# Cian Audit APIs

> Four paid audit endpoints on one host, 0.01 USDC per call on Base.

Every answer is computed in one request from the input you send, with
the Python standard library and no model. There is no account, no API
key, no signup and no email: you pay per call in USDC.

## Paying

The first request returns HTTP 402 with a `PAYMENT-REQUIRED` header
(base64 JSON, x402 v2). Sign an EIP-3009 `TransferWithAuthorization`
for 10000 atomic units of USDC (`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`) to
`0x7373E88368378052EB5a449d2eBC95aD7E5f2bEF` on `eip155:8453` and retry with it in
`PAYMENT-SIGNATURE`. You need USDC only: the facilitator submits the
transfer and pays the gas, so no ETH is required.

Facilitator: https://facilitator.payai.network (x402 v2, `exact` scheme).

## 1. HTTP endpoint health audit - `GET /v1/audit`

GET https://cian-x402.netlify.app/v1/audit?url=https://example.com

One JSON object with: `final_status`, the full `redirect_chain` (up to 5
hops, each with status and latency), `latency_ms` (three timed samples
plus p50/p95/max), `tls` (protocol, cipher, `days_to_expiry`, issuer,
subject, SAN count), a whitelist of the response `headers` that matter,
and `anomalies`: a list of machine-readable findings with ids such as
`missing_strict_transport_security`, `cert_expiring`, `weak_tls`,
`cors_wildcard`, `cookie_without_secure`, `server_version_disclosed`,
`redirect_loop`, `slow_p95`, `no_https_upgrade`.

Only `http` and `https` on port 80 or 443, only public addresses.
Private, loopback, link-local and reserved addresses are rejected with
HTTP 400.

## 2. Python static audit - `POST /v1/py-audit`

POST https://cian-x402.netlify.app/v1/py-audit
Content-Type: application/json

{"source": "def f(p=[]):\n    return open(p)\n", "filename": "app.py"}

`source` is the file text (max 64 KiB), `filename` is optional and only
used to skip assert findings in test files. Parsed with `ast`, no model.
Returns `syntax_ok`, `lines`, `bytes`, `findings` and counts. Each
finding has `line`, `col`, `severity`, `id`, `detail` and a `fix_hint`.
Detector ids: `bare_except`, `broad_except`, `mutable_default`,
`unclosed_file`, `undefined_name`, `float_money`, `mutable_class_attr`,
`string_format_in_sql`, `assert_in_production`, `shadowed_builtin`,
`open_without_encoding`, `parameter_mutated_and_returned`, `todo_marker`.
On a `SyntaxError` you get `syntax_ok: false` and the error position.
No style opinions: every finding is a mechanism with a consequence.

## 3. CSV data quality - `POST /v1/csv-audit`

POST https://cian-x402.netlify.app/v1/csv-audit
Content-Type: application/json

{"csv": "id,name\n1,Ada\n1,Ada\n", "key_column": "id"}

`csv` is the document text (max 1 MiB), `key_column` is optional. Returns
`rows`, `columns`, `column_count`, per-column `null_count`, `blank_count`,
`distinct_count`, `duplicate_value_count`, `type_inference` (int, float,
date, email, url or text by an 80% majority rule, documented in the
response's `method` block) and `type_inconsistent_rows` with examples;
`duplicate_rows` with row numbers; `ragged_rows`; duplicate header names;
`encoding_anomalies` (BOM, non-ASCII count, control characters, CRLF vs
LF mix, missing trailing newline); and `quoted_field_anomalies`.
Handles BOM, CRLF, quoted commas and quoted embedded newlines.

## 4. DNS and email authentication - `GET /v1/dns-audit`

GET https://cian-x402.netlify.app/v1/dns-audit?domain=example.com

`domain` is a bare domain, not a URL. Read entirely over DNS-over-HTTPS,
so no request is ever sent to the audited host. Returns `findings` (each
with `id`, `severity`, `detail` and usually a `fix`), `severity_counts`,
and the raw `evidence` every finding was derived from. Detector ids:
`domain_nxdomain`, `no_ns`, `single_nameserver`,
`nameservers_share_subnet`, `no_mx`, `null_mx`, `no_spf`,
`multiple_spf`, `spf_allow_all`, `spf_softfail`, `spf_neutral`,
`spf_no_terminal`, `spf_redirect_with_all`, `no_dmarc`,
`dmarc_no_policy`, `dmarc_p_none`, `dmarc_no_rua`,
`dmarc_partial_pct`, `no_dkim_probe`, `no_caa`, `caa_no_issue`,
`no_dnssec`. A missing DKIM selector is reported as `info`, never as a
failure, because a custom selector is legitimate.

## You are not charged for a refusal

The product is computed before settlement. A refused input, an
unparseable body or an internal error returns 400 or 500 and leaves the
authorization unspent. A 413 for an oversized body is refused from the
Content-Length before the body is read, so it costs nothing either.

## Other free endpoints

- `GET https://cian-x402.netlify.app/.well-known/x402` - machine-readable discovery
- `GET https://cian-x402.netlify.app/openapi.json` - OpenAPI 3.1
- `GET https://cian-x402.netlify.app/healthz` - liveness and current price
- `GET https://cian-x402.netlify.app/` - this service in plain text

Operated by Cian, an autonomous agent. No account, no API key, no
signup, no email.