{
    "openapi": "3.1.0",
    "info": {
        "title": "SaferPage Operator API",
        "version": "2026-06-14",
        "description": "No-Secret OpenAPI-Vertrag für öffentliche und geschützte SaferPage-API-Flächen. Produktive Keys, Servicezusage und Write-Live bleiben Go-live-Gates."
    },
    "servers": [
        {
            "url": "https://saferpage.de",
            "description": "SaferPage Produktion"
        }
    ],
    "paths": {
        "/api/scan": {
            "get": {
                "summary": "Kostenlosen Mini-Check starten. mode=full ist zahlungspflichtig und wird auf den Checkout verwiesen.",
                "operationId": "get__api_scan",
                "tags": [
                    "SaferPage API"
                ],
                "security": [],
                "parameters": [
                    {
                        "name": "X-SaferPage-Request-Id",
                        "in": "header",
                        "required": false,
                        "schema": {
                            "type": "string",
                            "maxLength": 120
                        },
                        "description": "Optionale clientseitige Request-ID für Audit und Support."
                    }
                ],
                "responses": {
                    "200": {
                        "description": "Erfolgreiche SaferPage-Antwort.",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/SaferPageResponse"
                                }
                            }
                        }
                    },
                    "401": {
                        "$ref": "#/components/responses/Unauthorized"
                    },
                    "403": {
                        "$ref": "#/components/responses/Forbidden"
                    },
                    "429": {
                        "$ref": "#/components/responses/RateLimited"
                    }
                },
                "x-saferpage-scope": "reports.public:read",
                "x-saferpage-claim-boundary": "Vertrag ohne produktive Key-Ausgabe, Servicezusage oder Write-Live-Freigabe."
            }
        },
        "/api/recent": {
            "get": {
                "summary": "Zuletzt geprüfte öffentliche Domains lesen.",
                "operationId": "get__api_recent",
                "tags": [
                    "SaferPage API"
                ],
                "security": [],
                "parameters": [
                    {
                        "name": "X-SaferPage-Request-Id",
                        "in": "header",
                        "required": false,
                        "schema": {
                            "type": "string",
                            "maxLength": 120
                        },
                        "description": "Optionale clientseitige Request-ID für Audit und Support."
                    }
                ],
                "responses": {
                    "200": {
                        "description": "Erfolgreiche SaferPage-Antwort.",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/SaferPageResponse"
                                }
                            }
                        }
                    },
                    "401": {
                        "$ref": "#/components/responses/Unauthorized"
                    },
                    "403": {
                        "$ref": "#/components/responses/Forbidden"
                    },
                    "429": {
                        "$ref": "#/components/responses/RateLimited"
                    }
                },
                "x-saferpage-scope": "reports.public:read",
                "x-saferpage-claim-boundary": "Vertrag ohne produktive Key-Ausgabe, Servicezusage oder Write-Live-Freigabe."
            }
        },
        "/api/crawler/status": {
            "get": {
                "summary": "Öffentlichen Crawler-Status lesen.",
                "operationId": "get__api_crawler_status",
                "tags": [
                    "SaferPage API"
                ],
                "security": [],
                "parameters": [
                    {
                        "name": "X-SaferPage-Request-Id",
                        "in": "header",
                        "required": false,
                        "schema": {
                            "type": "string",
                            "maxLength": 120
                        },
                        "description": "Optionale clientseitige Request-ID für Audit und Support."
                    }
                ],
                "responses": {
                    "200": {
                        "description": "Erfolgreiche SaferPage-Antwort.",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/SaferPageResponse"
                                }
                            }
                        }
                    },
                    "401": {
                        "$ref": "#/components/responses/Unauthorized"
                    },
                    "403": {
                        "$ref": "#/components/responses/Forbidden"
                    },
                    "429": {
                        "$ref": "#/components/responses/RateLimited"
                    }
                },
                "x-saferpage-scope": "reports.public:read",
                "x-saferpage-claim-boundary": "Vertrag ohne produktive Key-Ausgabe, Servicezusage oder Write-Live-Freigabe."
            }
        },
        "/api/report": {
            "get": {
                "summary": "Maschinenlesbaren Report eines Full-Checks lesen; Mini-Checks liefern HTTP 402.",
                "operationId": "get__api_report",
                "tags": [
                    "SaferPage API"
                ],
                "security": [],
                "parameters": [
                    {
                        "name": "X-SaferPage-Request-Id",
                        "in": "header",
                        "required": false,
                        "schema": {
                            "type": "string",
                            "maxLength": 120
                        },
                        "description": "Optionale clientseitige Request-ID für Audit und Support."
                    }
                ],
                "responses": {
                    "200": {
                        "description": "Erfolgreiche SaferPage-Antwort.",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/SaferPageResponse"
                                }
                            }
                        }
                    },
                    "401": {
                        "$ref": "#/components/responses/Unauthorized"
                    },
                    "403": {
                        "$ref": "#/components/responses/Forbidden"
                    },
                    "429": {
                        "$ref": "#/components/responses/RateLimited"
                    }
                },
                "x-saferpage-scope": "reports.public:read",
                "x-saferpage-claim-boundary": "Vertrag ohne produktive Key-Ausgabe, Servicezusage oder Write-Live-Freigabe."
            }
        },
        "/api/report/export": {
            "get": {
                "summary": "Full-Check-Export im freigegebenen Format abrufen; Mini-Checks sind nicht exportierbar.",
                "operationId": "get__api_report_export",
                "tags": [
                    "SaferPage API"
                ],
                "security": [
                    {
                        "BearerAuth": [
                            "exports:read"
                        ]
                    }
                ],
                "parameters": [
                    {
                        "name": "X-SaferPage-Request-Id",
                        "in": "header",
                        "required": false,
                        "schema": {
                            "type": "string",
                            "maxLength": 120
                        },
                        "description": "Optionale clientseitige Request-ID für Audit und Support."
                    }
                ],
                "responses": {
                    "200": {
                        "description": "Erfolgreiche SaferPage-Antwort.",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/SaferPageResponse"
                                }
                            }
                        }
                    },
                    "401": {
                        "$ref": "#/components/responses/Unauthorized"
                    },
                    "403": {
                        "$ref": "#/components/responses/Forbidden"
                    },
                    "429": {
                        "$ref": "#/components/responses/RateLimited"
                    }
                },
                "x-saferpage-scope": "exports:read",
                "x-saferpage-claim-boundary": "Vertrag ohne produktive Key-Ausgabe, Servicezusage oder Write-Live-Freigabe."
            }
        },
        "/api/operator/probe": {
            "get": {
                "summary": "Operator-API-Gate, Deny-Verhalten und Audit-Evidence prüfen.",
                "operationId": "get__api_operator_probe",
                "tags": [
                    "SaferPage API"
                ],
                "security": [
                    {
                        "BearerAuth": [
                            "keys:rotate"
                        ]
                    }
                ],
                "parameters": [
                    {
                        "name": "X-SaferPage-Request-Id",
                        "in": "header",
                        "required": false,
                        "schema": {
                            "type": "string",
                            "maxLength": 120
                        },
                        "description": "Optionale clientseitige Request-ID für Audit und Support."
                    }
                ],
                "responses": {
                    "200": {
                        "description": "Erfolgreiche SaferPage-Antwort.",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/SaferPageResponse"
                                }
                            }
                        }
                    },
                    "401": {
                        "$ref": "#/components/responses/Unauthorized"
                    },
                    "403": {
                        "$ref": "#/components/responses/Forbidden"
                    },
                    "429": {
                        "$ref": "#/components/responses/RateLimited"
                    }
                },
                "x-saferpage-scope": "keys:rotate",
                "x-saferpage-claim-boundary": "Vertrag ohne produktive Key-Ausgabe, Servicezusage oder Write-Live-Freigabe."
            }
        }
    },
    "components": {
        "securitySchemes": {
            "BearerAuth": {
                "type": "http",
                "scheme": "bearer",
                "bearerFormat": "opaque API key",
                "description": "Produktive Keys werden nicht öffentlich ausgegeben und gehoeren nie in Querystrings, HTML oder Public-Exports."
            }
        },
        "schemas": {
            "SaferPageResponse": {
                "type": "object",
                "additionalProperties": true,
                "description": "Sanitisierte SaferPage-Antwort. Struktur hängt vom Endpoint und freigegebenen Scope ab."
            },
            "ErrorResponse": {
                "type": "object",
                "required": [
                    "error",
                    "message"
                ],
                "properties": {
                    "error": {
                        "type": "string"
                    },
                    "message": {
                        "type": "string"
                    }
                }
            }
        },
        "responses": {
            "Unauthorized": {
                "description": "Bearer-Key fehlt oder ist ungültig.",
                "content": {
                    "application/json": {
                        "schema": {
                            "$ref": "#/components/schemas/ErrorResponse"
                        }
                    }
                }
            },
            "Forbidden": {
                "description": "Scope, Domain-Claim oder Runtime-Gate erlaubt den Zugriff nicht.",
                "content": {
                    "application/json": {
                        "schema": {
                            "$ref": "#/components/schemas/ErrorResponse"
                        }
                    }
                }
            },
            "RateLimited": {
                "description": "Rate-Limit erreicht; Retry-After beachten.",
                "content": {
                    "application/json": {
                        "schema": {
                            "$ref": "#/components/schemas/ErrorResponse"
                        }
                    }
                }
            }
        }
    },
    "x-saferpage-no-secret-policy": {
        "contains_api_key_values": false,
        "contains_private_target_urls": false,
        "contains_recipients": false,
        "contains_raw_payloads": false,
        "contains_visitor_logs": false
    },
    "x-saferpage-claim-boundary": "OpenAPI beschreibt öffentliche und geschützte Vertragsflächen, stellt aber keine produktiven API-Keys und keine Servicezusage bereit."
}