{"openapi":"3.0.3","info":{"title":"JWT, JWS & JWK Security Auditor & RFC 8725 Linter API","version":"1.0.0","description":"Decodes, verifies, and audits JWT/JWS tokens and JWK/JWKS key sets against RFC 8725 & RFC 7518 best practices: detects alg:none, jku/x5u/jwk/kid header injection, weak/dictionary HMAC secrets, missing/excessive exp/aud/iss claims, leaked payload secrets, and private keys exposed in public JWKS."},"servers":[{"url":"https://api.tinplate.dev","description":"Production Edge Gateway"}],"components":{"schemas":{"JwtJwkInspectorResponseData":{"type":"object","properties":{"verdict":{"type":"string","enum":["pass","warn","fail"]},"security_score":{"type":"integer","minimum":0,"maximum":100},"grade":{"type":"string","enum":["A","B","C","D","F"]},"decoded_header":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"decoded_payload":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"signature_present":{"type":"boolean"},"signature_verified":{"type":"boolean","nullable":true},"weak_secret_cracked":{"type":"string","nullable":true},"token_status":{"type":"string","enum":["valid_window","expired","not_yet_valid","missing_exp","not_provided"]},"findings":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string","enum":["malformed_token","alg_none","header_injection_vector","weak_hmac_secret","signature_mismatch","claim_lifetime_hygiene","sensitive_payload_claim","private_key_exposed_in_jwk","weak_cryptographic_key","jwk_metadata_hygiene"]},"severity":{"type":"string","enum":["low","medium","high","critical"]},"rfc_reference":{"type":"string"},"description":{"type":"string"},"remediation":{"type":"string"}},"required":["category","severity","rfc_reference","description","remediation"]}}},"required":["verdict","security_score","grade","decoded_header","decoded_payload","signature_present","signature_verified","weak_secret_cracked","token_status","findings"]},"JwtJwkInspectorRequest":{"type":"object","properties":{"token":{"type":"string","maxLength":65536,"description":"Compact JWS / JWT string (header.payload.signature) to decode, verify, and audit against RFC 8725.","example":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ij../../etc/passwdIn0.eyJzdWIiOiJ1c2VyXzEyMyIsImFkbWluIjp0cnVlLCJwYXNzd29yZCI6InN1cGVyc2VjcmV0In0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"},"hmac_secret":{"type":"string","maxLength":4096,"description":"Optional HMAC secret to verify HS256/HS384/HS512 signatures and check RFC 7518 key entropy requirements."},"jwk":{"type":"object","additionalProperties":{"nullable":true},"description":"Optional JWK or JWKS ({ keys: [...] }) object to audit for leaked private key parameters (d, p, q, k) and key strength."},"reference_time_unix":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Optional Unix epoch timestamp (seconds) for deterministic exp/nbf/iat validation."},"max_ttl_seconds":{"type":"integer","minimum":0,"exclusiveMinimum":true,"default":86400,"description":"Maximum recommended token lifetime (exp - iat) in seconds before flagging long-lived access tokens."}}},"ResponseMeta":{"type":"object","required":["request_id"],"properties":{"request_id":{"type":"string","format":"uuid"},"ms":{"type":"integer","minimum":0},"version":{"type":"string","example":"1.0.0"}}},"ErrorEnvelope":{"type":"object","required":["ok","error","meta"],"properties":{"ok":{"type":"boolean","enum":[false]},"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string","example":"invalid_input"},"message":{"type":"string","example":"Request body failed validation"}}},"meta":{"$ref":"#/components/schemas/ResponseMeta"}}}},"parameters":{}},"paths":{"/v1/jwt-jwk-inspector":{"post":{"tags":["34_JWT_JWK_INSPECTOR"],"summary":"Decode, verify, and audit a JWT token or JWK set against RFC 8725 security rules","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/JwtJwkInspectorRequest"}}}},"responses":{"200":{"description":"JWT/JWK security verdict, score, decoded claims, signature verification, and RFC 8725 findings","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","enum":[true]},"data":{"$ref":"#/components/schemas/JwtJwkInspectorResponseData"},"meta":{"$ref":"#/components/schemas/ResponseMeta"}},"required":["ok","data","meta"]}}}},"400":{"description":"Invalid input or malformed JSON request body","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}},"401":{"description":"Missing or invalid authentication credentials","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}},"413":{"description":"Request payload exceeds subscribed plan byte cap","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}},"429":{"description":"Rate limit exceeded","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}}}}}}}