Detect trust-boundary violations API

Find caller-supplied data flows that cross from a higher trust zone to a lower one without the required controls. Uses only supplied components, zones, flows, and controls. No infrastructure is scanned.

The Detect trust-boundary violations operation is part of the Payload Safety & Architecture Control Checks API on BRAINIAC.software. Find caller-supplied data flows that cross from a higher trust zone to a lower one without the required controls. Uses only supplied components, zones, flows, and controls. No infrastructure is scanned. It is exposed as POST /api/v1/security/trust-boundary-violation-detect and priced at $0.04 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied payloads, components, zones, flows, controls, requirements, and evidence processed locally Limitations: A pattern match or architecture gap is not proof of an exploit, and a clean result is not a guarantee of safety. No network call is made and nothing is written to disk. Trust, data-flow, and coverage checks use only the architecture and requirements in the request. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Score payload anomaly and input safety, Audit sensitive data flows, Find security control coverage gaps. Open the group documentation for the full request schema, field notes, and response examples before integrating.

POST$0.04 USDC
/api/v1/security/trust-boundary-violation-detect

Example request

curl -i -X POST "https://www.brainiac.software/api/v1/security/trust-boundary-violation-detect" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "zones": [
    {
      "id": "trusted",
      "trust_level": 80
    },
    {
      "id": "public",
      "trust_level": 10
    }
  ],
  "components": [
    {
      "id": "api",
      "zone_id": "trusted",
      "kind": "service"
    },
    {
      "id": "cdn",
      "zone_id": "public",
      "kind": "gateway"
    }
  ],
  "flows": [
    {
      "id": "f1",
      "from_component_id": "api",
      "to_component_id": "cdn",
      "data_classes": [
        "pii"
      ]
    }
  ],
  "controls": [
    {
      "id": "c1",
      "kind": "logging",
      "flow_ids": [
        "f1"
      ]
    }
  ],
  "required_controls_on_trust_drop": [
    "encryption_in_transit",
    "authentication"
  ]
}
JSON

An unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.

FAQ

  • Do I need an API key? No. Pay the listed USDC amount with x402.
  • What network? Base (eip155:8453), USDC.
  • Is this an official determination? No. Results are for human review against the cited sources.

Related APIs

Payload Safety & Architecture Control Checks APIFull docsHow it works