{"openapi":"3.1.0","info":{"title":"Security Signal Intelligence API","version":"1.0.0","description":"Correlate security events, detect weak signals and attack sequences, surface insider-threat, privilege-escalation, lateral-movement, account-takeover, credential-abuse, and brute-force patterns, and score severity—using caller-supplied JSON events and logs with local explainable rules only. Paid with x402 exact USDC on Base. No account is required.","contact":{"email":"support@brainiac.software"},"x-guidance":"BRAINIAC.software is a pay-per-call API for software agents. No account or API key is required.\nPayment uses the x402 protocol with exact USDC on Base (chain id 8453). Each POST operation has a fixed USD price.\nHow to call an operation:\n1. POST a JSON body matching the operation's requestBody schema to the operation path. Include an Idempotency-Key header (64 hex characters, 32 random bytes).\n2. If you have not paid, the server responds 402 with payment requirements in the body. Pay the exact amount to the payTo address on Base.\n3. Retry the identical request with the same Idempotency-Key and add a payment-signature header containing the x402 payment payload. On success (200) the operation result is returned.\n4. Reuse the same Idempotency-Key only for retries of the same operation and request body; it will not be charged twice.\nAll outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Verify time-sensitive or official data with the cited source before acting."},"servers":[{"url":"https://www.brainiac.software"}],"paths":{"/api/v1/security-signals/event-correlate":{"post":{"operationId":"correlate_security_events","summary":"Correlate security events","description":"Correlate caller-supplied security events into related incident groups using time windows and shared actor/host/IP links. Observed grouping only—not a confirmed attack.","tags":["security-signals"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"eventType":{"type":"string","maxLength":120},"category":{"type":"string","maxLength":80},"severity":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"host":{"type":"string","maxLength":253},"sourceHost":{"type":"string","maxLength":253},"destinationHost":{"type":"string","maxLength":253},"sourceIp":{"type":"string","maxLength":80},"destinationIp":{"type":"string","maxLength":80},"process":{"type":"string","maxLength":160},"action":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","unknown"]},"privilege":{"type":"string","maxLength":80},"previousPrivilege":{"type":"string","maxLength":80},"authMethod":{"type":"string","maxLength":80},"mfaUsed":{"type":"boolean"},"geoCountry":{"type":"string","maxLength":80},"previousGeoCountry":{"type":"string","maxLength":80},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"count":{"type":"number","minimum":0,"maximum":1000000000},"message":{"type":"string","maxLength":4000},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"relatedEventIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"correlationWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"weakSignalWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"sequenceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceFailureThreshold":{"type":"number","minimum":2,"maximum":10000},"lowAndSlowFailureThreshold":{"type":"number","minimum":2,"maximum":10000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","correlationWindowMinutes":60,"events":[{"id":"E1","at":"2026-11-04T20:00:00.000Z","eventType":"auth_failure","category":"auth","userId":"u1","host":"vpn-1","sourceIp":"203.0.113.10","outcome":"failure","source":"Caller-supplied SIEM"},{"id":"E2","at":"2026-11-04T20:05:00.000Z","eventType":"auth_success","category":"auth","userId":"u1","host":"vpn-1","sourceIp":"203.0.113.10","outcome":"success","source":"Caller-supplied SIEM"},{"id":"E3","at":"2026-11-04T20:10:00.000Z","eventType":"remote_logon","category":"auth","userId":"u1","host":"app-2","sourceIp":"203.0.113.10","outcome":"success","source":"Caller-supplied SIEM"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"groupCount":{"type":"number"},"windowMinutes":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confirmedAttack":{"type":"boolean"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"infrastructureConnected":{"type":"boolean"},"confirmedAttackClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"correlated","groupCount":1,"windowMinutes":60,"items":[{"id":"event-correlate-E1","detector":"event-correlate","title":"Related security event group","status":"signal","observedFacts":["3 events occurred within 60 minutes.","Shared actor keys: u1.","Shared host keys: vpn_1, app_2."],"inferredThreat":"Events may belong to one incident cluster based on time proximity and shared actor/host/IP links.","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E1","E2","E3"],"firstAt":"2026-11-04T20:00:00.000Z","lastAt":"2026-11-04T20:10:00.000Z","reasons":["time_window","shared_actor","shared_host"],"evidence":[{"eventId":"E1","at":"2026-11-04T20:00:00.000Z","fact":"auth_failure on vpn-1 outcome=failure","inference":"Grouped by caller-supplied fields and time proximity only.","confidence":"medium"},{"eventId":"E2","at":"2026-11-04T20:05:00.000Z","fact":"auth_success on vpn-1 outcome=success","inference":"Grouped by caller-supplied fields and time proximity only.","confidence":"medium"},{"eventId":"E3","at":"2026-11-04T20:10:00.000Z","fact":"remote_logon on app-2 outcome=success","inference":"Grouped by caller-supplied fields and time proximity only.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"}],"paidProviderUsed":false,"apiKeyRequired":false,"networkAccessed":false,"infrastructureConnected":false,"confirmedAttackClaimed":false,"findings":[{"kind":"observation","code":"event_group","subject":"event-correlate-E1","detail":"Correlated 3 events (confidence=medium, confirmedAttack=false)."}],"limitations":["Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.","Detections are local rule and time-window analyses over supplied records. Missing values are not invented.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.","No paid threat-intel feed or endpoint agent is used and no API key is required.","Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/security-signals/weak-signal-detect":{"post":{"operationId":"detect_weak_security_signals","summary":"Detect weak security signals","description":"Identify early suspicious-activity indicators from caller-supplied events. Weak signals are hypotheses with explicit confidence—not confirmed attacks.","tags":["security-signals"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"eventType":{"type":"string","maxLength":120},"category":{"type":"string","maxLength":80},"severity":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"host":{"type":"string","maxLength":253},"sourceHost":{"type":"string","maxLength":253},"destinationHost":{"type":"string","maxLength":253},"sourceIp":{"type":"string","maxLength":80},"destinationIp":{"type":"string","maxLength":80},"process":{"type":"string","maxLength":160},"action":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","unknown"]},"privilege":{"type":"string","maxLength":80},"previousPrivilege":{"type":"string","maxLength":80},"authMethod":{"type":"string","maxLength":80},"mfaUsed":{"type":"boolean"},"geoCountry":{"type":"string","maxLength":80},"previousGeoCountry":{"type":"string","maxLength":80},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"count":{"type":"number","minimum":0,"maximum":1000000000},"message":{"type":"string","maxLength":4000},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"relatedEventIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"correlationWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"weakSignalWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"sequenceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceFailureThreshold":{"type":"number","minimum":2,"maximum":10000},"lowAndSlowFailureThreshold":{"type":"number","minimum":2,"maximum":10000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","events":[{"id":"E1","at":"2026-11-04T20:00:00.000Z","eventType":"auth_failure","category":"auth","userId":"u1","host":"vpn-1","outcome":"failure","labels":["first_seen"],"source":"Caller-supplied"},{"id":"E2","at":"2026-11-04T20:02:00.000Z","eventType":"recon","userId":"u1","host":"vpn-1","message":"port scan probe","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"signalCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confirmedAttack":{"type":"boolean"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"infrastructureConnected":{"type":"boolean"},"confirmedAttackClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","signalCount":2,"items":[{"id":"weak-signal-detect-E1","detector":"weak-signal-detect","title":"Weak suspicious-activity signal","status":"signal","observedFacts":["Observed authentication failure outcome.","Observed anomaly/first-seen labels or wording in supplied data."],"inferredThreat":"Early indicator of suspicious activity may be present; not a confirmed attack.","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E1","E2"],"firstAt":"2026-11-04T20:00:00.000Z","lastAt":"2026-11-04T20:02:00.000Z","reasons":["auth_failure","anomaly_label"],"evidence":[{"eventId":"E1","at":"2026-11-04T20:00:00.000Z","fact":"Observed authentication failure outcome. Observed anomaly/first-seen labels or wording in supplied data.","inference":"1 nearby same-actor events were also supplied.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"},{"id":"weak-signal-detect-E1","detector":"weak-signal-detect","title":"Weak suspicious-activity signal","status":"signal","observedFacts":["Observed reconnaissance-like keywords in supplied event text."],"inferredThreat":"Early indicator of suspicious activity may be present; not a confirmed attack.","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E1","E2"],"firstAt":"2026-11-04T20:00:00.000Z","lastAt":"2026-11-04T20:02:00.000Z","reasons":["recon_keyword"],"evidence":[{"eventId":"E2","at":"2026-11-04T20:02:00.000Z","fact":"Observed reconnaissance-like keywords in supplied event text.","inference":"1 nearby same-actor events were also supplied.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"}],"paidProviderUsed":false,"apiKeyRequired":false,"networkAccessed":false,"infrastructureConnected":false,"confirmedAttackClaimed":false,"findings":[{"kind":"observation","code":"weak_signal","subject":"E1","detail":"Weak signal status=signal, confidence=medium."},{"kind":"observation","code":"weak_signal","subject":"E2","detail":"Weak signal status=signal, confidence=medium."}],"limitations":["Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.","Detections are local rule and time-window analyses over supplied records. Missing values are not invented.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.","No paid threat-intel feed or endpoint agent is used and no API key is required.","Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/security-signals/attack-sequence-detect":{"post":{"operationId":"detect_attack_sequences","summary":"Detect attack sequences","description":"Detect caller-supplied event sequences that match local attack-pattern rules. Matches are inferred patterns, not confirmed compromises.","tags":["security-signals"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"eventType":{"type":"string","maxLength":120},"category":{"type":"string","maxLength":80},"severity":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"host":{"type":"string","maxLength":253},"sourceHost":{"type":"string","maxLength":253},"destinationHost":{"type":"string","maxLength":253},"sourceIp":{"type":"string","maxLength":80},"destinationIp":{"type":"string","maxLength":80},"process":{"type":"string","maxLength":160},"action":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","unknown"]},"privilege":{"type":"string","maxLength":80},"previousPrivilege":{"type":"string","maxLength":80},"authMethod":{"type":"string","maxLength":80},"mfaUsed":{"type":"boolean"},"geoCountry":{"type":"string","maxLength":80},"previousGeoCountry":{"type":"string","maxLength":80},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"count":{"type":"number","minimum":0,"maximum":1000000000},"message":{"type":"string","maxLength":4000},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"relatedEventIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"correlationWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"weakSignalWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"sequenceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceFailureThreshold":{"type":"number","minimum":2,"maximum":10000},"lowAndSlowFailureThreshold":{"type":"number","minimum":2,"maximum":10000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","sequenceWindowMinutes":180,"events":[{"id":"E1","at":"2026-11-04T19:00:00.000Z","eventType":"auth_failure","category":"auth","userId":"u9","outcome":"failure","source":"Caller-supplied"},{"id":"E2","at":"2026-11-04T19:01:00.000Z","eventType":"auth_failure","category":"auth","userId":"u9","outcome":"failure","source":"Caller-supplied"},{"id":"E3","at":"2026-11-04T19:02:00.000Z","eventType":"auth_success","category":"auth","userId":"u9","outcome":"success","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"sequenceCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confirmedAttack":{"type":"boolean"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"infrastructureConnected":{"type":"boolean"},"confirmedAttackClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","sequenceCount":1,"items":[{"id":"attack-sequence-detect-E1","detector":"attack-sequence-detect","title":"Auth failures followed by success","status":"signal","observedFacts":["Step 1: auth_failure at 2026-11-04T19:00:00.000Z","Step 2: auth_success at 2026-11-04T19:02:00.000Z"],"inferredThreat":"Supplied events match local sequence pattern \"auth_fail_then_success\" for actor/host key u9. Not a confirmed attack.","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E1","E3"],"firstAt":"2026-11-04T19:00:00.000Z","lastAt":"2026-11-04T19:02:00.000Z","reasons":["sequence_match","auth_fail_then_success"],"evidence":[{"eventId":"E1","at":"2026-11-04T19:00:00.000Z","fact":"Observed step 1 event.","inference":"Fits pattern auth_fail_then_success within 180 minutes.","confidence":"medium"},{"eventId":"E3","at":"2026-11-04T19:02:00.000Z","fact":"Observed step 2 event.","inference":"Fits pattern auth_fail_then_success within 180 minutes.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"}],"paidProviderUsed":false,"apiKeyRequired":false,"networkAccessed":false,"infrastructureConnected":false,"confirmedAttackClaimed":false,"findings":[{"kind":"conflict","code":"attack_sequence","subject":"attack-sequence-detect-E1","detail":"Sequence pattern auth_fail_then_success matched with confidence=medium; confirmedAttack=false."}],"limitations":["Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.","Detections are local rule and time-window analyses over supplied records. Missing values are not invented.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.","No paid threat-intel feed or endpoint agent is used and no API key is required.","Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/security-signals/insider-threat-signal-detect":{"post":{"operationId":"detect_insider_threat_signals","summary":"Detect insider-threat signals","description":"Identify unusual user activity in caller-supplied logs (off-hours, bulk/export wording, privilege changes). Not a confirmed insider attack.","tags":["security-signals"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"eventType":{"type":"string","maxLength":120},"category":{"type":"string","maxLength":80},"severity":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"host":{"type":"string","maxLength":253},"sourceHost":{"type":"string","maxLength":253},"destinationHost":{"type":"string","maxLength":253},"sourceIp":{"type":"string","maxLength":80},"destinationIp":{"type":"string","maxLength":80},"process":{"type":"string","maxLength":160},"action":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","unknown"]},"privilege":{"type":"string","maxLength":80},"previousPrivilege":{"type":"string","maxLength":80},"authMethod":{"type":"string","maxLength":80},"mfaUsed":{"type":"boolean"},"geoCountry":{"type":"string","maxLength":80},"previousGeoCountry":{"type":"string","maxLength":80},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"count":{"type":"number","minimum":0,"maximum":1000000000},"message":{"type":"string","maxLength":4000},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"relatedEventIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"correlationWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"weakSignalWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"sequenceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceFailureThreshold":{"type":"number","minimum":2,"maximum":10000},"lowAndSlowFailureThreshold":{"type":"number","minimum":2,"maximum":10000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","events":[{"id":"E1","at":"2026-11-04T02:10:00.000Z","userId":"contractor-1","action":"download","message":"bulk export sensitive archive","count":250,"source":"Caller-supplied DLP"},{"id":"E2","at":"2026-11-04T02:40:00.000Z","userId":"contractor-1","action":"usb_copy","message":"copy to USB","source":"Caller-supplied DLP"},{"id":"E3","at":"2026-11-04T03:05:00.000Z","userId":"contractor-1","previousPrivilege":"user","privilege":"admin","source":"Caller-supplied IAM"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"signalCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confirmedAttack":{"type":"boolean"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"infrastructureConnected":{"type":"boolean"},"confirmedAttackClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","signalCount":1,"items":[{"id":"insider-threat-signal-detect-E1","detector":"insider-threat-signal-detect","title":"Unusual user-activity signal","status":"signal","observedFacts":["3 events occurred in off-hours UTC windows (22:00–05:00).","2 events show bulk/export/sensitive wording or high counts.","1 privilege-change rows were supplied for this user."],"inferredThreat":"Unusual activity pattern for user key contractor_1 may indicate insider-threat risk. Not a confirmed insider attack.","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E1","E2","E3"],"firstAt":"2026-11-04T02:10:00.000Z","lastAt":"2026-11-04T03:05:00.000Z","reasons":["off_hours","bulk_or_sensitive","privilege_change"],"evidence":[{"eventId":"E1","at":"2026-11-04T02:10:00.000Z","fact":"download outcome=unknown","inference":"Evaluated only against caller-supplied user activity rows.","confidence":"medium"},{"eventId":"E2","at":"2026-11-04T02:40:00.000Z","fact":"usb_copy outcome=unknown","inference":"Evaluated only against caller-supplied user activity rows.","confidence":"medium"},{"eventId":"E3","at":"2026-11-04T03:05:00.000Z","fact":"event outcome=unknown","inference":"Evaluated only against caller-supplied user activity rows.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"}],"paidProviderUsed":false,"apiKeyRequired":false,"networkAccessed":false,"infrastructureConnected":false,"confirmedAttackClaimed":false,"findings":[{"kind":"observation","code":"insider_signal","subject":"contractor_1","detail":"Insider-threat signal status=signal."}],"limitations":["Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.","Detections are local rule and time-window analyses over supplied records. Missing values are not invented.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.","No paid threat-intel feed or endpoint agent is used and no API key is required.","Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/security-signals/privilege-escalation-detect":{"post":{"operationId":"detect_privilege_escalation_indicators","summary":"Detect privilege-escalation indicators","description":"Detect privilege-escalation indicators from caller-supplied privilege fields and escalation keywords. Not confirmation of successful abuse.","tags":["security-signals"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"eventType":{"type":"string","maxLength":120},"category":{"type":"string","maxLength":80},"severity":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"host":{"type":"string","maxLength":253},"sourceHost":{"type":"string","maxLength":253},"destinationHost":{"type":"string","maxLength":253},"sourceIp":{"type":"string","maxLength":80},"destinationIp":{"type":"string","maxLength":80},"process":{"type":"string","maxLength":160},"action":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","unknown"]},"privilege":{"type":"string","maxLength":80},"previousPrivilege":{"type":"string","maxLength":80},"authMethod":{"type":"string","maxLength":80},"mfaUsed":{"type":"boolean"},"geoCountry":{"type":"string","maxLength":80},"previousGeoCountry":{"type":"string","maxLength":80},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"count":{"type":"number","minimum":0,"maximum":1000000000},"message":{"type":"string","maxLength":4000},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"relatedEventIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"correlationWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"weakSignalWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"sequenceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceFailureThreshold":{"type":"number","minimum":2,"maximum":10000},"lowAndSlowFailureThreshold":{"type":"number","minimum":2,"maximum":10000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","events":[{"id":"E1","at":"2026-11-04T18:00:00.000Z","userId":"u2","host":"srv-1","previousPrivilege":"user","privilege":"local-admin","message":"net localgroup administrators add","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"signalCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confirmedAttack":{"type":"boolean"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"infrastructureConnected":{"type":"boolean"},"confirmedAttackClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","signalCount":1,"items":[{"id":"privilege-escalation-detect-E1","detector":"privilege-escalation-detect","title":"Privilege-escalation indicator","status":"signal","observedFacts":["Observed privilege change user → local-admin.","Observed privilege-escalation keywords in supplied event text."],"inferredThreat":"Privilege escalation may have been attempted or completed. Not confirmed without corroborating controls evidence.","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E1"],"firstAt":"2026-11-04T18:00:00.000Z","lastAt":"2026-11-04T18:00:00.000Z","reasons":["privilege_field_change","escalation_keyword"],"evidence":[{"eventId":"E1","at":"2026-11-04T18:00:00.000Z","fact":"Observed privilege change user → local-admin. Observed privilege-escalation keywords in supplied event text.","inference":"Local keyword/field rules only; no endpoint agent was queried.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"}],"paidProviderUsed":false,"apiKeyRequired":false,"networkAccessed":false,"infrastructureConnected":false,"confirmedAttackClaimed":false,"findings":[{"kind":"conflict","code":"privilege_escalation","subject":"E1","detail":"Privilege-escalation indicator confidence=medium; confirmedAttack=false."}],"limitations":["Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.","Detections are local rule and time-window analyses over supplied records. Missing values are not invented.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.","No paid threat-intel feed or endpoint agent is used and no API key is required.","Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/security-signals/lateral-movement-detect":{"post":{"operationId":"detect_lateral_movement_indicators","summary":"Detect lateral-movement indicators","description":"Identify suspicious host-to-host movement from caller-supplied network/auth logs. Does not access the caller's network.","tags":["security-signals"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"eventType":{"type":"string","maxLength":120},"category":{"type":"string","maxLength":80},"severity":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"host":{"type":"string","maxLength":253},"sourceHost":{"type":"string","maxLength":253},"destinationHost":{"type":"string","maxLength":253},"sourceIp":{"type":"string","maxLength":80},"destinationIp":{"type":"string","maxLength":80},"process":{"type":"string","maxLength":160},"action":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","unknown"]},"privilege":{"type":"string","maxLength":80},"previousPrivilege":{"type":"string","maxLength":80},"authMethod":{"type":"string","maxLength":80},"mfaUsed":{"type":"boolean"},"geoCountry":{"type":"string","maxLength":80},"previousGeoCountry":{"type":"string","maxLength":80},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"count":{"type":"number","minimum":0,"maximum":1000000000},"message":{"type":"string","maxLength":4000},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"relatedEventIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"correlationWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"weakSignalWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"sequenceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceFailureThreshold":{"type":"number","minimum":2,"maximum":10000},"lowAndSlowFailureThreshold":{"type":"number","minimum":2,"maximum":10000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","events":[{"id":"E1","at":"2026-11-04T18:30:00.000Z","userId":"u2","sourceHost":"ws-10","destinationHost":"dc-01","message":"psexec remote exec","outcome":"success","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"signalCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confirmedAttack":{"type":"boolean"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"infrastructureConnected":{"type":"boolean"},"confirmedAttackClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","signalCount":1,"items":[{"id":"lateral-movement-detect-E1","detector":"lateral-movement-detect","title":"Lateral-movement indicator","status":"signal","observedFacts":["Observed host-to-host movement ws-10 → dc-01.","Observed lateral-movement tooling/protocol keywords in supplied text."],"inferredThreat":"Suspicious movement between systems may be present in supplied network/auth logs. Not a confirmed intrusion.","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E1"],"firstAt":"2026-11-04T18:30:00.000Z","lastAt":"2026-11-04T18:30:00.000Z","reasons":["host_to_host","lateral_keyword"],"evidence":[{"eventId":"E1","at":"2026-11-04T18:30:00.000Z","fact":"Observed host-to-host movement ws-10 → dc-01. Observed lateral-movement tooling/protocol keywords in supplied text.","inference":"Derived only from caller-supplied source/destination fields and keywords.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"}],"paidProviderUsed":false,"apiKeyRequired":false,"networkAccessed":false,"infrastructureConnected":false,"confirmedAttackClaimed":false,"findings":[{"kind":"conflict","code":"lateral_movement","subject":"E1","detail":"Lateral-movement indicator confidence=medium; confirmedAttack=false."}],"limitations":["Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.","Detections are local rule and time-window analyses over supplied records. Missing values are not invented.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.","No paid threat-intel feed or endpoint agent is used and no API key is required.","Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/security-signals/account-takeover-signal-detect":{"post":{"operationId":"detect_account_takeover_signals","summary":"Detect account-takeover signals","description":"Identify account-takeover indicators when multiple distinct signals appear for the same user (geo/device/MFA/recovery). Not a confirmed takeover.","tags":["security-signals"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"eventType":{"type":"string","maxLength":120},"category":{"type":"string","maxLength":80},"severity":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"host":{"type":"string","maxLength":253},"sourceHost":{"type":"string","maxLength":253},"destinationHost":{"type":"string","maxLength":253},"sourceIp":{"type":"string","maxLength":80},"destinationIp":{"type":"string","maxLength":80},"process":{"type":"string","maxLength":160},"action":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","unknown"]},"privilege":{"type":"string","maxLength":80},"previousPrivilege":{"type":"string","maxLength":80},"authMethod":{"type":"string","maxLength":80},"mfaUsed":{"type":"boolean"},"geoCountry":{"type":"string","maxLength":80},"previousGeoCountry":{"type":"string","maxLength":80},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"count":{"type":"number","minimum":0,"maximum":1000000000},"message":{"type":"string","maxLength":4000},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"relatedEventIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"correlationWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"weakSignalWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"sequenceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceFailureThreshold":{"type":"number","minimum":2,"maximum":10000},"lowAndSlowFailureThreshold":{"type":"number","minimum":2,"maximum":10000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","events":[{"id":"E1","at":"2026-11-04T17:00:00.000Z","userId":"u3","eventType":"password_reset","message":"password reset","source":"Caller-supplied IdP"},{"id":"E2","at":"2026-11-04T17:05:00.000Z","userId":"u3","eventType":"auth_success","outcome":"success","previousGeoCountry":"US","geoCountry":"RO","previousDeviceId":"dev-a","deviceId":"dev-b","mfaUsed":false,"source":"Caller-supplied IdP"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"signalCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confirmedAttack":{"type":"boolean"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"infrastructureConnected":{"type":"boolean"},"confirmedAttackClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","signalCount":1,"items":[{"id":"account-takeover-signal-detect-E1","detector":"account-takeover-signal-detect","title":"Account-takeover indicator set","status":"signal","observedFacts":["1 geo-change rows were supplied.","1 device-change rows were supplied.","1 events indicate MFA absent/bypass wording or successful auth without MFA when mfaUsed=false.","Observed recovery/reset wording and a successful auth event for the same user key."],"inferredThreat":"Account takeover indicators for user key u3 were observed across multiple signal types. Not a confirmed takeover.","confirmedAttack":false,"confidence":"high","relatedEventIds":["E1","E2"],"firstAt":"2026-11-04T17:00:00.000Z","lastAt":"2026-11-04T17:05:00.000Z","reasons":["impossible_or_changed_travel","new_device","mfa_gap","recovery_then_login"],"evidence":[{"eventId":"E1","at":"2026-11-04T17:00:00.000Z","fact":"password_reset geo=n/a device=n/a","inference":"Requires multiple distinct indicator kinds before status=signal.","confidence":"high"},{"eventId":"E2","at":"2026-11-04T17:05:00.000Z","fact":"auth_success geo=RO device=dev-b","inference":"Requires multiple distinct indicator kinds before status=signal.","confidence":"high"}],"source":"Caller-supplied events; local rules only"}],"paidProviderUsed":false,"apiKeyRequired":false,"networkAccessed":false,"infrastructureConnected":false,"confirmedAttackClaimed":false,"findings":[{"kind":"conflict","code":"account_takeover","subject":"u3","detail":"ATO signal status=signal, confidence=high; confirmedAttack=false."}],"limitations":["Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.","Detections are local rule and time-window analyses over supplied records. Missing values are not invented.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.","No paid threat-intel feed or endpoint agent is used and no API key is required.","Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/security-signals/credential-abuse-detect":{"post":{"operationId":"detect_credential_abuse_patterns","summary":"Detect credential-abuse patterns","description":"Detect suspicious credential usage such as repeated failures, fail-then-success, or reuse across many hosts from caller-supplied auth events.","tags":["security-signals"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"eventType":{"type":"string","maxLength":120},"category":{"type":"string","maxLength":80},"severity":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"host":{"type":"string","maxLength":253},"sourceHost":{"type":"string","maxLength":253},"destinationHost":{"type":"string","maxLength":253},"sourceIp":{"type":"string","maxLength":80},"destinationIp":{"type":"string","maxLength":80},"process":{"type":"string","maxLength":160},"action":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","unknown"]},"privilege":{"type":"string","maxLength":80},"previousPrivilege":{"type":"string","maxLength":80},"authMethod":{"type":"string","maxLength":80},"mfaUsed":{"type":"boolean"},"geoCountry":{"type":"string","maxLength":80},"previousGeoCountry":{"type":"string","maxLength":80},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"count":{"type":"number","minimum":0,"maximum":1000000000},"message":{"type":"string","maxLength":4000},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"relatedEventIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"correlationWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"weakSignalWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"sequenceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceFailureThreshold":{"type":"number","minimum":2,"maximum":10000},"lowAndSlowFailureThreshold":{"type":"number","minimum":2,"maximum":10000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","events":[{"id":"E1","at":"2026-11-04T16:00:00.000Z","username":"svc-backup","host":"db-1","outcome":"failure","category":"auth","sourceIp":"198.51.100.8","source":"Caller-supplied"},{"id":"E2","at":"2026-11-04T16:01:00.000Z","username":"svc-backup","host":"db-2","outcome":"failure","category":"auth","sourceIp":"198.51.100.8","source":"Caller-supplied"},{"id":"E3","at":"2026-11-04T16:02:00.000Z","username":"svc-backup","host":"db-3","outcome":"failure","category":"auth","sourceIp":"198.51.100.8","source":"Caller-supplied"},{"id":"E4","at":"2026-11-04T16:03:00.000Z","username":"svc-backup","host":"db-3","outcome":"success","category":"auth","sourceIp":"198.51.100.8","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"signalCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confirmedAttack":{"type":"boolean"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"infrastructureConnected":{"type":"boolean"},"confirmedAttackClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","signalCount":1,"items":[{"id":"credential-abuse-detect-E1","detector":"credential-abuse-detect","title":"Credential-abuse pattern","status":"signal","observedFacts":["3 authentication failures were supplied for credential key svc_backup_198_51_100_8.","Observed failures and at least one success for the same credential/source key.","Credential/source key touched 3 distinct hosts."],"inferredThreat":"Suspicious credential usage pattern may be present. Not confirmation that credentials were compromised.","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E1","E2","E3","E4"],"firstAt":"2026-11-04T16:00:00.000Z","lastAt":"2026-11-04T16:03:00.000Z","reasons":["repeated_failures","fail_then_success","spray_or_reuse_across_hosts"],"evidence":[{"eventId":"E1","at":"2026-11-04T16:00:00.000Z","fact":"outcome=failure host=db-1","inference":"Pattern derived from caller-supplied auth outcomes and host fan-out.","confidence":"medium"},{"eventId":"E2","at":"2026-11-04T16:01:00.000Z","fact":"outcome=failure host=db-2","inference":"Pattern derived from caller-supplied auth outcomes and host fan-out.","confidence":"medium"},{"eventId":"E3","at":"2026-11-04T16:02:00.000Z","fact":"outcome=failure host=db-3","inference":"Pattern derived from caller-supplied auth outcomes and host fan-out.","confidence":"medium"},{"eventId":"E4","at":"2026-11-04T16:03:00.000Z","fact":"outcome=success host=db-3","inference":"Pattern derived from caller-supplied auth outcomes and host fan-out.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"}],"paidProviderUsed":false,"apiKeyRequired":false,"networkAccessed":false,"infrastructureConnected":false,"confirmedAttackClaimed":false,"findings":[{"kind":"conflict","code":"credential_abuse","subject":"svc_backup_198_51_100_8","detail":"Credential-abuse signal status=signal; confirmedAttack=false."}],"limitations":["Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.","Detections are local rule and time-window analyses over supplied records. Missing values are not invented.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.","No paid threat-intel feed or endpoint agent is used and no API key is required.","Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/security-signals/brute-force-pattern-detect":{"post":{"operationId":"detect_brute_force_patterns","summary":"Detect brute-force patterns","description":"Identify burst, distributed, and low-and-slow brute-force patterns from caller-supplied authentication failures.","tags":["security-signals"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"eventType":{"type":"string","maxLength":120},"category":{"type":"string","maxLength":80},"severity":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"host":{"type":"string","maxLength":253},"sourceHost":{"type":"string","maxLength":253},"destinationHost":{"type":"string","maxLength":253},"sourceIp":{"type":"string","maxLength":80},"destinationIp":{"type":"string","maxLength":80},"process":{"type":"string","maxLength":160},"action":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","unknown"]},"privilege":{"type":"string","maxLength":80},"previousPrivilege":{"type":"string","maxLength":80},"authMethod":{"type":"string","maxLength":80},"mfaUsed":{"type":"boolean"},"geoCountry":{"type":"string","maxLength":80},"previousGeoCountry":{"type":"string","maxLength":80},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"count":{"type":"number","minimum":0,"maximum":1000000000},"message":{"type":"string","maxLength":4000},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"relatedEventIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"correlationWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"weakSignalWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"sequenceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceFailureThreshold":{"type":"number","minimum":2,"maximum":10000},"lowAndSlowFailureThreshold":{"type":"number","minimum":2,"maximum":10000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","bruteForceWindowMinutes":30,"bruteForceFailureThreshold":5,"lowAndSlowFailureThreshold":4,"events":[{"id":"E1","at":"2026-11-04T15:00:00.000Z","username":"admin","host":"ssh-1","outcome":"failure","category":"auth","sourceIp":"203.0.113.1","source":"Caller-supplied"},{"id":"E2","at":"2026-11-04T15:01:00.000Z","username":"admin","host":"ssh-1","outcome":"failure","category":"auth","sourceIp":"203.0.113.2","source":"Caller-supplied"},{"id":"E3","at":"2026-11-04T15:02:00.000Z","username":"admin","host":"ssh-1","outcome":"failure","category":"auth","sourceIp":"203.0.113.3","source":"Caller-supplied"},{"id":"E4","at":"2026-11-04T15:03:00.000Z","username":"admin","host":"ssh-1","outcome":"failure","category":"auth","sourceIp":"203.0.113.4","source":"Caller-supplied"},{"id":"E5","at":"2026-11-04T15:04:00.000Z","username":"admin","host":"ssh-1","outcome":"failure","category":"auth","sourceIp":"203.0.113.5","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"patternCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confirmedAttack":{"type":"boolean"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"infrastructureConnected":{"type":"boolean"},"confirmedAttackClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","patternCount":1,"items":[{"id":"brute-force-pattern-detect-E1","detector":"brute-force-pattern-detect","title":"Distributed brute-force pattern","status":"signal","observedFacts":["5 auth failures toward admin_ssh_1 within 30 minutes.","Distinct sources observed: 5.","Failure span: 4 minutes."],"inferredThreat":"Brute-force style authentication pressure may be occurring. Not confirmation that an account was breached.","confirmedAttack":false,"confidence":"high","relatedEventIds":["E1","E2","E3","E4","E5"],"firstAt":"2026-11-04T15:00:00.000Z","lastAt":"2026-11-04T15:04:00.000Z","reasons":["burst_failures","distributed_sources"],"evidence":[{"eventId":"E1","at":"2026-11-04T15:00:00.000Z","fact":"Auth failure from 203.0.113.1","inference":"Counted only caller-supplied failure outcomes in the time window.","confidence":"high"},{"eventId":"E2","at":"2026-11-04T15:01:00.000Z","fact":"Auth failure from 203.0.113.2","inference":"Counted only caller-supplied failure outcomes in the time window.","confidence":"high"},{"eventId":"E3","at":"2026-11-04T15:02:00.000Z","fact":"Auth failure from 203.0.113.3","inference":"Counted only caller-supplied failure outcomes in the time window.","confidence":"high"},{"eventId":"E4","at":"2026-11-04T15:03:00.000Z","fact":"Auth failure from 203.0.113.4","inference":"Counted only caller-supplied failure outcomes in the time window.","confidence":"high"},{"eventId":"E5","at":"2026-11-04T15:04:00.000Z","fact":"Auth failure from 203.0.113.5","inference":"Counted only caller-supplied failure outcomes in the time window.","confidence":"high"}],"source":"Caller-supplied events; local rules only"}],"paidProviderUsed":false,"apiKeyRequired":false,"networkAccessed":false,"infrastructureConnected":false,"confirmedAttackClaimed":false,"findings":[{"kind":"conflict","code":"brute_force","subject":"brute-force-pattern-detect-E1","detail":"Brute-force pattern reasons=burst_failures, distributed_sources; confirmedAttack=false."}],"limitations":["Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.","Detections are local rule and time-window analyses over supplied records. Missing values are not invented.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.","No paid threat-intel feed or endpoint agent is used and no API key is required.","Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/security-signals/event-severity-score":{"post":{"operationId":"score_security_event_severity","summary":"Score security-event severity","description":"Calculate an explainable severity score for detections derived from caller-supplied events, with scoring breakdown and confirmedAttack=false.","tags":["security-signals"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"events":{"maxItems":20000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"at":{"type":"string","maxLength":40},"eventType":{"type":"string","maxLength":120},"category":{"type":"string","maxLength":80},"severity":{"type":"string","maxLength":40},"userId":{"type":"string","maxLength":120},"username":{"type":"string","maxLength":120},"host":{"type":"string","maxLength":253},"sourceHost":{"type":"string","maxLength":253},"destinationHost":{"type":"string","maxLength":253},"sourceIp":{"type":"string","maxLength":80},"destinationIp":{"type":"string","maxLength":80},"process":{"type":"string","maxLength":160},"action":{"type":"string","maxLength":120},"outcome":{"type":"string","enum":["success","failure","unknown"]},"privilege":{"type":"string","maxLength":80},"previousPrivilege":{"type":"string","maxLength":80},"authMethod":{"type":"string","maxLength":80},"mfaUsed":{"type":"boolean"},"geoCountry":{"type":"string","maxLength":80},"previousGeoCountry":{"type":"string","maxLength":80},"deviceId":{"type":"string","maxLength":120},"previousDeviceId":{"type":"string","maxLength":120},"count":{"type":"number","minimum":0,"maximum":1000000000},"message":{"type":"string","maxLength":4000},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"relatedEventIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"asOf":{"type":"string","maxLength":40},"correlationWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"weakSignalWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"sequenceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceWindowMinutes":{"type":"number","minimum":1,"maximum":10080},"bruteForceFailureThreshold":{"type":"number","minimum":2,"maximum":10000},"lowAndSlowFailureThreshold":{"type":"number","minimum":2,"maximum":10000}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","events":[{"id":"E1","at":"2026-11-04T19:00:00.000Z","eventType":"auth_failure","category":"auth","userId":"u9","outcome":"failure","source":"Caller-supplied"},{"id":"E2","at":"2026-11-04T19:02:00.000Z","eventType":"auth_success","category":"auth","userId":"u9","outcome":"success","source":"Caller-supplied"},{"id":"E3","at":"2026-11-04T19:10:00.000Z","userId":"u9","sourceHost":"ws-1","destinationHost":"db-1","message":"winrm lateral","outcome":"success","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"scoredCount":{"type":"number"},"topScore":{"type":"number"},"topBand":{"type":"string"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"score":{"type":"number"},"band":{"type":"string"},"confirmedAttack":{"type":"boolean"},"confidence":{"type":"string"},"relatedEventIds":{"type":"array","items":{"type":"string"}},"firstAt":{"type":"string"},"lastAt":{"type":"string"},"reasons":{"type":"array","items":{"type":"string"}},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"scoringBreakdown":{"type":"array","items":{"type":"object","properties":{"component":{"type":"string"},"points":{"type":"number"}},"additionalProperties":true}},"evidence":{"type":"array","items":{"type":"object","properties":{"eventId":{"type":"string"},"at":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"networkAccessed":{"type":"boolean"},"infrastructureConnected":{"type":"boolean"},"confirmedAttackClaimed":{"type":"boolean"},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"scored","scoredCount":5,"topScore":36,"topBand":"low","items":[{"id":"attack-sequence-detect-E1","detector":"attack-sequence-detect","title":"Auth failures followed by success","status":"signal","score":36,"band":"low","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E1","E2"],"firstAt":"2026-11-04T19:00:00.000Z","lastAt":"2026-11-04T19:02:00.000Z","reasons":["sequence_match","auth_fail_then_success"],"observedFacts":["Step 1: auth_failure at 2026-11-04T19:00:00.000Z","Step 2: auth_success at 2026-11-04T19:02:00.000Z"],"inferredThreat":"Supplied events match local sequence pattern \"auth_fail_then_success\" for actor/host key u9. Not a confirmed attack.","scoringBreakdown":[{"component":"detector_weight","points":28},{"component":"confidence_boost","points":4},{"component":"related_event_bonus","points":4}],"evidence":[{"eventId":"E1","at":"2026-11-04T19:00:00.000Z","fact":"Observed step 1 event.","inference":"Fits pattern auth_fail_then_success within 180 minutes.","confidence":"medium"},{"eventId":"E2","at":"2026-11-04T19:02:00.000Z","fact":"Observed step 2 event.","inference":"Fits pattern auth_fail_then_success within 180 minutes.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"},{"id":"attack-sequence-detect-E2","detector":"attack-sequence-detect","title":"Successful access then host-to-host movement","status":"signal","score":36,"band":"low","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E2","E3"],"firstAt":"2026-11-04T19:02:00.000Z","lastAt":"2026-11-04T19:10:00.000Z","reasons":["sequence_match","access_then_lateral"],"observedFacts":["Step 1: auth_success at 2026-11-04T19:02:00.000Z","Step 2: winrm lateral at 2026-11-04T19:10:00.000Z"],"inferredThreat":"Supplied events match local sequence pattern \"access_then_lateral\" for actor/host key u9. Not a confirmed attack.","scoringBreakdown":[{"component":"detector_weight","points":28},{"component":"confidence_boost","points":4},{"component":"related_event_bonus","points":4}],"evidence":[{"eventId":"E2","at":"2026-11-04T19:02:00.000Z","fact":"Observed step 1 event.","inference":"Fits pattern access_then_lateral within 180 minutes.","confidence":"medium"},{"eventId":"E3","at":"2026-11-04T19:10:00.000Z","fact":"Observed step 2 event.","inference":"Fits pattern access_then_lateral within 180 minutes.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"},{"id":"lateral-movement-detect-E3","detector":"lateral-movement-detect","title":"Lateral-movement indicator","status":"signal","score":28,"band":"low","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E3"],"firstAt":"2026-11-04T19:10:00.000Z","lastAt":"2026-11-04T19:10:00.000Z","reasons":["host_to_host","lateral_keyword"],"observedFacts":["Observed host-to-host movement ws-1 → db-1.","Observed lateral-movement tooling/protocol keywords in supplied text."],"inferredThreat":"Suspicious movement between systems may be present in supplied network/auth logs. Not a confirmed intrusion.","scoringBreakdown":[{"component":"detector_weight","points":22},{"component":"confidence_boost","points":4},{"component":"related_event_bonus","points":2}],"evidence":[{"eventId":"E3","at":"2026-11-04T19:10:00.000Z","fact":"Observed host-to-host movement ws-1 → db-1. Observed lateral-movement tooling/protocol keywords in supplied text.","inference":"Derived only from caller-supplied source/destination fields and keywords.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"},{"id":"credential-abuse-detect-E1","detector":"credential-abuse-detect","title":"Credential-abuse pattern","status":"signal","score":24,"band":"low","confirmedAttack":false,"confidence":"low","relatedEventIds":["E1","E2","E3"],"firstAt":"2026-11-04T19:00:00.000Z","lastAt":"2026-11-04T19:10:00.000Z","reasons":["fail_then_success"],"observedFacts":["Observed failures and at least one success for the same credential/source key."],"inferredThreat":"Suspicious credential usage pattern may be present. Not confirmation that credentials were compromised.","scoringBreakdown":[{"component":"detector_weight","points":18},{"component":"confidence_boost","points":0},{"component":"related_event_bonus","points":6}],"evidence":[{"eventId":"E1","at":"2026-11-04T19:00:00.000Z","fact":"outcome=failure host=n/a","inference":"Pattern derived from caller-supplied auth outcomes and host fan-out.","confidence":"low"},{"eventId":"E2","at":"2026-11-04T19:02:00.000Z","fact":"outcome=success host=n/a","inference":"Pattern derived from caller-supplied auth outcomes and host fan-out.","confidence":"low"},{"eventId":"E3","at":"2026-11-04T19:10:00.000Z","fact":"outcome=success host=db-1","inference":"Pattern derived from caller-supplied auth outcomes and host fan-out.","confidence":"low"}],"source":"Caller-supplied events; local rules only"},{"id":"weak-signal-detect-E1","detector":"weak-signal-detect","title":"Weak suspicious-activity signal","status":"signal","score":18,"band":"low","confirmedAttack":false,"confidence":"medium","relatedEventIds":["E1","E2","E3"],"firstAt":"2026-11-04T19:00:00.000Z","lastAt":"2026-11-04T19:10:00.000Z","reasons":["auth_failure"],"observedFacts":["Observed authentication failure outcome."],"inferredThreat":"Early indicator of suspicious activity may be present; not a confirmed attack.","scoringBreakdown":[{"component":"detector_weight","points":8},{"component":"confidence_boost","points":4},{"component":"related_event_bonus","points":6}],"evidence":[{"eventId":"E1","at":"2026-11-04T19:00:00.000Z","fact":"Observed authentication failure outcome.","inference":"2 nearby same-actor events were also supplied.","confidence":"medium"}],"source":"Caller-supplied events; local rules only"}],"paidProviderUsed":false,"apiKeyRequired":false,"networkAccessed":false,"infrastructureConnected":false,"confirmedAttackClaimed":false,"findings":[{"kind":"observation","code":"severity_score","subject":"weak-signal-detect-E1","detail":"Explainable severity 18 (low) for weak-signal-detect."},{"kind":"observation","code":"severity_score","subject":"attack-sequence-detect-E1","detail":"Explainable severity 36 (low) for attack-sequence-detect."},{"kind":"observation","code":"severity_score","subject":"attack-sequence-detect-E2","detail":"Explainable severity 36 (low) for attack-sequence-detect."},{"kind":"observation","code":"severity_score","subject":"lateral-movement-detect-E3","detail":"Explainable severity 28 (low) for lateral-movement-detect."},{"kind":"observation","code":"severity_score","subject":"credential-abuse-detect-E1","detail":"Explainable severity 24 (low) for credential-abuse-detect."}],"limitations":["Security events and logs are copied only from labeled fields supplied by the caller. The caller's network and security infrastructure are not accessed.","Detections are local rule and time-window analyses over supplied records. Missing values are not invented.","Observed facts are separated from inferred threat hypotheses. Events are not labeled confirmed attacks without sufficient multi-signal evidence.","No paid threat-intel feed or endpoint agent is used and no API key is required.","Severity scores are explainable rule weights over supplied detections/events, not vendor risk scores."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}}},"components":{"schemas":{"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}}}}}