Audit sensitive data flows API

Check where caller-declared sensitive data classes travel through supplied components and whether handling rules for zones, components, and required controls are violated. No repository is scanned.

The Audit sensitive data flows operation is part of the Payload Safety & Architecture Control Checks API on BRAINIAC.software. Check where caller-declared sensitive data classes travel through supplied components and whether handling rules for zones, components, and required controls are violated. No repository is scanned. It is exposed as POST /api/v1/security/sensitive-data-flow-audit and priced at $0.04 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied payloads, components, zones, flows, controls, requirements, and evidence processed locally Limitations: A pattern match or architecture gap is not proof of an exploit, and a clean result is not a guarantee of safety. No network call is made and nothing is written to disk. Trust, data-flow, and coverage checks use only the architecture and requirements in the request. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Score payload anomaly and input safety, Detect trust-boundary violations, Find security control coverage gaps. Open the group documentation for the full request schema, field notes, and response examples before integrating.

POST$0.04 USDC
/api/v1/security/sensitive-data-flow-audit

Example request

curl -i -X POST "https://www.brainiac.software/api/v1/security/sensitive-data-flow-audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "sensitive_data_classes": [
    "card_pan"
  ],
  "zones": [
    {
      "id": "pci",
      "trust_level": 90
    },
    {
      "id": "app",
      "trust_level": 50
    }
  ],
  "components": [
    {
      "id": "vault",
      "zone_id": "pci",
      "kind": "datastore"
    },
    {
      "id": "web",
      "zone_id": "app",
      "kind": "service"
    }
  ],
  "flows": [
    {
      "id": "f1",
      "from_component_id": "vault",
      "to_component_id": "web",
      "data_classes": [
        "card_pan"
      ]
    }
  ],
  "handling_rules": [
    {
      "id": "r1",
      "data_class": "card_pan",
      "allowed_zone_ids": [
        "pci"
      ],
      "require_control_kinds": [
        "tokenization"
      ]
    }
  ]
}
JSON

An unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.

FAQ

  • Do I need an API key? No. Pay the listed USDC amount with x402.
  • What network? Base (eip155:8453), USDC.
  • Is this an official determination? No. Results are for human review against the cited sources.

Related APIs

Payload Safety & Architecture Control Checks APIFull docsHow it works