{"openapi":"3.0.3","info":{"title":"Agent URL & SSRF Firewall API","version":"1.0.0","description":"Advisory SSRF pre-check and redirect-chain inspector blocking private IP ranges, cloud metadata endpoints, localhost variants, obfuscated decimal/hex/octal IPs, and unsafe redirects."},"servers":[{"url":"https://api.tinplate.dev","description":"Production Edge Gateway"}],"components":{"schemas":{"SsrfCheckResponse":{"type":"object","properties":{"allowed":{"type":"boolean","example":true},"risk_level":{"type":"string","enum":["safe","blocked","high_risk"],"example":"safe"},"advisory":{"type":"boolean","enum":[true]},"note":{"type":"string"},"static_check":{"type":"object","properties":{"allowed":{"type":"boolean"},"category":{"type":"string"},"reason":{"type":"string","nullable":true},"normalized_url":{"type":"string","nullable":true},"hostname":{"type":"string","nullable":true}},"required":["allowed","category","reason","normalized_url","hostname"]},"dns_ips":{"type":"array","items":{"type":"string"}},"blocked_dns_ips":{"type":"array","items":{"type":"string"}},"redirect_chain":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string"},"status":{"type":"integer"},"location":{"type":"string","nullable":true}},"required":["url","status","location"]}}},"required":["allowed","risk_level","advisory","note","static_check","dns_ips","blocked_dns_ips","redirect_chain"]},"SsrfCheckRequest":{"type":"object","properties":{"url":{"type":"string","minLength":1,"maxLength":2048,"example":"https://example.com/docs","description":"Target URL to evaluate for SSRF risk."},"check_dns":{"type":"boolean","example":true,"description":"Resolve A/AAAA records via DoH and check resolved IPs (default true)."},"inspect_redirects":{"type":"boolean","example":false,"description":"Follow redirects via private fetcher to inspect redirect chain (default false)."}},"required":["url"]},"ResponseMeta":{"type":"object","required":["request_id"],"properties":{"request_id":{"type":"string","format":"uuid"},"ms":{"type":"integer","minimum":0},"version":{"type":"string","example":"1.0.0"}}},"ErrorEnvelope":{"type":"object","required":["ok","error","meta"],"properties":{"ok":{"type":"boolean","enum":[false]},"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string","example":"invalid_input"},"message":{"type":"string","example":"Request body failed validation"}}},"meta":{"$ref":"#/components/schemas/ResponseMeta"}}}},"parameters":{}},"paths":{"/v1/ssrf-firewall":{"post":{"tags":["13_SSRF_FIREWALL"],"summary":"Check a URL for SSRF risk, private DNS resolution, and unsafe redirects","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SsrfCheckRequest"}}}},"responses":{"200":{"description":"SSRF assessment result","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","enum":[true]},"data":{"$ref":"#/components/schemas/SsrfCheckResponse"},"meta":{"$ref":"#/components/schemas/ResponseMeta"}},"required":["ok","data","meta"]}}}},"400":{"description":"Invalid input or malformed JSON request body","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}},"401":{"description":"Missing or invalid authentication credentials","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}},"413":{"description":"Request payload exceeds subscribed plan byte cap","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}},"429":{"description":"Rate limit exceeded","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}}}}}}}