API

Authenticated responses use Cache-Control: no-store.

Exchange identity

POST /api/auth/exchange exchanges a verified Cloudflare Access assertion for a short-lived token.

Account

GET /api/account/me returns role, status, daily quota, reset time and pending report count.

Check

POST /api/v1/check
Content-Type: application/json

{ "target": "https://sample.test/path" }

The response contains only hit / miss and quota information. Legacy GET /check remains temporarily compatible and is marked deprecated.

Report

POST /api/v1/reports accepts a domain, reproducible evidence and optional attack tags. Submission never adds an IOC automatically.