsafe-inline' 'unsafe-eval' *"}],"findings":[{"kind":"confirmed","code":"csp_unsafe_inline","subject":"script-src","detail":"script-src or default-src allows unsafe-inline."},{"kind":"confirmed","code":"csp_unsafe_eval","subject":"script-src","detail":"script-src or default-src allows unsafe-eval."},{"kind":"confirmed","code":"csp_script_wildcard","subject":"script-src","detail":"script-src or default-src allows every host."}],"limitations":["These checks do not show that a website is secure.","Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.","A path or endpoint is requested only when the caller lists it.","Cookie values are not copied into the response.","An unavailable check means that configuration was not in the response."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/security-configuration/exposed-file-check":{"post":{"operationId":"check_listed_public_paths","summary":"Check listed public paths","description":"Request only the paths the caller lists, on the same host as the supplied URL. A non-HTML HTTP 200 is a confirmed reachable path. No common-file list is guessed and the body is not copied.","tags":["security-configuration"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"url":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"},"origin":{"type":"string","minLength":8,"maxLength":200},"transport":{"type":"string","enum":["http","https"]},"headers":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80},"value":{"type":"string","maxLength":4000}},"required":["name","value"],"additionalProperties":false}},"setCookies":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":2000}},"contentSecurityPolicy":{"type":"string","maxLength":8000},"contentSecurityPolicyReportOnly":{"type":"string","maxLength":8000},"tls":{"type":"object","properties":{"protocol":{"type":"string","maxLength":40},"issuer":{"type":"string","maxLength":200},"subject":{"type":"string","maxLength":200},"validFrom":{"type":"string","maxLength":80},"validTo":{"type":"string","maxLength":80},"authorized":{"type":"boolean"},"hostnameMatches":{"type":"boolean"}},"additionalProperties":false},"paths":{"maxItems":4,"type":"array","items":{"type":"string","minLength":1,"maxLength":200}},"endpoints":{"maxItems":4,"type":"array","items":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"}}},"additionalProperties":false},"example":{"url":"https://user:pass@example.com/","paths":["/.env","/../secret"]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"websiteSecure":{"type":"boolean"},"securityDetermined":{"type":"boolean"},"requestsSent":{"type":"number"},"confirmedCount":{"type":"number"},"unavailableCount":{"type":"number"},"recommendationCount":{"type":"number"},"status":{"type":"string"},"paths":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string"},"httpStatus":{"type":"number"},"contentType":{"type":"string"},"exposed":{"type":"boolean"}},"additionalProperties":true}},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-03T16:00:00.000Z","websiteSecure":false,"securityDetermined":false,"requestsSent":0,"confirmedCount":0,"unavailableCount":2,"recommendationCount":0,"status":"unavailable","paths":[{"path":"/.env","httpStatus":0,"contentType":"","exposed":false},{"path":"/../secret","httpStatus":0,"contentType":"","exposed":false}],"findings":[{"kind":"unavailable","code":"path_rejected","subject":"/.env","detail":"The path leaves the supplied host, contains .., or could not be parsed. It was not requested."},{"kind":"unavailable","code":"path_rejected","subject":"/../secret","detail":"The path leaves the supplied host, contains .., or could not be parsed. It was not requested."}],"limitations":["These checks do not show that a website is secure.","Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.","A path or endpoint is requested only when the caller lists it.","Cookie values are not copied into the response.","An unavailable check means that configuration was not in the response."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/security-configuration/public-endpoint-audit":{"post":{"operationId":"audit_listed_public_endpoints","summary":"Audit listed public endpoints","description":"Send one GET to each listed public URL and record HTTPS, HSTS, and nosniff. Credential URLs and non-public addresses are not fetched. No login or credential test is attempted.","tags":["security-configuration"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"url":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"},"origin":{"type":"string","minLength":8,"maxLength":200},"transport":{"type":"string","enum":["http","https"]},"headers":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80},"value":{"type":"string","maxLength":4000}},"required":["name","value"],"additionalProperties":false}},"setCookies":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":2000}},"contentSecurityPolicy":{"type":"string","maxLength":8000},"contentSecurityPolicyReportOnly":{"type":"string","maxLength":8000},"tls":{"type":"object","properties":{"protocol":{"type":"string","maxLength":40},"issuer":{"type":"string","maxLength":200},"subject":{"type":"string","maxLength":200},"validFrom":{"type":"string","maxLength":80},"validTo":{"type":"string","maxLength":80},"authorized":{"type":"boolean"},"hostnameMatches":{"type":"boolean"}},"additionalProperties":false},"paths":{"maxItems":4,"type":"array","items":{"type":"string","minLength":1,"maxLength":200}},"endpoints":{"maxItems":4,"type":"array","items":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"}}},"additionalProperties":false},"example":{"endpoints":["https://user:pass@example.com/admin","http://127.0.0.1/latest/meta-data"]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"websiteSecure":{"type":"boolean"},"securityDetermined":{"type":"boolean"},"requestsSent":{"type":"number"},"confirmedCount":{"type":"number"},"unavailableCount":{"type":"number"},"recommendationCount":{"type":"number"},"status":{"type":"string"},"endpoints":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string"},"httpStatus":{"type":"number"},"transport":{"type":"string"},"contentTypeOptions":{"type":"boolean"},"hsts":{"type":"boolean"}},"additionalProperties":true}},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-03T16:00:00.000Z","websiteSecure":false,"securityDetermined":false,"requestsSent":0,"confirmedCount":0,"unavailableCount":2,"recommendationCount":0,"status":"unavailable","endpoints":[{"url":"https://user:pass@example.com/admin","httpStatus":0,"transport":"https","contentTypeOptions":false,"hsts":false},{"url":"http://127.0.0.1/latest/meta-data","httpStatus":0,"transport":"http","contentTypeOptions":false,"hsts":false}],"findings":[{"kind":"unavailable","code":"endpoint_unavailable","subject":"https://user:pass@example.com/admin","detail":"The URL contains credentials and was not fetched."},{"kind":"unavailable","code":"endpoint_unavailable","subject":"http://127.0.0.1/latest/meta-data","detail":"The address is not public and was not fetched."}],"limitations":["These checks do not show that a website is secure.","Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.","A path or endpoint is requested only when the caller lists it.","Cookie values are not copied into the response.","An unavailable check means that configuration was not in the response."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/security-configuration/website-report":{"post":{"operationId":"report_website_security_configuration","summary":"Report website security configuration","description":"Combine header, TLS, cookie, CORS, and CSP observations for one public URL or supplied configuration. Extra paths and endpoints are requested only when listed. The report does not show that the site is secure.","tags":["security-configuration"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"url":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"},"origin":{"type":"string","minLength":8,"maxLength":200},"transport":{"type":"string","enum":["http","https"]},"headers":{"maxItems":40,"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80},"value":{"type":"string","maxLength":4000}},"required":["name","value"],"additionalProperties":false}},"setCookies":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":2000}},"contentSecurityPolicy":{"type":"string","maxLength":8000},"contentSecurityPolicyReportOnly":{"type":"string","maxLength":8000},"tls":{"type":"object","properties":{"protocol":{"type":"string","maxLength":40},"issuer":{"type":"string","maxLength":200},"subject":{"type":"string","maxLength":200},"validFrom":{"type":"string","maxLength":80},"validTo":{"type":"string","maxLength":80},"authorized":{"type":"boolean"},"hostnameMatches":{"type":"boolean"}},"additionalProperties":false},"paths":{"maxItems":4,"type":"array","items":{"type":"string","minLength":1,"maxLength":200}},"endpoints":{"maxItems":4,"type":"array","items":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?:\\/\\/\\S+$"}}},"additionalProperties":false},"example":{"transport":"https","headers":[{"name":"Strict-Transport-Security","value":"max-age=0"},{"name":"Access-Control-Allow-Origin","value":"*"},{"name":"Access-Control-Allow-Credentials","value":"true"}],"setCookies":["session=sessionsecret; Path=/"],"contentSecurityPolicy":"default-src 'self'; script-src 'unsafe-inline'","tls":{"protocol":"TLSv1.2","issuer":"Example","subject":"example.com","validFrom":"Jan 1 00:00:00 2026 GMT","validTo":"Jan 1 00:00:00 2027 GMT","authorized":true,"hostnameMatches":true}}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"websiteSecure":{"type":"boolean"},"securityDetermined":{"type":"boolean"},"requestsSent":{"type":"number"},"confirmedCount":{"type":"number"},"unavailableCount":{"type":"number"},"recommendationCount":{"type":"number"},"status":{"type":"string"},"requestedUrl":{"type":"string"},"finalUrl":{"type":"string"},"httpStatus":{"type":"number"},"transport":{"type":"string"},"present":{"type":"array","items":{"type":"string"}},"protocol":{"type":"string"},"paths":{"type":"array","items":{}},"endpoints":{"type":"array","items":{}},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-03T16:00:00.000Z","websiteSecure":false,"securityDetermined":false,"requestsSent":0,"confirmedCount":7,"unavailableCount":3,"recommendationCount":4,"status":"checked","requestedUrl":"","finalUrl":"","httpStatus":0,"transport":"https","present":["access-control-allow-credentials","access-control-allow-origin","content-security-policy","strict-transport-security"],"protocol":"TLSv1.2","paths":[],"endpoints":[],"findings":[{"kind":"confirmed","code":"hsts_disabled","subject":"strict-transport-security","detail":"Strict-Transport-Security sets max-age to 0."},{"kind":"confirmed","code":"content_type_options_missing","subject":"x-content-type-options","detail":"X-Content-Type-Options was absent."},{"kind":"confirmed","code":"framing_control_missing","subject":"x-frame-options","detail":"Neither X-Frame-Options nor CSP frame-ancestors was present."},{"kind":"recommendation","code":"referrer_policy_missing","subject":"referrer-policy","detail":"Referrer-Policy was absent."},{"kind":"recommendation","code":"permissions_policy_missing","subject":"permissions-policy","detail":"Permissions-Policy was absent."},{"kind":"confirmed","code":"cookie_secure_missing","subject":"session","detail":"This cookie was set on HTTPS without the Secure attribute."},{"kind":"recommendation","code":"cookie_httponly_missing","subject":"session","detail":"This cookie does not set HttpOnly. Not every cookie needs that attribute."},{"kind":"recommendation","code":"cookie_samesite_missing","subject":"session","detail":"SameSite was not set."},{"kind":"confirmed","code":"cors_wildcard","subject":"access-control-allow-origin","detail":"The response allows any origin."},{"kind":"confirmed","code":"cors_wildcard_credentials","subject":"access-control-allow-credentials","detail":"The response allows any origin and also allows credentials."},{"kind":"unavailable","code":"cors_origin_untested","subject":"","detail":"No origin was supplied, so reflection was not tested."},{"kind":"confirmed","code":"csp_unsafe_inline","subject":"script-src","detail":"script-src or default-src allows unsafe-inline."},{"kind":"unavailable","code":"url_missing","subject":"","detail":"A public URL is required before a path is requested."},{"kind":"unavailable","code":"endpoints_missing","subject":"","detail":"No extra endpoint was listed. The main URL was not requested again."}],"limitations":["These checks do not show that a website is secure.","Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.","A path or endpoint is requested only when the caller lists it.","Cookie values are not copied into the response.","An unavailable check means that configuration was not in the response."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.12"},"protocols":[{"x402":{}}]}}}},"components":{"schemas":{"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}}}}}