{
  "openapi": "3.1.0",
  "info": {
    "title": "Network Packet Threat Analyzer API",
    "version": "0.0.2",
    "description": "Analyze packet captures, extract flows and IOCs, inspect DNS, compare captures and generate threat reports.",
    "x-pricing-model": "payg",
    "x-free-tier-calls": 0,
    "x-docs-url": "",
    "x-dakidarts-contract-status": "published",
    "x-dakidarts-execution-status": "source-only"
  },
  "servers": [
    {
      "url": "https://api.dakidarts.com/network-packet-threat-analyzer",
      "description": "Dakidarts direct gateway"
    }
  ],
  "tags": [
    {
      "name": "Operations",
      "description": "Operations endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Analysis",
      "description": "Analysis endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Batch operations",
      "description": "Batch operations endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Flows",
      "description": "Flows endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Iocs",
      "description": "Iocs endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Dns",
      "description": "Dns endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Hex",
      "description": "Hex endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Rules",
      "description": "Rules endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Compare",
      "description": "Compare endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Report",
      "description": "Report endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Strings",
      "description": "Strings endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Jobs",
      "description": "Jobs endpoints sourced from the Network Packet Threat Analyzer API implementation."
    },
    {
      "name": "Admin",
      "description": "Admin endpoints sourced from the Network Packet Threat Analyzer API implementation."
    }
  ],
  "paths": {
    "/status": {
      "get": {
        "summary": "Health",
        "description": "Health check. No parameters.",
        "operationId": "network-packet-threat-analyzer_get_status",
        "tags": [
          "Operations"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    },
    "/analyze": {
      "get": {
        "summary": "Analyze",
        "description": "Test mode \u2014 analyzes a bundled sample capture. No file upload needed. Useful for integration testing.",
        "operationId": "network-packet-threat-analyzer_get_analyze",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "sensitivity",
            "in": "query",
            "required": false,
            "description": "Detection sensitivity: `low`, `medium`, or `high`.",
            "schema": {
              "type": "string",
              "default": "medium"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Analyze",
        "description": "Test mode \u2014 analyzes a bundled sample capture. No file upload needed. Useful for integration testing.",
        "operationId": "network-packet-threat-analyzer_post_analyze",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "sensitivity",
            "in": "query",
            "required": false,
            "description": "Detection sensitivity: `low`, `medium`, or `high`.",
            "schema": {
              "type": "string",
              "default": "medium"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap_b64": {
                    "type": "string",
                    "example": "aB3Kd...",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap_b64"
                ]
              }
            },
            "application/octet-stream": {
              "schema": {
                "type": "string",
                "format": "binary"
              }
            },
            "multipart/form-data": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap": {
                    "type": "string",
                    "format": "binary",
                    "example": "@capture.pcap",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap"
                ]
              }
            }
          }
        },
        "x-required-groups": {
          "capture-input": [
            "pcap",
            "pcap_b64"
          ]
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    },
    "/analyze/batch": {
      "post": {
        "summary": "Analyze Batch",
        "description": "Analyze multiple captures in one request. Up to 10 files, 25 MB combined.",
        "operationId": "network-packet-threat-analyzer_post_analyze_batch",
        "tags": [
          "Batch operations"
        ],
        "parameters": [
          {
            "name": "sensitivity",
            "in": "query",
            "required": false,
            "description": "Detection sensitivity: `low`, `medium`, or `high`.",
            "schema": {
              "type": "string",
              "default": "medium"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "status": {
                      "type": "string"
                    },
                    "results": {
                      "type": "array",
                      "items": {}
                    },
                    "sensitivity": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "batch_threat_score": {
                      "type": "integer"
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "captures": {
                    "type": "array",
                    "example": [
                      {
                        "name": "capture.pcap",
                        "pcap_b64": "BASE64_PCAP"
                      }
                    ],
                    "items": {
                      "type": "object"
                    }
                  }
                },
                "required": [
                  "captures"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    },
    "/flows": {
      "post": {
        "summary": "Flows",
        "description": "Extract per-conversation network flow records with a per-flow threat score.",
        "operationId": "network-packet-threat-analyzer_post_flows",
        "tags": [
          "Flows"
        ],
        "parameters": [
          {
            "name": "top_n",
            "in": "query",
            "required": false,
            "description": "Max flows to return (default: 50)",
            "schema": {
              "type": "integer",
              "default": 50,
              "example": "?top_n=10"
            },
            "example": "?top_n=10"
          },
          {
            "name": "min_packets",
            "in": "query",
            "required": false,
            "description": "Min packets per flow (default: 1)",
            "schema": {
              "type": "integer",
              "default": 1,
              "example": "?min_packets=5"
            },
            "example": "?min_packets=5"
          },
          {
            "name": "sensitivity",
            "in": "query",
            "required": false,
            "description": "Detection sensitivity: `low`, `medium`, or `high`.",
            "schema": {
              "type": "string",
              "default": "medium"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "flows": {
                      "type": "array",
                      "items": {}
                    },
                    "status": {
                      "type": "string"
                    },
                    "sensitivity": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "total_bytes": {
                      "type": "integer"
                    },
                    "total_flows": {
                      "type": "integer"
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap_b64": {
                    "type": "string",
                    "example": "aB3Kd...",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap_b64"
                ]
              }
            },
            "application/octet-stream": {
              "schema": {
                "type": "string",
                "format": "binary"
              }
            },
            "multipart/form-data": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap": {
                    "type": "string",
                    "format": "binary",
                    "example": "@capture.pcap",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap"
                ]
              }
            }
          }
        },
        "x-required-groups": {
          "capture-input": [
            "pcap",
            "pcap_b64"
          ]
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "flows": [
            {
              "bytes": 1420,
              "dst_ip": "45.77.12.9",
              "src_ip": "10.0.0.5",
              "packets": 10,
              "dst_port": 4444,
              "protocol": "tcp",
              "src_port": 49152,
              "flow_score": 70,
              "duration_seconds": 9.0,
              "avg_payload_entropy": 2.8274,
              "avg_interval_seconds": 1.0
            }
          ],
          "status": "ok",
          "sensitivity": "medium",
          "total_bytes": 1420,
          "total_flows": 10
        }
      }
    },
    "/iocs": {
      "post": {
        "summary": "Iocs",
        "description": "Extract Indicators of Compromise: IPs, domains, URLs, and payload hashes (MD5/SHA1/SHA256).",
        "operationId": "network-packet-threat-analyzer_post_iocs",
        "tags": [
          "Iocs"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "iocs": {
                      "type": "object",
                      "properties": {
                        "ips": {
                          "type": "array",
                          "items": {
                            "type": "string"
                          }
                        },
                        "urls": {
                          "type": "array",
                          "items": {
                            "type": "string"
                          }
                        },
                        "hashes": {
                          "type": "object",
                          "properties": {
                            "md5": {
                              "type": "array",
                              "items": {
                                "type": "string"
                              }
                            },
                            "sha1": {
                              "type": "array",
                              "items": {
                                "type": "string"
                              }
                            },
                            "sha256": {
                              "type": "array",
                              "items": {
                                "type": "string"
                              }
                            }
                          },
                          "additionalProperties": true
                        },
                        "domains": {
                          "type": "array",
                          "items": {
                            "type": "string"
                          }
                        }
                      },
                      "additionalProperties": true
                    },
                    "status": {
                      "type": "string"
                    },
                    "enrichment": {
                      "type": "object",
                      "properties": {
                        "source": {
                          "type": "string"
                        },
                        "malicious_ips": {
                          "type": "array",
                          "items": {
                            "type": "string"
                          }
                        },
                        "malicious_domains": {
                          "type": "array",
                          "items": {
                            "type": "string"
                          }
                        }
                      },
                      "additionalProperties": true
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap_b64": {
                    "type": "string",
                    "example": "aB3Kd...",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap_b64"
                ]
              }
            },
            "application/octet-stream": {
              "schema": {
                "type": "string",
                "format": "binary"
              }
            },
            "multipart/form-data": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap": {
                    "type": "string",
                    "format": "binary",
                    "example": "@capture.pcap",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap"
                ]
              }
            }
          }
        },
        "x-required-groups": {
          "capture-input": [
            "pcap",
            "pcap_b64"
          ]
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "iocs": {
            "ips": [
              "10.0.0.5",
              "45.77.12.9"
            ],
            "urls": [
              "http://c2.evil.tk/beacon"
            ],
            "hashes": {
              "md5": [],
              "sha1": [],
              "sha256": []
            },
            "domains": [
              "c2.evil.tk"
            ]
          },
          "status": "ok",
          "enrichment": {
            "source": "local heuristics (no external feeds)",
            "malicious_ips": [
              "45.77.12.9"
            ],
            "malicious_domains": [
              "c2.evil.tk"
            ]
          }
        }
      }
    },
    "/dns": {
      "post": {
        "summary": "Dns",
        "description": "DNS-specific analysis: detect DNS tunneling, DGA activity, and suspicious TLDs.",
        "operationId": "network-packet-threat-analyzer_post_dns",
        "tags": [
          "Dns"
        ],
        "parameters": [
          {
            "name": "top_n",
            "in": "query",
            "required": false,
            "description": "Max domains to return (default: 50)",
            "schema": {
              "type": "integer",
              "default": 50,
              "example": "?top_n=20"
            },
            "example": "?top_n=20"
          },
          {
            "name": "flag_tunneling",
            "in": "query",
            "required": false,
            "description": "Enable tunneling detection: `true`/`false` (default: `true`)",
            "schema": {
              "type": "boolean",
              "default": true,
              "example": "?flag_tunneling=false"
            },
            "example": "?flag_tunneling=false"
          },
          {
            "name": "sensitivity",
            "in": "query",
            "required": false,
            "description": "Detection sensitivity: `low`, `medium`, or `high`.",
            "schema": {
              "type": "string",
              "default": "medium"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "status": {
                      "type": "string"
                    },
                    "detections": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {},
                        "additionalProperties": true
                      }
                    },
                    "top_domains": {
                      "type": "array",
                      "items": {
                        "type": "array",
                        "items": {}
                      }
                    },
                    "nxdomain_rate": {
                      "type": "number"
                    },
                    "queries_total": {
                      "type": "integer"
                    },
                    "unique_domains": {
                      "type": "integer"
                    },
                    "dns_threat_score": {
                      "type": "integer"
                    },
                    "suspicious_domains": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "flag": {
                            "type": "string"
                          },
                          "domain": {
                            "type": "string"
                          },
                          "query_count": {
                            "type": "integer"
                          },
                          "subdomain_entropy": {
                            "type": "number"
                          }
                        },
                        "additionalProperties": true
                      }
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap_b64": {
                    "type": "string",
                    "example": "aB3Kd...",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap_b64"
                ]
              }
            },
            "application/octet-stream": {
              "schema": {
                "type": "string",
                "format": "binary"
              }
            },
            "multipart/form-data": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap": {
                    "type": "string",
                    "format": "binary",
                    "example": "@capture.pcap",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap"
                ]
              }
            }
          }
        },
        "x-required-groups": {
          "capture-input": [
            "pcap",
            "pcap_b64"
          ]
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "status": "ok",
          "detections": [
            {
              "type": "nxdomain_spike",
              "reason": "elevated NXDOMAIN rate - possible domain generation algorithm (DGA) activity",
              "nxdomain_rate": 1.0
            }
          ],
          "top_domains": [
            [
              "mail.evil.tk",
              1
            ]
          ],
          "nxdomain_rate": 1.0,
          "queries_total": 3,
          "unique_domains": 4,
          "dns_threat_score": 25,
          "suspicious_domains": [
            {
              "flag": "suspicious_tld",
              "domain": "a1b2c3d4e5f6.verylongsubdomain.tk",
              "query_count": 1,
              "subdomain_entropy": 4.6202
            }
          ]
        }
      }
    },
    "/hex": {
      "post": {
        "summary": "Hex Analyze",
        "description": "Single-packet analysis from hex-encoded data. Paste hex from `hexdump`, IDS alerts, or any tool that outputs raw packet bytes.",
        "operationId": "network-packet-threat-analyzer_post_hex",
        "tags": [
          "Hex"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "status": {
                      "type": "string"
                    },
                    "decoded": {
                      "type": "object",
                      "properties": {},
                      "additionalProperties": true
                    },
                    "verdict": {
                      "type": "string"
                    },
                    "flags_list": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "type": {
                            "type": "string"
                          },
                          "detail": {
                            "type": "string"
                          }
                        },
                        "additionalProperties": true
                      }
                    },
                    "payload_entropy": {
                      "type": "number"
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "hex": {
                    "type": "string"
                  }
                },
                "required": [
                  "hex"
                ]
              }
            },
            "text/plain": {
              "schema": {
                "type": "string"
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "status": "ok",
          "decoded": {
            "flags": [
              "SYN"
            ],
            "ip_dst": "45.77.12.9",
            "ip_src": "10.0.0.1",
            "ip_ttl": 64,
            "eth_dst": "66:77:88:99:aa:bb",
            "eth_src": "00:11:22:33:44:55",
            "dst_port": 4444,
            "ip_proto": 6,
            "protocol": "tcp",
            "src_port": 12345
          },
          "verdict": "malicious",
          "flags_list": [
            {
              "type": "suspicious_port",
              "detail": "destination port 4444 is on the suspicious ports list"
            },
            {
              "type": "c2_signature",
              "detail": "payload matched: beacon"
            }
          ],
          "payload_entropy": 2.585
        }
      }
    },
    "/rules": {
      "get": {
        "summary": "Rules",
        "description": "Returns the full detection rule catalog, scoring weights, thresholds, and system limits.",
        "operationId": "network-packet-threat-analyzer_get_rules",
        "tags": [
          "Rules"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "rules": [
                      {
                        "id": "c2_signature",
                        "name": "C2 Signature Match",
                        "weight": 40,
                        "severity": "critical",
                        "tunables": [
                          "KNOWN_C2_PATTERNS"
                        ],
                        "threshold": "any match in any TCP/UDP payload",
                        "description": "Matches known command-and-control patterns (.onion, .tk, c2., beacon) inside payloads"
                      }
                    ],
                    "limits": {
                      "max_upload_bytes": 26214400,
                      "cache_ttl_seconds": 60,
                      "supported_formats": [
                        "pcap",
                        "pcapng"
                      ],
                      "max_batch_captures": 10,
                      "sensitivity_levels": [
                        "low",
                        "medium",
                        "high"
                      ],
                      "max_batch_total_bytes": 26214400
                    },
                    "status": "ok",
                    "version": "0.0.2"
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "rules": [
            {
              "id": "c2_signature",
              "name": "C2 Signature Match",
              "weight": 40,
              "severity": "critical",
              "tunables": [
                "KNOWN_C2_PATTERNS"
              ],
              "threshold": "any match in any TCP/UDP payload",
              "description": "Matches known command-and-control patterns (.onion, .tk, c2., beacon) inside payloads"
            }
          ],
          "limits": {
            "max_upload_bytes": 26214400,
            "cache_ttl_seconds": 60,
            "supported_formats": [
              "pcap",
              "pcapng"
            ],
            "max_batch_captures": 10,
            "sensitivity_levels": [
              "low",
              "medium",
              "high"
            ],
            "max_batch_total_bytes": 26214400
          },
          "status": "ok",
          "version": "0.0.2"
        }
      }
    },
    "/compare": {
      "post": {
        "summary": "Compare",
        "description": "Compare two captures: identify new/removed endpoints, protocol drift, and threat-score delta.",
        "operationId": "network-packet-threat-analyzer_post_compare",
        "tags": [
          "Compare"
        ],
        "parameters": [
          {
            "name": "sensitivity",
            "in": "query",
            "required": false,
            "description": "Detection sensitivity: `low`, `medium`, or `high`.",
            "schema": {
              "type": "string",
              "default": "medium"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "status": {
                      "type": "string"
                    },
                    "score_delta": {
                      "type": "integer"
                    },
                    "sensitivity": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "packet_delta": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "new_endpoints": {
                      "type": "array",
                      "items": {}
                    },
                    "protocol_drift": {
                      "type": "object",
                      "properties": {
                        "added": {
                          "description": "Dynamic source value; no concrete response example is published."
                        },
                        "removed": {
                          "description": "Dynamic source value; no concrete response example is published."
                        }
                      },
                      "additionalProperties": true
                    },
                    "detections_added": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "removed_endpoints": {
                      "type": "array",
                      "items": {}
                    },
                    "detections_removed": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "threat_score_after": {
                      "type": "integer"
                    },
                    "threat_score_before": {
                      "type": "integer"
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "multipart/form-data": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap_a": {
                    "type": "string",
                    "format": "binary"
                  },
                  "pcap_b": {
                    "type": "string",
                    "format": "binary"
                  }
                },
                "required": [
                  "pcap_a",
                  "pcap_b"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "status": "ok",
          "score_delta": 75,
          "sensitivity": "medium",
          "packet_delta": 4,
          "new_endpoints": [
            [
              "10.0.0.5",
              "45.77.12.9",
              49152,
              4444,
              "tcp"
            ]
          ],
          "protocol_drift": {
            "added": [],
            "removed": [
              "icmp"
            ]
          },
          "detections_added": [
            "c2_signature",
            "suspicious_port"
          ],
          "removed_endpoints": [
            [
              "10.0.0.20",
              "93.184.216.34",
              50000,
              80,
              "tcp"
            ]
          ],
          "detections_removed": [],
          "threat_score_after": 100,
          "threat_score_before": 25
        }
      }
    },
    "/report": {
      "post": {
        "summary": "Report",
        "description": "Executive report with human-readable verdict, severity-ranked findings, and actionable remediation guidance.",
        "operationId": "network-packet-threat-analyzer_post_report",
        "tags": [
          "Report"
        ],
        "parameters": [
          {
            "name": "sensitivity",
            "in": "query",
            "required": false,
            "description": "Detection sensitivity: `low`, `medium`, or `high`.",
            "schema": {
              "type": "string",
              "default": "medium"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "status": {
                      "type": "string"
                    },
                    "metrics": {
                      "type": "object",
                      "properties": {},
                      "additionalProperties": true
                    },
                    "summary": {
                      "type": "object",
                      "properties": {},
                      "additionalProperties": true
                    },
                    "verdict": {
                      "type": "string"
                    },
                    "findings": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "title": {
                            "type": "string"
                          },
                          "detail": {
                            "type": "string"
                          },
                          "severity": {
                            "type": "string"
                          },
                          "remediation": {
                            "type": "string"
                          }
                        },
                        "additionalProperties": true
                      }
                    },
                    "headline": {
                      "type": "string"
                    },
                    "detections": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {},
                        "additionalProperties": true
                      }
                    },
                    "sensitivity": {
                      "type": "string"
                    },
                    "threat_score": {
                      "type": "integer"
                    },
                    "score_breakdown": {
                      "type": "object",
                      "properties": {},
                      "additionalProperties": true
                    },
                    "remediation_summary": {
                      "type": "string"
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap_b64": {
                    "type": "string",
                    "example": "aB3Kd...",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap_b64"
                ]
              }
            },
            "application/octet-stream": {
              "schema": {
                "type": "string",
                "format": "binary"
              }
            },
            "multipart/form-data": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap": {
                    "type": "string",
                    "format": "binary",
                    "example": "@capture.pcap",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap"
                ]
              }
            }
          }
        },
        "x-required-groups": {
          "capture-input": [
            "pcap",
            "pcap_b64"
          ]
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    },
    "/strings": {
      "post": {
        "summary": "Strings",
        "description": "Extract printable ASCII strings from payloads (like the `strings` command). Useful for identifying embedded commands, URLs, or debug info in captured traffic.",
        "operationId": "network-packet-threat-analyzer_post_strings",
        "tags": [
          "Strings"
        ],
        "parameters": [
          {
            "name": "min_len",
            "in": "query",
            "required": false,
            "description": "Min string length (default: 6, max: 1024)",
            "schema": {
              "type": "integer",
              "default": 6,
              "example": "?min_len=8"
            },
            "example": "?min_len=8"
          },
          {
            "name": "top_n",
            "in": "query",
            "required": false,
            "description": "Max strings to return (default: 100, max: 1000)",
            "schema": {
              "type": "integer",
              "default": 100,
              "example": "?top_n=50"
            },
            "example": "?top_n=50"
          },
          {
            "name": "sensitivity",
            "in": "query",
            "required": false,
            "description": "Detection sensitivity: `low`, `medium`, or `high`.",
            "schema": {
              "type": "string",
              "default": "medium"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "status": {
                      "type": "string"
                    },
                    "strings": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "value": {
                            "type": "string"
                          },
                          "entropy": {
                            "type": "number"
                          },
                          "packet_index": {
                            "type": "integer"
                          }
                        },
                        "additionalProperties": true
                      }
                    },
                    "total_strings": {
                      "type": "integer"
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap_b64": {
                    "type": "string",
                    "example": "aB3Kd...",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap_b64"
                ]
              }
            },
            "application/octet-stream": {
              "schema": {
                "type": "string",
                "format": "binary"
              }
            },
            "multipart/form-data": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap": {
                    "type": "string",
                    "format": "binary",
                    "example": "@capture.pcap",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap"
                ]
              }
            }
          }
        },
        "x-required-groups": {
          "capture-input": [
            "pcap",
            "pcap_b64"
          ]
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "status": "ok",
          "strings": [
            {
              "value": "GET /beacon HTTP/1.1",
              "entropy": 3.7842,
              "packet_index": 1
            }
          ],
          "total_strings": 30
        }
      }
    },
    "/jobs": {
      "post": {
        "summary": "Create Job",
        "description": "Submit an async analysis job for large captures without blocking the HTTP request. Returns a job ID to poll with `GET /jobs/{id}`.",
        "operationId": "network-packet-threat-analyzer_post_jobs",
        "tags": [
          "Jobs"
        ],
        "parameters": [
          {
            "name": "sensitivity",
            "in": "query",
            "required": false,
            "description": "Detection sensitivity: `low`, `medium`, or `high`.",
            "schema": {
              "type": "string",
              "default": "medium"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "poll": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "job_id": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "status": {
                      "type": "string"
                    },
                    "job_status": {
                      "description": "Dynamic source value; no concrete response example is published."
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap_b64": {
                    "type": "string",
                    "example": "aB3Kd...",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap_b64"
                ]
              }
            },
            "application/octet-stream": {
              "schema": {
                "type": "string",
                "format": "binary"
              }
            },
            "multipart/form-data": {
              "schema": {
                "type": "object",
                "properties": {
                  "pcap": {
                    "type": "string",
                    "format": "binary",
                    "example": "@capture.pcap",
                    "x-required-group": "capture-input"
                  }
                },
                "required": [
                  "pcap"
                ]
              }
            }
          }
        },
        "x-required-groups": {
          "capture-input": [
            "pcap",
            "pcap_b64"
          ]
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    },
    "/jobs/{job_id}": {
      "get": {
        "summary": "Get Job",
        "description": "Poll an async analysis job for status and results.",
        "operationId": "network-packet-threat-analyzer_get_jobs_{job_id}",
        "tags": [
          "Jobs"
        ],
        "parameters": [
          {
            "name": "job_id",
            "in": "path",
            "required": true,
            "description": "Job ID from POST /jobs",
            "schema": {
              "type": "string",
              "example": "a8838851f49f471d8356977b93aa6b78"
            },
            "example": "a8838851f49f471d8356977b93aa6b78"
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "job_id": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "status": {
                      "type": "string"
                    },
                    "created_at": {
                      "type": "string",
                      "format": "date-time"
                    },
                    "job_status": {
                      "description": "Dynamic source value; no concrete response example is published."
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    }
  },
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key"
      }
    }
  },
  "security": [
    {
      "ApiKeyAuth": []
    }
  ]
}