Cybersecurity Configuration Intelligence API Documentation

Read security headers, TLS, cookies, CORS, and CSP from a public URL or from configuration supplied by the caller. Listed paths are the only extra resources requested. Payment is the exact USDC price on Base with x402.

{
  "transport": "https",
  "headers": [
    {
      "name": "Strict-Transport-Security",
      "value": "max-age=0"
    },
    {
      "name": "Content-Security-Policy",
      "value": "default-src 'none'"
    }
  ]
}

{
  "checkedAt": "2026-11-03T16:00:00.000Z",
  "websiteSecure": false,
  "securityDetermined": false,
  "requestsSent": 0,
  "confirmedCount": 3,
  "unavailableCount": 0,
  "recommendationCount": 2,
  "status": "checked",
  "requestedUrl": "",
  "finalUrl": "",
  "httpStatus": 0,
  "transport": "https",
  "present": [
    "content-security-policy",
    "strict-transport-security"
  ],
  "findings": [
    {
      "kind": "confirmed",
      "code": "hsts_disabled",
      "subject": "strict-transport-security",
      "detail": "Strict-Transport-Security sets max-age to 0."
    },
    {
      "kind": "confirmed",
      "code": "content_type_options_missing",
      "subject": "x-content-type-options",
      "detail": "X-Content-Type-Options was absent."
    },
    {
      "kind": "confirmed",
      "code": "framing_control_missing",
      "subject": "x-frame-options",
      "detail": "Neither X-Frame-Options nor CSP frame-ancestors was present."
    },
    {
      "kind": "recommendation",
      "code": "referrer_policy_missing",
      "subject": "referrer-policy",
      "detail": "Referrer-Policy was absent."
    },
    {
      "kind": "recommendation",
      "code": "permissions_policy_missing",
      "subject": "permissions-policy",
      "detail": "Permissions-Policy was absent."
    }
  ],
  "limitations": [
    "These checks do not show that a website is secure.",
    "Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.",
    "A path or endpoint is requested only when the caller lists it.",
    "Cookie values are not copied into the response.",
    "An unavailable check means that configuration was not in the response."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/security-configuration/header-audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "transport": "https",
  "headers": [
    {
      "name": "Strict-Transport-Security",
      "value": "max-age=0"
    },
    {
      "name": "Content-Security-Policy",
      "value": "default-src 'none'"
    }
  ]
}
JSON

{
  "tls": {
    "protocol": "TLSv1.0",
    "issuer": "Example",
    "subject": "example.com",
    "validFrom": "Jan 1 00:00:00 2020 GMT",
    "validTo": "Jan 1 00:00:00 2024 GMT",
    "authorized": false,
    "hostnameMatches": false
  }
}

{
  "checkedAt": "2026-11-03T16:00:00.000Z",
  "websiteSecure": false,
  "securityDetermined": false,
  "requestsSent": 0,
  "confirmedCount": 4,
  "unavailableCount": 0,
  "recommendationCount": 0,
  "status": "checked",
  "requestedUrl": "",
  "finalUrl": "",
  "httpStatus": 0,
  "protocol": "TLSv1.0",
  "issuer": "Example",
  "subject": "example.com",
  "validFrom": "Jan 1 00:00:00 2020 GMT",
  "validTo": "Jan 1 00:00:00 2024 GMT",
  "authorized": false,
  "hostnameMatches": false,
  "findings": [
    {
      "kind": "confirmed",
      "code": "tls_name_mismatch",
      "subject": "example.com",
      "detail": "The supplied certificate information says the host name does not match."
    },
    {
      "kind": "confirmed",
      "code": "tls_untrusted",
      "subject": "Example",
      "detail": "The supplied certificate information says the certificate is not authorized."
    },
    {
      "kind": "confirmed",
      "code": "tls_expired",
      "subject": "example.com",
      "detail": "The certificate end date is in the past."
    },
    {
      "kind": "confirmed",
      "code": "tls_protocol_old",
      "subject": "TLSv1.0",
      "detail": "The negotiated protocol is older than TLS 1.2."
    }
  ],
  "limitations": [
    "These checks do not show that a website is secure.",
    "Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.",
    "A path or endpoint is requested only when the caller lists it.",
    "Cookie values are not copied into the response.",
    "An unavailable check means that configuration was not in the response."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/security-configuration/tls-audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "tls": {
    "protocol": "TLSv1.0",
    "issuer": "Example",
    "subject": "example.com",
    "validFrom": "Jan 1 00:00:00 2020 GMT",
    "validTo": "Jan 1 00:00:00 2024 GMT",
    "authorized": false,
    "hostnameMatches": false
  }
}
JSON

{
  "transport": "https",
  "setCookies": [
    "session=sessionsecret; Path=/"
  ]
}

{
  "checkedAt": "2026-11-03T16:00:00.000Z",
  "websiteSecure": false,
  "securityDetermined": false,
  "requestsSent": 0,
  "confirmedCount": 1,
  "unavailableCount": 0,
  "recommendationCount": 2,
  "status": "checked",
  "requestedUrl": "",
  "finalUrl": "",
  "httpStatus": 0,
  "transport": "https",
  "cookies": [
    {
      "name": "session",
      "secure": false,
      "httpOnly": false,
      "sameSite": ""
    }
  ],
  "findings": [
    {
      "kind": "confirmed",
      "code": "cookie_secure_missing",
      "subject": "session",
      "detail": "This cookie was set on HTTPS without the Secure attribute."
    },
    {
      "kind": "recommendation",
      "code": "cookie_httponly_missing",
      "subject": "session",
      "detail": "This cookie does not set HttpOnly. Not every cookie needs that attribute."
    },
    {
      "kind": "recommendation",
      "code": "cookie_samesite_missing",
      "subject": "session",
      "detail": "SameSite was not set."
    }
  ],
  "limitations": [
    "These checks do not show that a website is secure.",
    "Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.",
    "A path or endpoint is requested only when the caller lists it.",
    "Cookie values are not copied into the response.",
    "An unavailable check means that configuration was not in the response."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/security-configuration/cookie-audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "transport": "https",
  "setCookies": [
    "session=sessionsecret; Path=/"
  ]
}
JSON

{
  "headers": [
    {
      "name": "Access-Control-Allow-Origin",
      "value": "*"
    },
    {
      "name": "Access-Control-Allow-Credentials",
      "value": "true"
    }
  ]
}

{
  "checkedAt": "2026-11-03T16:00:00.000Z",
  "websiteSecure": false,
  "securityDetermined": false,
  "requestsSent": 0,
  "confirmedCount": 2,
  "unavailableCount": 1,
  "recommendationCount": 0,
  "status": "checked",
  "requestedUrl": "",
  "finalUrl": "",
  "httpStatus": 0,
  "allowOrigin": "*",
  "allowCredentials": "true",
  "allowMethods": "",
  "findings": [
    {
      "kind": "confirmed",
      "code": "cors_wildcard",
      "subject": "access-control-allow-origin",
      "detail": "The response allows any origin."
    },
    {
      "kind": "confirmed",
      "code": "cors_wildcard_credentials",
      "subject": "access-control-allow-credentials",
      "detail": "The response allows any origin and also allows credentials."
    },
    {
      "kind": "unavailable",
      "code": "cors_origin_untested",
      "subject": "",
      "detail": "No origin was supplied, so reflection was not tested."
    }
  ],
  "limitations": [
    "These checks do not show that a website is secure.",
    "Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.",
    "A path or endpoint is requested only when the caller lists it.",
    "Cookie values are not copied into the response.",
    "An unavailable check means that configuration was not in the response."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/security-configuration/cors-policy-audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "headers": [
    {
      "name": "Access-Control-Allow-Origin",
      "value": "*"
    },
    {
      "name": "Access-Control-Allow-Credentials",
      "value": "true"
    }
  ]
}
JSON

{
  "contentSecurityPolicy": "default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' *"
}

{
  "checkedAt": "2026-11-03T16:00:00.000Z",
  "websiteSecure": false,
  "securityDetermined": false,
  "requestsSent": 0,
  "confirmedCount": 3,
  "unavailableCount": 0,
  "recommendationCount": 0,
  "status": "checked",
  "requestedUrl": "",
  "finalUrl": "",
  "httpStatus": 0,
  "enforced": true,
  "directives": [
    {
      "name": "default-src",
      "value": "'self'"
    },
    {
      "name": "script-src",
      "value": "'unsafe-inline' 'unsafe-eval' *"
    }
  ],
  "findings": [
    {
      "kind": "confirmed",
      "code": "csp_unsafe_inline",
      "subject": "script-src",
      "detail": "script-src or default-src allows unsafe-inline."
    },
    {
      "kind": "confirmed",
      "code": "csp_unsafe_eval",
      "subject": "script-src",
      "detail": "script-src or default-src allows unsafe-eval."
    },
    {
      "kind": "confirmed",
      "code": "csp_script_wildcard",
      "subject": "script-src",
      "detail": "script-src or default-src allows every host."
    }
  ],
  "limitations": [
    "These checks do not show that a website is secure.",
    "Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.",
    "A path or endpoint is requested only when the caller lists it.",
    "Cookie values are not copied into the response.",
    "An unavailable check means that configuration was not in the response."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/security-configuration/csp-policy-analyze" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "contentSecurityPolicy": "default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' *"
}
JSON

{
  "url": "https://user:pass@example.com/",
  "paths": [
    "/.env",
    "/../secret"
  ]
}

{
  "checkedAt": "2026-11-03T16:00:00.000Z",
  "websiteSecure": false,
  "securityDetermined": false,
  "requestsSent": 0,
  "confirmedCount": 0,
  "unavailableCount": 2,
  "recommendationCount": 0,
  "status": "unavailable",
  "paths": [
    {
      "path": "/.env",
      "httpStatus": 0,
      "contentType": "",
      "exposed": false
    },
    {
      "path": "/../secret",
      "httpStatus": 0,
      "contentType": "",
      "exposed": false
    }
  ],
  "findings": [
    {
      "kind": "unavailable",
      "code": "path_rejected",
      "subject": "/.env",
      "detail": "The path leaves the supplied host, contains .., or could not be parsed. It was not requested."
    },
    {
      "kind": "unavailable",
      "code": "path_rejected",
      "subject": "/../secret",
      "detail": "The path leaves the supplied host, contains .., or could not be parsed. It was not requested."
    }
  ],
  "limitations": [
    "These checks do not show that a website is secure.",
    "Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.",
    "A path or endpoint is requested only when the caller lists it.",
    "Cookie values are not copied into the response.",
    "An unavailable check means that configuration was not in the response."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/security-configuration/exposed-file-check" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "url": "https://user:pass@example.com/",
  "paths": [
    "/.env",
    "/../secret"
  ]
}
JSON

{
  "endpoints": [
    "https://user:pass@example.com/admin",
    "http://127.0.0.1/latest/meta-data"
  ]
}

{
  "checkedAt": "2026-11-03T16:00:00.000Z",
  "websiteSecure": false,
  "securityDetermined": false,
  "requestsSent": 0,
  "confirmedCount": 0,
  "unavailableCount": 2,
  "recommendationCount": 0,
  "status": "unavailable",
  "endpoints": [
    {
      "url": "https://user:pass@example.com/admin",
      "httpStatus": 0,
      "transport": "https",
      "contentTypeOptions": false,
      "hsts": false
    },
    {
      "url": "http://127.0.0.1/latest/meta-data",
      "httpStatus": 0,
      "transport": "http",
      "contentTypeOptions": false,
      "hsts": false
    }
  ],
  "findings": [
    {
      "kind": "unavailable",
      "code": "endpoint_unavailable",
      "subject": "https://user:pass@example.com/admin",
      "detail": "The URL contains credentials and was not fetched."
    },
    {
      "kind": "unavailable",
      "code": "endpoint_unavailable",
      "subject": "http://127.0.0.1/latest/meta-data",
      "detail": "The address is not public and was not fetched."
    }
  ],
  "limitations": [
    "These checks do not show that a website is secure.",
    "Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.",
    "A path or endpoint is requested only when the caller lists it.",
    "Cookie values are not copied into the response.",
    "An unavailable check means that configuration was not in the response."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/security-configuration/public-endpoint-audit" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "endpoints": [
    "https://user:pass@example.com/admin",
    "http://127.0.0.1/latest/meta-data"
  ]
}
JSON

{
  "transport": "https",
  "headers": [
    {
      "name": "Strict-Transport-Security",
      "value": "max-age=0"
    },
    {
      "name": "Access-Control-Allow-Origin",
      "value": "*"
    },
    {
      "name": "Access-Control-Allow-Credentials",
      "value": "true"
    }
  ],
  "setCookies": [
    "session=sessionsecret; Path=/"
  ],
  "contentSecurityPolicy": "default-src 'self'; script-src 'unsafe-inline'",
  "tls": {
    "protocol": "TLSv1.2",
    "issuer": "Example",
    "subject": "example.com",
    "validFrom": "Jan 1 00:00:00 2026 GMT",
    "validTo": "Jan 1 00:00:00 2027 GMT",
    "authorized": true,
    "hostnameMatches": true
  }
}

{
  "checkedAt": "2026-11-03T16:00:00.000Z",
  "websiteSecure": false,
  "securityDetermined": false,
  "requestsSent": 0,
  "confirmedCount": 7,
  "unavailableCount": 3,
  "recommendationCount": 4,
  "status": "checked",
  "requestedUrl": "",
  "finalUrl": "",
  "httpStatus": 0,
  "transport": "https",
  "present": [
    "access-control-allow-credentials",
    "access-control-allow-origin",
    "content-security-policy",
    "strict-transport-security"
  ],
  "protocol": "TLSv1.2",
  "paths": [],
  "endpoints": [],
  "findings": [
    {
      "kind": "confirmed",
      "code": "hsts_disabled",
      "subject": "strict-transport-security",
      "detail": "Strict-Transport-Security sets max-age to 0."
    },
    {
      "kind": "confirmed",
      "code": "content_type_options_missing",
      "subject": "x-content-type-options",
      "detail": "X-Content-Type-Options was absent."
    },
    {
      "kind": "confirmed",
      "code": "framing_control_missing",
      "subject": "x-frame-options",
      "detail": "Neither X-Frame-Options nor CSP frame-ancestors was present."
    },
    {
      "kind": "recommendation",
      "code": "referrer_policy_missing",
      "subject": "referrer-policy",
      "detail": "Referrer-Policy was absent."
    },
    {
      "kind": "recommendation",
      "code": "permissions_policy_missing",
      "subject": "permissions-policy",
      "detail": "Permissions-Policy was absent."
    },
    {
      "kind": "confirmed",
      "code": "cookie_secure_missing",
      "subject": "session",
      "detail": "This cookie was set on HTTPS without the Secure attribute."
    },
    {
      "kind": "recommendation",
      "code": "cookie_httponly_missing",
      "subject": "session",
      "detail": "This cookie does not set HttpOnly. Not every cookie needs that attribute."
    },
    {
      "kind": "recommendation",
      "code": "cookie_samesite_missing",
      "subject": "session",
      "detail": "SameSite was not set."
    },
    {
      "kind": "confirmed",
      "code": "cors_wildcard",
      "subject": "access-control-allow-origin",
      "detail": "The response allows any origin."
    },
    {
      "kind": "confirmed",
      "code": "cors_wildcard_credentials",
      "subject": "access-control-allow-credentials",
      "detail": "The response allows any origin and also allows credentials."
    },
    {
      "kind": "unavailable",
      "code": "cors_origin_untested",
      "subject": "",
      "detail": "No origin was supplied, so reflection was not tested."
    },
    {
      "kind": "confirmed",
      "code": "csp_unsafe_inline",
      "subject": "script-src",
      "detail": "script-src or default-src allows unsafe-inline."
    },
    {
      "kind": "unavailable",
      "code": "url_missing",
      "subject": "",
      "detail": "A public URL is required before a path is requested."
    },
    {
      "kind": "unavailable",
      "code": "endpoints_missing",
      "subject": "",
      "detail": "No extra endpoint was listed. The main URL was not requested again."
    }
  ],
  "limitations": [
    "These checks do not show that a website is secure.",
    "Only one public GET is sent per supplied URL or path. No login, brute force, exploit, or credential test is attempted.",
    "A path or endpoint is requested only when the caller lists it.",
    "Cookie values are not copied into the response.",
    "An unavailable check means that configuration was not in the response."
  ]
}

curl -i -X POST "https://brainiac.software/api/v1/security-configuration/website-report" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "transport": "https",
  "headers": [
    {
      "name": "Strict-Transport-Security",
      "value": "max-age=0"
    },
    {
      "name": "Access-Control-Allow-Origin",
      "value": "*"
    },
    {
      "name": "Access-Control-Allow-Credentials",
      "value": "true"
    }
  ],
  "setCookies": [
    "session=sessionsecret; Path=/"
  ],
  "contentSecurityPolicy": "default-src 'self'; script-src 'unsafe-inline'",
  "tls": {
    "protocol": "TLSv1.2",
    "issuer": "Example",
    "subject": "example.com",
    "validFrom": "Jan 1 00:00:00 2026 GMT",
    "validTo": "Jan 1 00:00:00 2027 GMT",
    "authorized": true,
    "hostnameMatches": true
  }
}
JSON