{
  "openapi": "3.1.0",
  "info": {
    "title": "SQL Injection / XSS Payload Detector API",
    "version": "v0.0.2",
    "description": "Detect SQLi/XSS patterns, inspect encoded payloads and URLs, audit headers and scan inputs in batches.",
    "x-pricing-model": "payg",
    "x-free-tier-calls": 0,
    "x-docs-url": "",
    "x-dakidarts-contract-status": "published",
    "x-dakidarts-execution-status": "source-only"
  },
  "servers": [
    {
      "url": "https://api.dakidarts.com/sqli-xss-detector",
      "description": "Dakidarts direct gateway"
    }
  ],
  "tags": [
    {
      "name": "Operations",
      "description": "Operations endpoints sourced from the SQL Injection / XSS Payload Detector API implementation."
    },
    {
      "name": "Analysis",
      "description": "Analysis endpoints sourced from the SQL Injection / XSS Payload Detector API implementation."
    },
    {
      "name": "Batch operations",
      "description": "Batch operations endpoints sourced from the SQL Injection / XSS Payload Detector API implementation."
    },
    {
      "name": "Payloads",
      "description": "Payloads endpoints sourced from the SQL Injection / XSS Payload Detector API implementation."
    },
    {
      "name": "Utilities",
      "description": "Utilities endpoints sourced from the SQL Injection / XSS Payload Detector API implementation."
    }
  ],
  "paths": {
    "/": {
      "get": {
        "summary": "Index",
        "description": "Service banner.",
        "operationId": "sqli-xss-detector_get_root",
        "tags": [
          "Operations"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    },
    "/status": {
      "get": {
        "summary": "Health",
        "description": "Health + version check. `200 OK`.",
        "operationId": "sqli-xss-detector_get_status",
        "tags": [
          "Operations"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    },
    "/meta": {
      "get": {
        "summary": "Meta",
        "description": "API metadata: version, description, full endpoint listing, BYOK headers.",
        "operationId": "sqli-xss-detector_get_meta",
        "tags": [
          "Operations"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    },
    "/detect": {
      "get": {
        "summary": "Detect",
        "description": "Detect the risk of a user input string or payload across all 10 attack categories.",
        "operationId": "sqli-xss-detector_get_detect",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "input",
            "in": "query",
            "required": true,
            "description": "Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Detect",
        "description": "Detect the risk of a user input string or payload across all 10 attack categories.",
        "operationId": "sqli-xss-detector_post_detect",
        "tags": [
          "Analysis"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "risk": "exploit attempt",
                    "input": "' OR 1=1--",
                    "score": 60,
                    "matches": [
                      {
                        "label": "boolean-based tautology",
                        "weight": 20,
                        "category": "sqli",
                        "evidence": "or 1=1"
                      },
                      {
                        "label": "SQL string terminator",
                        "weight": 10,
                        "category": "sqli",
                        "evidence": "'"
                      },
                      {
                        "label": "encoded / obfuscated payload",
                        "weight": 10,
                        "category": "obfuscation",
                        "evidence": ""
                      }
                    ],
                    "severity": "high",
                    "categories": {
                      "xss": false,
                      "sqli": true,
                      "ssti": false,
                      "open_redirect": false,
                      "crlf_injection": false,
                      "ldap_injection": false,
                      "path_traversal": false,
                      "nosql_injection": false,
                      "command_injection": false,
                      "formula_injection": false
                    },
                    "was_obfuscated": false,
                    "encoding_layers": [],
                    "recommendations": [
                      "Use parameterized queries / prepared statements. Never concatenate user input into SQL. Apply least-privilege DB accounts."
                    ],
                    "matched_keywords": []
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "risk": "exploit attempt",
          "input": "' OR 1=1--",
          "score": 60,
          "matches": [
            {
              "label": "boolean-based tautology",
              "weight": 20,
              "category": "sqli",
              "evidence": "or 1=1"
            },
            {
              "label": "SQL string terminator",
              "weight": 10,
              "category": "sqli",
              "evidence": "'"
            },
            {
              "label": "encoded / obfuscated payload",
              "weight": 10,
              "category": "obfuscation",
              "evidence": ""
            }
          ],
          "severity": "high",
          "categories": {
            "xss": false,
            "sqli": true,
            "ssti": false,
            "open_redirect": false,
            "crlf_injection": false,
            "ldap_injection": false,
            "path_traversal": false,
            "nosql_injection": false,
            "command_injection": false,
            "formula_injection": false
          },
          "was_obfuscated": false,
          "encoding_layers": [],
          "recommendations": [
            "Use parameterized queries / prepared statements. Never concatenate user input into SQL. Apply least-privilege DB accounts."
          ],
          "matched_keywords": []
        }
      }
    },
    "/detect/sqli": {
      "get": {
        "summary": "Detect Sqli",
        "description": "Detect SQL injection only: quotes, boolean tautologies, UNION-based, time-based, error-based, stacked queries, and file read/write attempts.",
        "operationId": "sqli-xss-detector_get_detect_sqli",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "input",
            "in": "query",
            "required": true,
            "description": "Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Detect Sqli",
        "description": "Detect SQL injection only: quotes, boolean tautologies, UNION-based, time-based, error-based, stacked queries, and file read/write attempts.",
        "operationId": "sqli-xss-detector_post_detect_sqli",
        "tags": [
          "Analysis"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "risk": "exploit attempt",
                    "input": "1' UNION SELECT @@version--",
                    "score": 85,
                    "matches": [
                      {
                        "label": "UNION-based injection",
                        "weight": 30,
                        "category": "sqli",
                        "evidence": "union select"
                      },
                      {
                        "label": "SQL string terminator",
                        "weight": 10,
                        "category": "sqli",
                        "evidence": "'"
                      }
                    ],
                    "category": "sqli",
                    "severity": "critical",
                    "was_obfuscated": false,
                    "encoding_layers": []
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "risk": "exploit attempt",
          "input": "1' UNION SELECT @@version--",
          "score": 85,
          "matches": [
            {
              "label": "UNION-based injection",
              "weight": 30,
              "category": "sqli",
              "evidence": "union select"
            },
            {
              "label": "SQL string terminator",
              "weight": 10,
              "category": "sqli",
              "evidence": "'"
            }
          ],
          "category": "sqli",
          "severity": "critical",
          "was_obfuscated": false,
          "encoding_layers": []
        }
      }
    },
    "/detect/xss": {
      "get": {
        "summary": "Detect Xss",
        "description": "Detect cross-site scripting only: script tags, inline event handlers, `javascript:` URIs, dangerous HTML tags, and JS sinks.",
        "operationId": "sqli-xss-detector_get_detect_xss",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "input",
            "in": "query",
            "required": true,
            "description": "Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "risk": "exploit attempt",
                    "input": "<svg/onload=alert(1)>",
                    "score": 70,
                    "matches": [
                      {
                        "label": "script tag injection",
                        "weight": 25,
                        "category": "xss",
                        "evidence": "<svg/onload"
                      },
                      {
                        "label": "malicious JS sink",
                        "weight": 25,
                        "category": "xss",
                        "evidence": "alert("
                      }
                    ],
                    "category": "xss",
                    "severity": "high",
                    "was_obfuscated": false,
                    "encoding_layers": []
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "risk": "exploit attempt",
          "input": "<svg/onload=alert(1)>",
          "score": 70,
          "matches": [
            {
              "label": "script tag injection",
              "weight": 25,
              "category": "xss",
              "evidence": "<svg/onload"
            },
            {
              "label": "malicious JS sink",
              "weight": 25,
              "category": "xss",
              "evidence": "alert("
            }
          ],
          "category": "xss",
          "severity": "high",
          "was_obfuscated": false,
          "encoding_layers": []
        }
      },
      "post": {
        "summary": "Detect Xss",
        "description": "Detect cross-site scripting only: script tags, inline event handlers, `javascript:` URIs, dangerous HTML tags, and JS sinks.",
        "operationId": "sqli-xss-detector_post_detect_xss",
        "tags": [
          "Analysis"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    },
    "/detect/batch": {
      "get": {
        "summary": "Detect Batch",
        "description": "Scan up to **100 inputs** in a single call. Each input is scanned independently; per-input results are returned in order.",
        "operationId": "sqli-xss-detector_get_detect_batch",
        "tags": [
          "Batch operations"
        ],
        "parameters": [
          {
            "name": "input",
            "in": "query",
            "required": true,
            "description": "Up to 100 input strings. POST JSON uses an `inputs` array; GET accepts repeated `input` query values.",
            "schema": {
              "type": "string",
              "example": "SELECT * FROM users"
            },
            "example": "SELECT * FROM users"
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "count": {
                      "type": "integer"
                    },
                    "errors": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "error": {
                            "type": "string"
                          },
                          "input": {}
                        },
                        "additionalProperties": true
                      }
                    },
                    "results": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {},
                        "additionalProperties": true
                      }
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Detect Batch",
        "description": "Scan up to **100 inputs** in a single call. Each input is scanned independently; per-input results are returned in order.",
        "operationId": "sqli-xss-detector_post_detect_batch",
        "tags": [
          "Batch operations"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "count": {
                      "type": "integer"
                    },
                    "errors": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "error": {
                            "type": "string"
                          },
                          "input": {}
                        },
                        "additionalProperties": true
                      }
                    },
                    "results": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {},
                        "additionalProperties": true
                      }
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "inputs": {
                    "type": "array",
                    "example": [
                      "SELECT * FROM users"
                    ],
                    "items": {
                      "type": "string"
                    }
                  }
                },
                "required": [
                  "inputs"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "count": 4,
          "errors": [],
          "results": [
            {
              "risk": "exploit attempt",
              "input": "' OR 1=1--",
              "score": 60
            },
            {
              "risk": "exploit attempt",
              "input": "<script>alert(1)</script>",
              "score": 100
            },
            {
              "risk": "safe",
              "input": "safe text",
              "score": 0
            },
            {
              "risk": "exploit attempt",
              "input": "../../etc/passwd",
              "score": 80
            }
          ]
        }
      }
    },
    "/analyze": {
      "get": {
        "summary": "Analyze",
        "description": "Full detection plus forensic analysis: decoded value, encoding layers, Shannon entropy, printable-character ratio, and non-ASCII characters. Perfect for WAF log review and threat triage.",
        "operationId": "sqli-xss-detector_get_analyze",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "input",
            "in": "query",
            "required": true,
            "description": "Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Analyze",
        "description": "Full detection plus forensic analysis: decoded value, encoding layers, Shannon entropy, printable-character ratio, and non-ASCII characters. Perfect for WAF log review and threat triage.",
        "operationId": "sqli-xss-detector_post_analyze",
        "tags": [
          "Analysis"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "risk": "exploit attempt",
                    "input": "%3Cscript%3Ealert(1)%3C%2Fscript%3E",
                    "score": 70,
                    "matches": [
                      {
                        "label": "script tag injection",
                        "weight": 30,
                        "category": "xss",
                        "evidence": "<script>"
                      }
                    ],
                    "analysis": {
                      "entropy": 3.783,
                      "decoded_value": "<script>alert(1)</script>",
                      "decoded_length": 21,
                      "non_ascii_chars": [],
                      "original_length": 33,
                      "printable_ratio": 1.0
                    },
                    "severity": "high",
                    "categories": {
                      "xss": true
                    },
                    "was_obfuscated": true,
                    "encoding_layers": [
                      "url"
                    ],
                    "recommendations": [
                      "Context-aware output encoding, strict Content-Security-Policy, and sanitize untrusted HTML server-side."
                    ]
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "risk": "exploit attempt",
          "input": "%3Cscript%3Ealert(1)%3C%2Fscript%3E",
          "score": 70,
          "matches": [
            {
              "label": "script tag injection",
              "weight": 30,
              "category": "xss",
              "evidence": "<script>"
            }
          ],
          "analysis": {
            "entropy": 3.783,
            "decoded_value": "<script>alert(1)</script>",
            "decoded_length": 21,
            "non_ascii_chars": [],
            "original_length": 33,
            "printable_ratio": 1.0
          },
          "severity": "high",
          "categories": {
            "xss": true
          },
          "was_obfuscated": true,
          "encoding_layers": [
            "url"
          ],
          "recommendations": [
            "Context-aware output encoding, strict Content-Security-Policy, and sanitize untrusted HTML server-side."
          ]
        }
      }
    },
    "/analyze/url": {
      "get": {
        "summary": "Analyze Url",
        "description": "Analyze a URL locally (open redirect, path traversal, CRLF injection, scheme checks) and optionally query external threat-intel providers using **your own keys**. If a key is omitted, that provider is simply skipped \u2014 the call never fails.",
        "operationId": "sqli-xss-detector_get_analyze_url",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "X-GSB-Key",
            "in": "header",
            "required": false,
            "description": "Optional Google Safe Browsing API key for external URL reputation checks (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "X-Virustotal-Key",
            "in": "header",
            "required": false,
            "description": "Optional VirusTotal API key for external URL reputation checks (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "input",
            "in": "query",
            "required": true,
            "description": "Input string to inspect or transform (maximum 10,000 characters); POST also accepts form data, and GET accepts this as a query parameter.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Analyze Url",
        "description": "Analyze a URL locally (open redirect, path traversal, CRLF injection, scheme checks) and optionally query external threat-intel providers using **your own keys**. If a key is omitted, that provider is simply skipped \u2014 the call never fails.",
        "operationId": "sqli-xss-detector_post_analyze_url",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "X-GSB-Key",
            "in": "header",
            "required": false,
            "description": "Optional Google Safe Browsing API key for external URL reputation checks (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "X-Virustotal-Key",
            "in": "header",
            "required": false,
            "description": "Optional VirusTotal API key for external URL reputation checks (BYOK).",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "host": "example.com",
                    "note": "External checks only run when X-GSB-Key / X-Virustotal-Key headers are supplied (BYOK).",
                    "path": "/redirect",
                    "risk": "suspicious",
                    "input": "https://example.com/redirect?url=//evil.com",
                    "query": "url=//evil.com",
                    "score": 40,
                    "scheme": "https",
                    "external": {
                      "virustotal": {
                        "url": "https://example.com/redirect?url=//evil.com",
                        "stats": {
                          "timeout": 0,
                          "harmless": 60,
                          "malicious": 0,
                          "suspicious": 0,
                          "undetected": 10
                        },
                        "status": "ok",
                        "service": "virustotal",
                        "malicious": 0,
                        "reputation": -7
                      },
                      "google_safe_browsing": {
                        "status": "ok",
                        "matches": [],
                        "service": "google_safe_browsing",
                        "threat_found": false
                      }
                    },
                    "findings": [
                      {
                        "label": "redirect parameter",
                        "weight": 25,
                        "evidence": "url=//evil.com"
                      }
                    ],
                    "severity": "medium",
                    "was_obfuscated": false,
                    "encoding_layers": []
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "host": "example.com",
          "note": "External checks only run when X-GSB-Key / X-Virustotal-Key headers are supplied (BYOK).",
          "path": "/redirect",
          "risk": "suspicious",
          "input": "https://example.com/redirect?url=//evil.com",
          "query": "url=//evil.com",
          "score": 40,
          "scheme": "https",
          "external": {
            "virustotal": {
              "url": "https://example.com/redirect?url=//evil.com",
              "stats": {
                "timeout": 0,
                "harmless": 60,
                "malicious": 0,
                "suspicious": 0,
                "undetected": 10
              },
              "status": "ok",
              "service": "virustotal",
              "malicious": 0,
              "reputation": -7
            },
            "google_safe_browsing": {
              "status": "ok",
              "matches": [],
              "service": "google_safe_browsing",
              "threat_found": false
            }
          },
          "findings": [
            {
              "label": "redirect parameter",
              "weight": 25,
              "evidence": "url=//evil.com"
            }
          ],
          "severity": "medium",
          "was_obfuscated": false,
          "encoding_layers": []
        }
      }
    },
    "/scan/headers": {
      "get": {
        "summary": "Scan Headers",
        "description": "Audit a set of HTTP response headers. Reports missing security headers (CSP, HSTS, X-Frame-Options, etc.) and any CRLF/header-injection evidence.",
        "operationId": "sqli-xss-detector_get_scan_headers",
        "tags": [
          "Analysis"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "headers": {
                      "type": "object",
                      "properties": {
                        "header-name": {
                          "type": "string"
                        }
                      },
                      "additionalProperties": true
                    },
                    "injection_found": {
                      "type": "object",
                      "properties": {
                        "header-name": {
                          "type": "object",
                          "properties": {
                            "type": {
                              "type": "string"
                            },
                            "evidence": {
                              "type": "string"
                            }
                          },
                          "additionalProperties": true
                        }
                      },
                      "additionalProperties": true
                    },
                    "recommendations": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "missing_security_headers": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "security_headers_present": {
                      "type": "object",
                      "properties": {
                        "header-name": {
                          "type": "string"
                        }
                      },
                      "additionalProperties": true
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Scan Headers",
        "description": "Audit a set of HTTP response headers. Reports missing security headers (CSP, HSTS, X-Frame-Options, etc.) and any CRLF/header-injection evidence.",
        "operationId": "sqli-xss-detector_post_scan_headers",
        "tags": [
          "Analysis"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "headers": {
                      "type": "object",
                      "properties": {
                        "header-name": {
                          "type": "string"
                        }
                      },
                      "additionalProperties": true
                    },
                    "injection_found": {
                      "type": "object",
                      "properties": {
                        "header-name": {
                          "type": "object",
                          "properties": {
                            "type": {
                              "type": "string"
                            },
                            "evidence": {
                              "type": "string"
                            }
                          },
                          "additionalProperties": true
                        }
                      },
                      "additionalProperties": true
                    },
                    "recommendations": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "missing_security_headers": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "security_headers_present": {
                      "type": "object",
                      "properties": {
                        "header-name": {
                          "type": "string"
                        }
                      },
                      "additionalProperties": true
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": false,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "headers": {
                    "type": "object",
                    "example": {
                      "X-Frame-Options": "DENY"
                    }
                  }
                }
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "headers": {
            "set-cookie": "sid=abc; HttpOnly",
            "x-frame-options": "DENY",
            "content-security-policy": "default-src 'self'"
          },
          "injection_found": {},
          "recommendations": [
            "Missing security headers: Strict-Transport-Security, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy"
          ],
          "missing_security_headers": [
            "Strict-Transport-Security",
            "X-Content-Type-Options",
            "X-XSS-Protection",
            "Referrer-Policy",
            "Permissions-Policy",
            "Cross-Origin-Opener-Policy",
            "Cross-Origin-Resource-Policy"
          ],
          "security_headers_present": {
            "X-Frame-Options": "DENY",
            "Content-Security-Policy": "default-src 'self'"
          }
        }
      }
    },
    "/payloads": {
      "get": {
        "summary": "Payloads",
        "description": "Return embedded example payloads grouped by attack category. Great for testing the API or building lab environments.",
        "operationId": "sqli-xss-detector_get_payloads",
        "tags": [
          "Payloads"
        ],
        "parameters": [
          {
            "name": "category",
            "in": "query",
            "required": false,
            "description": "Optional payload category filter; omit to return all categories.",
            "schema": {
              "type": "string",
              "default": ""
            }
          },
          {
            "name": "limit",
            "in": "query",
            "required": false,
            "description": "Maximum payloads returned per category (defaults to 100).",
            "schema": {
              "type": "integer",
              "default": 100
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "count": {
                      "type": "integer"
                    },
                    "limit": {
                      "type": "integer"
                    },
                    "categories": {
                      "type": "object",
                      "additionalProperties": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      }
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "count": 3,
          "limit": 3,
          "categories": {
            "xss": [
              "<script>alert(1)</script>",
              "<img src=x onerror=alert(1)>",
              "<svg/onload=alert(1)>"
            ]
          }
        }
      }
    },
    "/utilities/encode": {
      "get": {
        "summary": "Encode Util",
        "description": "Encode any text into Base64, URL-encoded, hex, and/or unicode-escape forms. Useful for building obfuscated test payloads.",
        "operationId": "sqli-xss-detector_get_utilities_encode",
        "tags": [
          "Utilities"
        ],
        "parameters": [
          {
            "name": "input",
            "in": "query",
            "required": true,
            "description": "Text to encode (maximum 10,000 characters).",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "input": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "encodings": {
                      "type": "object",
                      "additionalProperties": true
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Encode Util",
        "description": "Encode any text into Base64, URL-encoded, hex, and/or unicode-escape forms. Useful for building obfuscated test payloads.",
        "operationId": "sqli-xss-detector_post_utilities_encode",
        "tags": [
          "Utilities"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "input": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "encodings": {
                      "type": "object",
                      "additionalProperties": true
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  },
                  "encodings": {
                    "type": "array",
                    "default": [
                      "base64",
                      "url",
                      "hex",
                      "unicode"
                    ],
                    "items": {
                      "type": "string"
                    }
                  }
                },
                "required": [
                  "input"
                ]
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "input": "hello",
          "encodings": {
            "hex": "0x68656c6c6f",
            "url": "hello",
            "base64": "aGVsbG8=",
            "unicode": "\\u0068\\u0065\\u006c\\u006c\\u006f"
          }
        }
      }
    },
    "/utilities/decode": {
      "get": {
        "summary": "Decode Util",
        "description": "Automatically decode obfuscated input. Iteratively applies URL, HTML-entity, unicode-escape, hex, and Base64 decoders (up to 6 layers) and reports which encodings were detected.",
        "operationId": "sqli-xss-detector_get_utilities_decode",
        "tags": [
          "Utilities"
        ],
        "parameters": [
          {
            "name": "input",
            "in": "query",
            "required": true,
            "description": "Encoded string to decode (maximum 10,000 characters).",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "input": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "decoded": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "was_obfuscated": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "encoding_layers": {
                      "description": "Dynamic source value; no concrete response example is published."
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Decode Util",
        "description": "Automatically decode obfuscated input. Iteratively applies URL, HTML-entity, unicode-escape, hex, and Base64 decoders (up to 6 layers) and reports which encodings were detected.",
        "operationId": "sqli-xss-detector_post_utilities_decode",
        "tags": [
          "Utilities"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "input": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "decoded": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "was_obfuscated": {
                      "description": "Dynamic source value; no concrete response example is published."
                    },
                    "encoding_layers": {
                      "description": "Dynamic source value; no concrete response example is published."
                    }
                  },
                  "additionalProperties": true
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "input": {
                    "type": "string"
                  }
                },
                "required": [
                  "input"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "input": "aGVsbG8=",
          "decoded": "hello",
          "was_obfuscated": true,
          "encoding_layers": [
            "base64"
          ]
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key"
      }
    }
  },
  "security": [
    {
      "ApiKeyAuth": []
    }
  ]
}