{"openapi":"3.1.0","info":{"title":"SOAP Security API","version":"1.0.0","description":"Compare WS-Policy and WS-SecurityPolicy assertions in caller-supplied WSDL 1.1 documents. No network calls are made. Paid with x402 exact USDC on Base. No account is required.","contact":{"email":"support@brainiac.software"},"x-guidance":"BRAINIAC.software is a pay-per-call API for software agents. No account or API key is required.\nPayment uses the x402 protocol with exact USDC on Base (chain id 8453). Each POST operation has a fixed USD price.\nHow to call an operation:\n1. POST JSON matching the requestBody. Invalid input returns 400 with no payment challenge.\n2. A valid unpaid call returns 402 with the exact amount and payTo.\n3. Pay and retry with payment-signature. Payment settles only if the operation returns 2xx. A 4xx/5xx is not charged.\nInclude an Idempotency-Key header of 64 hex characters from 32 random bytes. Reuse that key only for retries of the same operation and request body.\nAll outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Verify time-sensitive or official data with the cited source before acting."},"servers":[{"url":"https://www.brainiac.software"}],"paths":{"/api/v1/soap-security/soap-security-policy-audit":{"post":{"operationId":"audit_soap_security_policy","summary":"Audit SOAP security policy","description":"Compare WS-Policy and WS-SecurityPolicy assertions across caller-supplied WSDL 1.1 bindings and operations. audit_status is valid, warnings, policy_conflicts, invalid, or incomplete. risk_level is low, medium, high, or critical. A declared policy is not evidence that a server enforces it. Imports are not fetched.","tags":["soap-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"documents":{"minItems":1,"maxItems":8,"type":"array","items":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]{0,79}$"},"role":{"type":"string","enum":["wsdl","xsd","policy"]},"content":{"type":"string","minLength":1,"maxLength":100000}},"required":["name","role","content"],"additionalProperties":false}},"expected":{"type":"object","properties":{"token":{"type":"string","enum":["username","x509","saml","issued","https","kerberos","secure_conversation","spnego"]},"signBody":{"type":"boolean"},"encryptBody":{"type":"boolean"},"transport":{"type":"boolean"},"timestamp":{"type":"boolean"}},"additionalProperties":false},"selection":{"type":"object","properties":{"service":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]{0,79}$"},"port":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]{0,79}$"},"binding":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]{0,79}$"},"operation":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]{0,79}$"}},"additionalProperties":false}},"required":["documents"],"additionalProperties":false},"example":{"documents":[{"name":"account.wsdl","role":"wsdl","content":"<?xml version=\"1.0\"?>\n<definitions xmlns=\"http://schemas.xmlsoap.org/wsdl/\" xmlns:tns=\"urn:account\" xmlns:wsp=\"http://www.w3.org/ns/ws-policy\" xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" targetNamespace=\"urn:account\">\n  <wsp:Policy wsu:Id=\"BindingPolicy\">\n    <wsp:ExactlyOne>\n      <wsp:All>\n        <sp:AsymmetricBinding>\n          <wsp:Policy>\n            <sp:InitiatorToken><wsp:Policy><sp:X509Token/></wsp:Policy></sp:InitiatorToken>\n            <sp:RecipientToken><wsp:Policy><sp:X509Token/></wsp:Policy></sp:RecipientToken>\n            <sp:AlgorithmSuite><wsp:Policy><sp:Basic256Sha256/></wsp:Policy></sp:AlgorithmSuite>\n            <sp:IncludeTimestamp/>\n          </wsp:Policy>\n        </sp:AsymmetricBinding>\n        <sp:SignedParts><sp:Body/></sp:SignedParts>\n        <sp:EncryptedParts><sp:Body/></sp:EncryptedParts>\n        <sp:WeirdToken/>\n      </wsp:All>\n    </wsp:ExactlyOne>\n  </wsp:Policy>\n  <types>\n    <schema xmlns=\"http://www.w3.org/2001/XMLSchema\">\n      <import namespace=\"urn:account\" schemaLocation=\"types.xsd\"/>\n    </schema>\n  </types>\n  <binding name=\"AccountBinding\">\n    <wsp:PolicyReference URI=\"#BindingPolicy\"/>\n    <operation name=\"GetAccount\"><input message=\"tns:In\"/><output message=\"tns:Out\"/></operation>\n    <operation name=\"ResetPassword\">\n      <wsp:Policy><wsp:All><sp:UsernameToken/></wsp:All></wsp:Policy>\n    </operation>\n  </binding>\n  <service name=\"AccountService\">\n    <wsp:PolicyReference URI=\"#MissingPolicy\"/>\n    <port name=\"AccountPort\" binding=\"tns:AccountBinding\"/>\n  </service>\n</definitions>"},{"name":"types.xsd","role":"xsd","content":"<?xml version=\"1.0\"?><schema xmlns=\"http://www.w3.org/2001/XMLSchema\" targetNamespace=\"urn:account\"/>"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"audit_status":{"type":"string"},"risk_level":{"type":"string"},"operation_security_profiles":{"type":"array","items":{"type":"object","properties":{"service":{"type":"string"},"port":{"type":"string"},"binding":{"type":"string"},"operation":{"type":"string"},"tokens":{"type":"array","items":{"type":"string"}},"sign_body":{"type":"boolean"},"encrypt_body":{"type":"boolean"},"transport":{"type":"boolean"},"timestamp":{"type":"boolean"},"inherited":{"type":"boolean"},"detail":{"type":"string"}},"additionalProperties":true}},"policy_conflicts":{"type":"array","items":{"type":"object","properties":{"binding":{"type":"string"},"operation":{"type":"string"},"code":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"missing_requirements":{"type":"array","items":{"type":"object","properties":{"binding":{"type":"string"},"operation":{"type":"string"},"requirement":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"unsupported_assertions":{"type":"array","items":{"type":"object","properties":{"document":{"type":"string"},"name":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"unresolved_references":{"type":"array","items":{"type":"object","properties":{"document":{"type":"string"},"reference":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"findings":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"severity":{"type":"string"},"document":{"type":"string"},"binding":{"type":"string"},"operation":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"audit_status":"policy_conflicts","risk_level":"critical","operation_security_profiles":[{"service":"AccountService","port":"AccountPort","binding":"AccountBinding","operation":"GetAccount","tokens":["x509"],"sign_body":true,"encrypt_body":true,"transport":false,"timestamp":true,"inherited":true,"detail":"This profile is read from the supplied policy documents. It was not checked against a running server."},{"service":"AccountService","port":"AccountPort","binding":"AccountBinding","operation":"ResetPassword","tokens":["username"],"sign_body":false,"encrypt_body":false,"transport":false,"timestamp":false,"inherited":false,"detail":"This profile is read from the supplied policy documents. It was not checked against a running server."}],"policy_conflicts":[{"binding":"AccountBinding","operation":"ResetPassword","code":"weaker_operation","detail":"ResetPassword requires less than the outer policy for AccountBinding: sign_body, encrypt_body, timestamp, token:x509. This compares the supplied documents only."},{"binding":"AccountBinding","operation":"GetAccount","code":"token_inconsistent","detail":"AccountBinding: The operations on this binding do not require the same tokens. This is a document comparison, not a runtime result."},{"binding":"AccountBinding","operation":"GetAccount","code":"sign_inconsistent","detail":"AccountBinding: The operations on this binding do not sign the body in the same way. This is a document comparison, not a runtime result."},{"binding":"AccountBinding","operation":"GetAccount","code":"encrypt_inconsistent","detail":"AccountBinding: The operations on this binding do not encrypt the body in the same way. This is a document comparison, not a runtime result."}],"missing_requirements":[{"binding":"AccountBinding","operation":"ResetPassword","requirement":"sign_body","detail":"ResetPassword does not repeat the outer sign_body requirement."},{"binding":"AccountBinding","operation":"ResetPassword","requirement":"encrypt_body","detail":"ResetPassword does not repeat the outer encrypt_body requirement."},{"binding":"AccountBinding","operation":"ResetPassword","requirement":"timestamp","detail":"ResetPassword does not repeat the outer timestamp requirement."},{"binding":"AccountBinding","operation":"ResetPassword","requirement":"token:x509","detail":"ResetPassword does not repeat the outer token:x509 requirement."}],"unsupported_assertions":[{"document":"account.wsdl","name":"WeirdToken","detail":"WeirdToken is not an implemented WS-SecurityPolicy assertion. It was not treated as protection."}],"unresolved_references":[{"document":"account.wsdl","reference":"#MissingPolicy","detail":"This policy reference is not in the supplied documents. It was not fetched."}],"findings":[{"code":"weaker_operation","severity":"critical","document":"account.wsdl","binding":"AccountBinding","operation":"ResetPassword","detail":"ResetPassword requires less than the outer policy for AccountBinding: sign_body, encrypt_body, timestamp, token:x509. This compares the supplied documents only."},{"code":"token_inconsistent","severity":"high","document":"account.wsdl","binding":"AccountBinding","operation":"GetAccount","detail":"AccountBinding: The operations on this binding do not require the same tokens. This is a document comparison, not a runtime result."},{"code":"sign_inconsistent","severity":"high","document":"account.wsdl","binding":"AccountBinding","operation":"GetAccount","detail":"AccountBinding: The operations on this binding do not sign the body in the same way. This is a document comparison, not a runtime result."},{"code":"encrypt_inconsistent","severity":"high","document":"account.wsdl","binding":"AccountBinding","operation":"GetAccount","detail":"AccountBinding: The operations on this binding do not encrypt the body in the same way. This is a document comparison, not a runtime result."},{"code":"policy_unresolved","severity":"medium","document":"account.wsdl","detail":"Policy reference #MissingPolicy is not in the supplied documents. It was not fetched."},{"code":"assertion_unsupported","severity":"medium","document":"account.wsdl","detail":"WeirdToken is not an implemented WS-SecurityPolicy assertion. It was not treated as protection."},{"code":"declared_only","severity":"low","detail":"These documents were supplied in the request. They were not fetched, and a declared policy is not evidence that a server enforces it."}],"limitations":["Documents are the XML strings in the request. Imports and policy references were not fetched.","A declared policy is not evidence that a running SOAP server enforces it.","Certificates and credentials are not validated.","Implemented policy namespaces are WS-Policy 1.2 and 1.5, and WS-SecurityPolicy 1.2 and 1.3. Other assertions are reported and are not treated as protection.","An operation with no attached policy inherits the nearest service, port, or binding policy. A policy with no security assertions is explicit, not missing.","Only WSDL 1.1 is read."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment required. The JSON body is the x402 PaymentRequired object: x402Version, resource with the operation description, accepts with the price and network, and extensions.bazaar with the input schema, input example, output schema, and output example."},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed before settlement, so no payment is taken. Reuse the same idempotency key to retrieve the stored error without paying again."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}],"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}},"/api/v1/soap-security/policy-strength":{"post":{"operationId":"score_soap_policy_strength","summary":"Score SOAP policy strength","description":"Score a caller-supplied algorithm suite, body signature, body encryption, timestamp, and token kind. Basic256Sha256 contributes the most, TripleDes and None the least. A username token scores below an X.509 token. The grade follows that score. No certificate is validated and no policy file is fetched.","tags":["soap-security"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"algorithm_suite":{"type":"string","enum":["Basic256Sha256","Basic256","Basic128Sha256","Basic128","TripleDes","None"]},"body_signed":{"type":"boolean"},"body_encrypted":{"type":"boolean"},"timestamp":{"type":"boolean"},"token":{"type":"string","enum":["x509","username","none"]}},"required":["algorithm_suite","body_signed","body_encrypted","timestamp","token"],"additionalProperties":false},"example":{"algorithm_suite":"Basic128","body_signed":true,"body_encrypted":false,"timestamp":true,"token":"username"}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"security_policy_grade":{"type":"string"},"cryptographic_strength_score":{"type":"number"}},"additionalProperties":true},"example":{"security_policy_grade":"D","cryptographic_strength_score":50}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment required. The JSON body is the x402 PaymentRequired object: x402Version, resource with the operation description, accepts with the price and network, and extensions.bazaar with the input schema, input example, output schema, and output example."},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed before settlement, so no payment is taken. Reuse the same idempotency key to retrieve the stored error without paying again."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}],"facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}}}},"components":{"schemas":{"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}}}}}