{ "openapi": "3.1.0", "info": { "title": "Infrastructure Impact public reader", "version": "1.0.0", "description": "Read-only public-source intelligence. No vault or write access. Data schema major 2 is independent of HTTP API version 1." }, "paths": { "/api/v1/advisories": { "get": { "summary": "Normalized advisories with cohort-filtered assessments", "parameters": [ { "name": "cves", "in": "query", "description": "Comma-separated CVE IDs; at most 200. Omit for all published CVEs.", "schema": { "type": "string" } }, { "name": "vendor", "in": "query", "schema": { "type": "string" } }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 100 } }, { "name": "offset", "in": "query", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "Page from a named immutable publication", "content": { "application/json": { "schema": { "type": "object", "required": [ "schema_version", "publication", "total", "offset", "limit", "items" ], "properties": { "schema_version": { "const": 2 }, "publication": { "type": "object" }, "total": { "type": "integer" }, "offset": { "type": "integer" }, "limit": { "type": "integer" }, "items": { "type": "array", "items": { "$ref": "/schemas/advisory-v2.json" } } } } } } }, "400": { "description": "Invalid cohort, vendor or pagination" }, "503": { "description": "Publication unavailable" } } } }, "/api/v1/assessments": { "get": { "summary": "CVE/product assessments with advisory provenance", "parameters": [ { "name": "cves", "in": "query", "description": "Comma-separated CVE IDs; at most 200. Omit for all published CVEs.", "schema": { "type": "string" } }, { "name": "vendor", "in": "query", "schema": { "type": "string" } }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 100 } }, { "name": "offset", "in": "query", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "Page from a named immutable publication", "content": { "application/json": { "schema": { "type": "object", "required": [ "schema_version", "publication", "total", "offset", "limit", "items" ], "properties": { "schema_version": { "const": 2 }, "publication": { "type": "object" }, "total": { "type": "integer" }, "offset": { "type": "integer" }, "limit": { "type": "integer" }, "items": { "type": "array", "items": { "type": "object", "description": "Assessment fields plus vendor, advisory_id, source_url and sha256" } } } } } } }, "400": { "description": "Invalid cohort, vendor or pagination" }, "503": { "description": "Publication unavailable" } } } }, "/health/live": { "get": { "summary": "Reader process liveness", "responses": { "200": { "description": "Successful response" }, "503": { "description": "Publication unavailable or stale (readiness only)" } } } }, "/health/ready": { "get": { "summary": "Readiness; stale publication returns 503", "responses": { "200": { "description": "Successful response" }, "503": { "description": "Publication unavailable or stale (readiness only)" } } } }, "/api/v1/health": { "get": { "summary": "Publication age and current collection status", "responses": { "200": { "description": "Successful response" }, "503": { "description": "Publication unavailable or stale (readiness only)" } } } }, "/api/export.json": { "get": { "summary": "Selected-cohort public dataset", "responses": { "200": { "description": "Successful response" }, "503": { "description": "Publication unavailable or stale (readiness only)" } } } }, "/api/export.csv": { "get": { "summary": "Selected-cohort CSV", "responses": { "200": { "description": "Successful response" }, "503": { "description": "Publication unavailable or stale (readiness only)" } } } }, "/snapshot.json": { "get": { "summary": "Complete current public generation", "responses": { "200": { "description": "Successful response" }, "503": { "description": "Publication unavailable or stale (readiness only)" } } } }, "/schemas/advisory-v2.json": { "get": { "summary": "Canonical normalized advisory JSON Schema", "responses": { "200": { "description": "Successful response" }, "503": { "description": "Publication unavailable or stale (readiness only)" } } } }, "/api/v1/catalogue": { "get": { "summary": "Operational source coverage and collection freshness", "responses": { "200": { "description": "Coverage profiles; successful checks do not establish comprehensive vendor coverage." } } } }, "/benchmark.json": { "get": { "summary": "Declared mapping case evaluation for this publication", "responses": { "200": { "description": "Case results and source hashes; global precision is not estimated." } } } }, "/release-assets.json": { "get": { "summary": "Dated public release-listing metadata, not CVE assessments", "responses": { "200": { "description": "Publisher build/platform/date/checksum fields with source provenance; firmware not downloaded." } } } }, "/api/v1/scorecards": { "get": { "summary": "Coverage-aware vendor evidence scorecards", "parameters": [ { "name": "cves", "in": "query", "description": "Comma-separated CVE IDs, maximum 200; omit for all published CVEs", "schema": { "type": "string" } }, { "name": "vendor", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Schema version 1 metadata from one immutable publication; no security ranking or intent inference" }, "400": { "description": "Invalid cohort or unknown vendor" }, "503": { "description": "Publication unavailable" } } } }, "/scorecards.json": { "get": { "summary": "Complete published scorecards metadata", "responses": { "200": { "description": "Static schema version 1 JSON; timeline bounds are explicit" } } } }, "/api/v1/timeline": { "get": { "summary": "Locally observed revision timeline with separate publisher dates", "parameters": [ { "name": "cves", "in": "query", "description": "Comma-separated CVE IDs, maximum 200; omit for all published CVEs", "schema": { "type": "string" } }, { "name": "vendor", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Schema version 1 metadata from one immutable publication; no security ranking or intent inference" }, "400": { "description": "Invalid cohort or unknown vendor" }, "503": { "description": "Publication unavailable" } } } }, "/timeline.json": { "get": { "summary": "Complete published timeline metadata", "responses": { "200": { "description": "Static schema version 1 JSON; timeline bounds are explicit" } } } }, "/api/v1/source-audit": { "get": { "summary": "Retained feed/index scope audit; no archive-completeness claim", "responses": { "200": { "description": "Version 1 public metadata from an immutable publication; no intent inference" }, "503": { "description": "Publication unavailable" } } } }, "/source-audit.json": { "get": { "summary": "Static source-scope audit", "responses": { "200": { "description": "Version 1 public metadata from an immutable publication; no intent inference" }, "503": { "description": "Publication unavailable" } } } }, "/api/v1/casefiles": { "get": { "summary": "Evidence-linked disclosure research questions", "responses": { "200": { "description": "Version 1 public metadata from an immutable publication; no intent inference" }, "503": { "description": "Publication unavailable" }, "400": { "description": "Invalid cohort or unknown vendor" } }, "parameters": [ { "name": "cves", "in": "query", "schema": { "type": "string" } }, { "name": "vendor", "in": "query", "schema": { "type": "string" } } ] } }, "/casefiles.json": { "get": { "summary": "Static public research case files", "responses": { "200": { "description": "Version 1 public metadata from an immutable publication; no intent inference" }, "503": { "description": "Publication unavailable" } } } }, "/api/v1/comparison-eligibility": { "get": { "summary": "Recompute comparison eligibility for a shared period and product scope", "parameters": [ { "name": "cves", "in": "query", "schema": { "type": "string" }, "description": "Comma-separated CVE identifiers; omitted selects all retained CVEs." }, { "name": "vendor", "in": "query", "schema": { "type": "string" } }, { "name": "start", "in": "query", "schema": { "type": "string", "format": "date" }, "description": "Inclusive initial advisory publication calendar date; defaults to end minus 364 days." }, { "name": "end", "in": "query", "schema": { "type": "string", "format": "date" }, "description": "Inclusive end, no later than publication date; defaults to that date." }, { "name": "products", "in": "query", "schema": { "type": "string" }, "description": "JSON object of vendor IDs to exact retained product-label arrays, at most 20 labels per vendor and 4096 UTF-8 bytes. Missing key includes all retained labels; empty array selects none." }, { "name": "group", "in": "query", "schema": { "type": "string" }, "description": "Reviewed product-role group ID; intersects exact product selectors. Unknown or duplicate IDs return 400. Role membership does not establish equivalent portfolios." } ], "responses": { "200": { "description": "Qualified scoped evidence counts, source gaps and explicit timing/rate suppression. Paired offsets describe document metadata only.", "content": { "application/json": { "schema": { "$ref": "./schemas/comparison-eligibility-v1.json" } } } }, "400": { "description": "Invalid date, cohort, vendor or exact product selection." } } } }, "/comparison-eligibility.json": { "get": { "summary": "Default-window comparison report for the immutable static publication", "responses": { "200": { "description": "Qualified scoped evidence counts, source gaps and explicit timing/rate suppression. Paired offsets describe document metadata only.", "content": { "application/json": { "schema": { "$ref": "./schemas/comparison-eligibility-v1.json" } } } } } } }, "/schemas/comparison-eligibility-v1.json": { "get": { "summary": "Comparison eligibility v1 JSON Schema", "responses": { "200": { "description": "Strict schema for qualified counts and currently suppressed rates/timing." } } } }, "/api/v1/product-groups": { "get": { "summary": "Versioned product roles and mapping coverage", "responses": { "200": { "description": "All retained non-draft statement roles, unmapped labels and source-linked rules. Not a portfolio inventory." } }, "parameters": [ { "name": "vendor", "in": "query", "schema": { "type": "string" } } ] } }, "/api/v1/extraction-validation": { "get": { "summary": "Pinned source-led extraction validation", "responses": { "200": { "description": "Whole purposive review sample; source revisions require re-review; independent human review pending." } } } }, "/api/v1/review-packet": { "get": { "summary": "Blind independent-review packet", "responses": { "200": { "description": "Source links and fingerprints with blank adjudications; expected labels and parser output withheld." } } } }, "/api/v1/publisher-history": { "get": { "summary": "Publisher-reported documentation changes", "responses": { "200": { "description": "Current change-log entries with provenance; not historical captures, first disclosure or firmware availability." } } } }, "/api/v1/vendor-gaps": { "get": { "summary": "Whole-publication collection, archive and source-review gaps; not a security ranking", "parameters": [ { "name": "vendor", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Vendor-gap report v1. Independent of any selected CVE cohort; human review remains pending." }, "400": { "description": "Unknown or repeated vendor" } } } }, "/api/v1/family-completeness": { "get": { "summary": "Curated family and release-line reference evidence; not inventory completeness", "description": "Whole-publication report, independent of the selected browser CVE cohort. Read only. Static Pages serves /family-completeness.json.", "responses": { "200": { "description": "Generation-bound report", "content": { "application/json": { "schema": { "$ref": "/schemas/family-completeness-v1.json" } } } } } } }, "/api/v1/comparison-readiness": { "get": { "summary": "Predeclared reference cohorts and blockers; no rates", "description": "Whole-publication report, independent of the selected browser CVE cohort. Read only. Static Pages serves /comparison-readiness.json.", "responses": { "200": { "description": "Generation-bound report", "content": { "application/json": { "schema": { "$ref": "/schemas/comparison-readiness-v1.json" } } } } } } }, "/api/v1/fix-leads": { "get": { "summary": "Dated research leads, alternative explanations and analysis gaps", "description": "Whole-publication report, independent of the selected browser CVE cohort. Read only. Static Pages serves /fix-leads.json.", "responses": { "200": { "description": "Generation-bound report", "content": { "application/json": { "schema": { "$ref": "/schemas/fix-leads-v1.json" } } } } } } }, "/api/v1/component-studies": { "get": { "summary": "Frozen component reference cohorts with scoped vendor statements and unknowns", "description": "Whole-publication study independent of dashboard cohort. No rates or ranking. Static Pages serves /component-studies.json.", "responses": { "200": { "description": "Generation-bound component study report", "content": { "application/json": { "schema": { "$ref": "/schemas/component-studies-v1.json" } } } } } } }, "/api/v1/product-cohorts": { "get": { "summary": "Product scope and source coverage", "description": "Whole-publication product-scope targets, bound component sources and missing build/service/lifecycle inventory. Rates and denominators remain null. Static Pages serves /product-cohorts.json.", "responses": { "200": { "description": "Generation-bound product cohort report", "content": { "application/json": { "schema": { "$ref": "/schemas/product-cohorts-v1.json" } } } } }, "operationId": "getProductCohorts" } }, "/api/v1/disclosure-review": { "get": { "summary": "Disclosure investigation review queue", "description": "Investigation tasks with CVE-specific counter-evidence and five unestablished evidence gates. No automatic verification or intent inference. Static Pages serves /disclosure-review.json.", "responses": { "200": { "description": "Generation-bound disclosure review queue", "content": { "application/json": { "schema": { "$ref": "/schemas/disclosure-review-v1.json" } } } } }, "operationId": "getDisclosureReview" } } } }