{
  "openapi": "3.0.0",
  "info": {
    "title": "Tokenizen x402 API: security tools and status data for AI agents",
    "version": "1.0.0",
    "description": "Pay-per-call security tools and status data for AI agents, paid in USDC on Base over x402. No signup and no API key.",
    "x-guidance": "Pay per call in USDC on Base mainnet (eip155:8453) over x402.\n1. Call a paid endpoint without payment. You get HTTP 402 with a PAYMENT-REQUIRED header (x402 v2, scheme exact, asset USDC).\n2. Sign an EIP-3009 transferWithAuthorization for the stated amount to the payTo address and resend the request with the PAYMENT-SIGNATURE header. Any x402 client does this.\n3. Legacy alternative: send the exact USDC amount on Base and put the transaction hash in PAYMENT-SIGNATURE. Each transaction hash can be used once.\nGET /api/status is free and lists the endpoints and prices. Some feeds are served free while their source data is stale; the response says so.",
    "contact": {
      "email": "info@holistischadviseur.nl"
    }
  },
  "paths": {
    "/openapi.json": {
      "get": {
        "summary": "OpenAPI discovery document",
        "description": "Free endpoint. Returns this OpenAPI spec.",
        "operationId": "getOpenApi",
        "security": [],
        "parameters": [],
        "responses": {
          "200": {
            "description": "OpenAPI 3.0.0 spec"
          }
        }
      }
    },
    "/api/status": {
      "get": {
        "summary": "Service description and payment info",
        "description": "Free endpoint. Returns all available endpoints, prices, and payment wallet address.",
        "operationId": "getStatus",
        "security": [],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Service info and payment details"
          }
        }
      }
    },
    "/api/health": {
      "get": {
        "summary": "VPS bot health: live PM2 status of all 50+ bots",
        "description": "Real-time PM2 status snapshot of all bots running on Hetzner VPS.",
        "operationId": "getHealth",
        "parameters": [
          {
            "in": "header",
            "name": "PAYMENT-SIGNATURE",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "x402 payment: base64 JSON payload with an EIP-3009 authorization (or, legacy, a Base mainnet USDC transaction hash)"
          }
        ],
        "x-payment-info": {
          "price": {
            "mode": "fixed",
            "currency": "USD",
            "amount": "0.002"
          },
          "protocols": [
            {
              "x402": {}
            }
          ]
        },
        "responses": {
          "200": {
            "description": "List of all bots with status, uptime, restarts, cpu, mem_mb"
          },
          "402": {
            "description": "Payment Required"
          }
        }
      }
    },
    "/api/vuln-search": {
      "get": {
        "summary": "Smart contract vulnerability pattern search (3ilm: 1,032 exact-reconciled findings)",
        "description": "Query 1,032 accepted/rejected findings from 10 exact-reconciled Sherlock contests (see METHODOLOGY.md: a smaller verified set is preferred over a larger unreconciled one). Returns matching vulnerability patterns with acceptance rates and real examples.",
        "operationId": "getVulnSearch",
        "parameters": [
          {
            "in": "header",
            "name": "PAYMENT-SIGNATURE",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "x402 USDC payment on Base mainnet"
          },
          {
            "in": "query",
            "name": "q",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Search query: e.g. \"oracle price manipulation\", \"reentrancy\", \"flash loan\""
          }
        ],
        "x-payment-info": {
          "price": {
            "mode": "fixed",
            "currency": "USD",
            "amount": "0.005000"
          },
          "protocols": [
            {
              "x402": {}
            }
          ]
        },
        "responses": {
          "200": {
            "description": "Matching patterns with acceptance_rate and examples"
          },
          "402": {
            "description": "Payment Required: $0.005 USDC on Base"
          }
        }
      }
    },
    "/api/audit-signals": {
      "get": {
        "summary": "Audit priority signals: Cantina + Sherlock, with our own analysis layer",
        "description": "Curated feed of live audit contests/bounties from Cantina and Sherlock ONLY (never HackenProof/Immunefi/CodeHawks: resale-prohibited by their Terms), enriched with our own audit-density, bounty/codebase-ratio and priority-score analysis. Refreshed twice daily (06:00/18:00 UTC). priorityScore is a v1 heuristic, not backtested: use as direction, not a guaranteed prediction.",
        "operationId": "getAuditSignals",
        "parameters": [
          {
            "in": "header",
            "name": "PAYMENT-SIGNATURE",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "x402 payment: base64 JSON payload with an EIP-3009 authorization (or, legacy, a Base mainnet USDC transaction hash)"
          }
        ],
        "x-payment-info": {
          "price": {
            "mode": "fixed",
            "currency": "USD",
            "amount": "0.010000"
          },
          "protocols": [
            {
              "x402": {}
            }
          ]
        },
        "responses": {
          "200": {
            "description": "Sellable audit items with ourAnalysis (priorityScore, priorityLabel, auditDensitySignal, bountyToCodebaseRatioUsdPerKb)"
          },
          "402": {
            "description": "Payment Required: $0.010 USDC on Base"
          }
        }
      }
    },
    "/api/bug-intel": {
      "post": {
        "summary": "Bug Bounty Intelligence: AI-generated hypotheses for Solidity in a public repo (not an audit)",
        "description": "Submit a public GitHub repo with Solidity code. The scan reads the files most likely to move funds first, in at most six parts, and returns AI-generated hypotheses, not an audit. The report states what share of the code was read. Returns a jobId; poll /api/bug-intel/{jobId}. Usually done within the hour. $5 USDC. Check the repo first, for free, with GET /api/bug-intel/precheck?repo=owner/name. If the scan fails or the report does not help, write to info@holistischadviseur.nl for a refund or a new attempt.",
        "operationId": "submitBugIntel",
        "parameters": [
          {
            "in": "header",
            "name": "PAYMENT-SIGNATURE",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "x402 payment: base64 JSON payload with an EIP-3009 authorization (or, legacy, a Base mainnet USDC transaction hash)"
          }
        ],
        "x-payment-info": {
          "price": {
            "mode": "fixed",
            "currency": "USD",
            "amount": "5.000000"
          },
          "protocols": [
            {
              "x402": {}
            }
          ]
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "repo"
                ],
                "properties": {
                  "repo": {
                    "type": "string",
                    "example": "owner/repo-name",
                    "description": "GitHub repo (owner/repo or full URL)"
                  },
                  "contact": {
                    "type": "string",
                    "example": "you@example.com",
                    "description": "Email or Telegram handle for delivery notification"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Job queued: contains jobId and pollUrl"
          },
          "400": {
            "description": "Invalid repo format or payment"
          },
          "402": {
            "description": "Payment Required: $5 USDC on Base"
          }
        }
      }
    },
    "/api/quick-check": {
      "post": {
        "summary": "Fast Solidity pre-screen: 7 regex detectors, benchmarked against SolidiFI",
        "description": "Fast, LLM-free pre-screen for Solidity source code using 7 regex-based detectors (tx.origin misuse, unhandled send/call, overflow/underflow, reentrancy, timestamp dependence, TOD, unchecked send). Benchmarked against SolidiFI (9,369 artificially injected bugs, 350 real contracts): 75.5-100 percent recall, 96.2-99.9 percent precision per bug type. Not a substitute for a full audit or /api/bug-intel.",
        "operationId": "quickCheck",
        "parameters": [
          {
            "in": "header",
            "name": "PAYMENT-SIGNATURE",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "x402 payment: base64 JSON payload with an EIP-3009 authorization (or, legacy, a Base mainnet USDC transaction hash)"
          }
        ],
        "x-payment-info": {
          "price": {
            "mode": "fixed",
            "currency": "USD",
            "amount": "0.050000"
          },
          "protocols": [
            {
              "x402": {}
            }
          ]
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "source"
                ],
                "properties": {
                  "source": {
                    "type": "string",
                    "description": "Raw Solidity source code as text"
                  },
                  "filename": {
                    "type": "string",
                    "example": "MyContract.sol",
                    "description": "Optional, for readability in the response"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Findings array, one entry per detector that fired"
          },
          "400": {
            "description": "Missing or invalid source"
          },
          "402": {
            "description": "Payment Required: $0.05 USDC on Base"
          }
        }
      }
    },
    "/api/judge-finding": {
      "post": {
        "summary": "Al-Mizaan 7-gate validity judge for your own bug bounty finding",
        "description": "Pressure-tests a candidate bug bounty finding through the Al-Mizaan 7-gate framework (mechanical gates, then an adversarial Defender/Attacker/Judge LLM debate) before you spend a real submission on Sherlock, Immunefi or Cantina. Hosted version of the open-source al-mizaan-judge CLI (github.com/holistis/al-mizaan-judge), run on our own key instead of yours.",
        "operationId": "judgeFinding",
        "parameters": [
          {
            "in": "header",
            "name": "PAYMENT-SIGNATURE",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "x402 payment: base64 JSON payload with an EIP-3009 authorization (or, legacy, a Base mainnet USDC transaction hash)"
          }
        ],
        "x-payment-info": {
          "price": {
            "mode": "fixed",
            "currency": "USD",
            "amount": "2.000000"
          },
          "protocols": [
            {
              "x402": {}
            }
          ]
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "title",
                  "bugClass",
                  "severity",
                  "affectedFile",
                  "affectedFunction",
                  "description",
                  "impact",
                  "invariant",
                  "exploitSketch",
                  "confidence",
                  "platform",
                  "code"
                ],
                "properties": {
                  "title": {
                    "type": "string"
                  },
                  "bugClass": {
                    "type": "string",
                    "enum": [
                      "access-control",
                      "reentrancy",
                      "integer-overflow",
                      "rounding-precision",
                      "oracle-manipulation",
                      "flash-loan",
                      "signature-replay",
                      "business-logic",
                      "dos-griefing",
                      "liquidation",
                      "proxy-storage",
                      "other"
                    ]
                  },
                  "severity": {
                    "type": "string",
                    "enum": [
                      "High",
                      "Medium",
                      "Low"
                    ]
                  },
                  "affectedFile": {
                    "type": "string"
                  },
                  "affectedFunction": {
                    "type": "string"
                  },
                  "description": {
                    "type": "string"
                  },
                  "impact": {
                    "type": "string"
                  },
                  "invariant": {
                    "type": "string"
                  },
                  "exploitSketch": {
                    "type": "string"
                  },
                  "confidence": {
                    "type": "number",
                    "description": "0-100 self-assessed confidence"
                  },
                  "platform": {
                    "type": "string",
                    "enum": [
                      "sherlock",
                      "immunefi",
                      "cantina",
                      "generic"
                    ]
                  },
                  "code": {
                    "type": "array",
                    "items": {
                      "type": "object",
                      "properties": {
                        "path": {
                          "type": "string"
                        },
                        "content": {
                          "type": "string"
                        }
                      }
                    }
                  },
                  "protocolContext": {
                    "type": "string",
                    "description": "Optional README/scope excerpt"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Full JudgeReport: finalVerdict, mechanical gate result, adversarial debate summary if run"
          },
          "400": {
            "description": "Missing required Finding fields"
          },
          "402": {
            "description": "Payment Required: $1.00 USDC on Base"
          }
        }
      }
    },
    "/api/site-check": {
      "post": {
        "summary": "One-off real-browser check of a single URL",
        "description": "Visits a URL with a real headless browser (Playwright/Chromium) and returns HTTP status, load time, page title, JS console errors, console warnings and uncaught exceptions. No subscription, no setup, a single call for a single URL. Private/internal IP ranges and non-http(s) schemes are rejected before any browser is launched.",
        "operationId": "siteCheck",
        "parameters": [
          {
            "in": "header",
            "name": "PAYMENT-SIGNATURE",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "x402 payment: base64 JSON payload with an EIP-3009 authorization (or, legacy, a Base mainnet USDC transaction hash)"
          }
        ],
        "x-payment-info": {
          "price": {
            "mode": "fixed",
            "currency": "USD",
            "amount": "0.020000"
          },
          "protocols": [
            {
              "x402": {}
            }
          ]
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "url"
                ],
                "properties": {
                  "url": {
                    "type": "string",
                    "example": "https://example.com",
                    "description": "The URL to check. Must be http:// or https://, public (not internal/private)."
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Site check report: reachable, http_status, load_time_ms, title, console_errors, console_warnings, js_exceptions"
          },
          "400": {
            "description": "Missing or disallowed URL (internal/private address, wrong scheme)"
          },
          "402": {
            "description": "Payment Required: $0.02 USDC on Base"
          }
        }
      }
    },
    "/api/bug-intel/precheck": {
      "get": {
        "summary": "Free precheck for a Bug Bounty Intelligence scan",
        "description": "No payment. Says whether the repository exists and is public, how many Solidity files count as the project's own logic (tests, mocks, scripts, interfaces and vendored dependencies are left out), and roughly how much of that code the scan will read. Rate limited to 8 requests per minute per client address.",
        "operationId": "precheckBugIntel",
        "security": [],
        "parameters": [
          {
            "name": "repo",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "owner/repo or a github.com URL"
          }
        ],
        "responses": {
          "200": {
            "description": "ok true, false or null (null: the check itself was unavailable, nothing is blocked)"
          },
          "400": {
            "description": "Invalid repo"
          },
          "429": {
            "description": "Too many prechecks from this IP"
          }
        }
      }
    },
    "/api/bug-intel/{jobId}": {
      "get": {
        "summary": "Poll Bug Intel job status",
        "description": "Free status endpoint. Returns status (queued/complete) and reportUrl when done.",
        "operationId": "getBugIntelStatus",
        "security": [],
        "parameters": [
          {
            "name": "jobId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Job status with reportUrl when complete"
          },
          "404": {
            "description": "Job not found"
          }
        }
      }
    }
  }
}