{
  "openapi": "3.0.0",
  "info": {
    "title": "CertScope API",
    "description": "SSL/TLS 90-Day Expiry Sentry, Post-Quantum Cryptography (NIST ML-KEM) Readiness Auditor, and Zero-Downtime Renewal Config Engine.",
    "version": "1.0.0",
    "contact": {
      "name": "ScopeKit Cryptography Team",
      "url": "https://certscope.agentlabs.workers.dev"
    }
  },
  "servers": [
    {
      "url": "https://certscope.agentlabs.workers.dev",
      "description": "Production Edge"
    },
    {
      "url": "http://localhost:3004",
      "description": "Local Dev"
    }
  ],
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key",
        "description": "Enter Pro/Agency API Key. Use 'certscope_eval_2026' for evaluation."
      }
    }
  },
  "paths": {
    "/health": {
      "get": {
        "summary": "Health Check",
        "tags": [
          "Tier 1: Free Diagnostic Suite"
        ],
        "responses": {
          "200": {
            "description": "Service online"
          }
        }
      }
    },
    "/v1/audit": {
      "get": {
        "summary": "Full Cryptographic & Expiry Audit",
        "tags": [
          "Tier 1: Free Diagnostic Suite"
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "example": "stripe.com"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Full audit findings"
          }
        }
      }
    },
    "/v1/audit/tls": {
      "get": {
        "summary": "TLS Handshake & 90-Day Expiry Sentry",
        "tags": [
          "Tier 1: Free Diagnostic Suite"
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "example": "github.com"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "TLS handshake findings"
          }
        }
      }
    },
    "/v1/audit/pqc": {
      "get": {
        "summary": "Post-Quantum Cryptography (ML-KEM) Audit",
        "tags": [
          "Tier 1: Free Diagnostic Suite"
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "example": "cloudflare.com"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "PQC readiness"
          }
        }
      }
    },
    "/v1/audit/caa": {
      "get": {
        "summary": "DNS CAA Record Pinning Audit",
        "tags": [
          "Tier 1: Free Diagnostic Suite"
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "example": "google.com"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "CAA records"
          }
        }
      }
    },
    "/v1/audit/hsts": {
      "get": {
        "summary": "HSTS & Preload Eligibility Check",
        "tags": [
          "Tier 1: Free Diagnostic Suite"
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "example": "stripe.com"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "HSTS status"
          }
        }
      }
    },
    "/v1/remediate/renewal-config": {
      "get": {
        "summary": "Certbot Automated Systemd Timer & Hardened NGINX Config",
        "tags": [
          "Tier 2: Pro Remediation Utilities"
        ],
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "example": "stripe.com"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Renewal configs"
          },
          "401": {
            "description": "API Key Required"
          }
        }
      }
    },
    "/v1/remediate/caa-records": {
      "get": {
        "summary": "DNS CAA Resource Records (BIND / Cloudflare / Route53)",
        "tags": [
          "Tier 2: Pro Remediation Utilities"
        ],
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "example": "stripe.com"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "CAA DNS records"
          },
          "401": {
            "description": "API Key Required"
          }
        }
      }
    },
    "/v1/agency/certificate": {
      "get": {
        "summary": "White-Label Printable Cryptographic Audit Certificate",
        "tags": [
          "Tier 3: Agency & Enterprise Suite"
        ],
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "example": "stripe.com"
            }
          },
          {
            "name": "format",
            "in": "query",
            "required": false,
            "schema": {
              "type": "string",
              "enum": [
                "html",
                "json"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Audit Certificate"
          },
          "401": {
            "description": "API Key Required"
          }
        }
      }
    }
  }
}