{
    "info": {
        "name": "SaferPage Operator API Smoke Collection",
        "_postman_id": "saferpage-no-secret-contract",
        "description": "No-Secret-Postman Collection als Dry-run-/Smoke-Vertrag mit Placeholdern. Sie enthält keine echten Keys, keine privaten Ziel-URLs, keine Empfänger und keine Servicezusage.",
        "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json",
        "version": "2026-06-14"
    },
    "item": [
        {
            "name": "Public Mini Scan Probe",
            "request": {
                "method": "GET",
                "header": [
                    {
                        "key": "Accept",
                        "value": "application/json"
                    },
                    {
                        "key": "X-SaferPage-Request-Id",
                        "value": "req_postman_contract"
                    }
                ],
                "url": {
                    "raw": "{{baseUrl}}/api/scan?url=example.de&mode=mini",
                    "host": [
                        "{{baseUrl}}"
                    ],
                    "path": [
                        "api",
                        "scan"
                    ],
                    "query": [
                        {
                            "key": "url",
                            "value": "example.de"
                        },
                        {
                            "key": "mode",
                            "value": "mini"
                        }
                    ]
                },
                "description": "Öffentlichen Mini-Check ohne Key testen; mini ist auch ohne mode der Standard. Scope: reports.public:read. No-Secret: keine echten Keys oder privaten Zielsysteme eintragen."
            },
            "event": [
                {
                    "listen": "test",
                    "script": {
                        "type": "text/javascript",
                        "exec": [
                            "const expected = [200];",
                            "pm.test(\"expected status contract\", function () {",
                            "  pm.expect(expected).to.include(pm.response.code);",
                            "});",
                            "pm.test(\"no raw secret in request\", function () {",
                            "  pm.expect(pm.request.url.toString()).to.not.include(\"sp_live_\");",
                            "});"
                        ]
                    }
                }
            ],
            "x-saferpage-id": "public_scan_probe",
            "x-saferpage-scope": "reports.public:read",
            "x-saferpage-expected-status": [
                200
            ]
        },
        {
            "name": "Full-Check Payment Gate Probe",
            "request": {
                "method": "GET",
                "header": [
                    {
                        "key": "Accept",
                        "value": "application/json"
                    },
                    {
                        "key": "X-SaferPage-Request-Id",
                        "value": "req_postman_contract"
                    }
                ],
                "url": {
                    "raw": "{{baseUrl}}/api/scan?url=example.de&mode=full",
                    "host": [
                        "{{baseUrl}}"
                    ],
                    "path": [
                        "api",
                        "scan"
                    ],
                    "query": [
                        {
                            "key": "url",
                            "value": "example.de"
                        },
                        {
                            "key": "mode",
                            "value": "full"
                        }
                    ]
                },
                "description": "Prüfen, dass ein Full-Check ohne bestätigte Zahlung nicht gestartet wird und der Checkout-Pfad zurückgegeben wird. Scope: reports.public:read. No-Secret: keine echten Keys oder privaten Zielsysteme eintragen."
            },
            "event": [
                {
                    "listen": "test",
                    "script": {
                        "type": "text/javascript",
                        "exec": [
                            "const expected = [402];",
                            "pm.test(\"expected status contract\", function () {",
                            "  pm.expect(expected).to.include(pm.response.code);",
                            "});",
                            "pm.test(\"no raw secret in request\", function () {",
                            "  pm.expect(pm.request.url.toString()).to.not.include(\"sp_live_\");",
                            "});"
                        ]
                    }
                }
            ],
            "x-saferpage-id": "public_full_scan_probe",
            "x-saferpage-scope": "reports.public:read",
            "x-saferpage-expected-status": [
                402
            ]
        },
        {
            "name": "Recent Public Reports",
            "request": {
                "method": "GET",
                "header": [
                    {
                        "key": "Accept",
                        "value": "application/json"
                    },
                    {
                        "key": "X-SaferPage-Request-Id",
                        "value": "req_postman_contract"
                    }
                ],
                "url": {
                    "raw": "{{baseUrl}}/api/recent",
                    "host": [
                        "{{baseUrl}}"
                    ],
                    "path": [
                        "api",
                        "recent"
                    ],
                    "query": []
                },
                "description": "Zuletzt geprüfte öffentliche Domains lesen. Scope: reports.public:read. No-Secret: keine echten Keys oder privaten Zielsysteme eintragen."
            },
            "event": [
                {
                    "listen": "test",
                    "script": {
                        "type": "text/javascript",
                        "exec": [
                            "const expected = [200];",
                            "pm.test(\"expected status contract\", function () {",
                            "  pm.expect(expected).to.include(pm.response.code);",
                            "});",
                            "pm.test(\"no raw secret in request\", function () {",
                            "  pm.expect(pm.request.url.toString()).to.not.include(\"sp_live_\");",
                            "});"
                        ]
                    }
                }
            ],
            "x-saferpage-id": "recent_public",
            "x-saferpage-scope": "reports.public:read",
            "x-saferpage-expected-status": [
                200
            ]
        },
        {
            "name": "Crawler Status Public",
            "request": {
                "method": "GET",
                "header": [
                    {
                        "key": "Accept",
                        "value": "application/json"
                    },
                    {
                        "key": "X-SaferPage-Request-Id",
                        "value": "req_postman_contract"
                    }
                ],
                "url": {
                    "raw": "{{baseUrl}}/api/crawler/status",
                    "host": [
                        "{{baseUrl}}"
                    ],
                    "path": [
                        "api",
                        "crawler",
                        "status"
                    ],
                    "query": []
                },
                "description": "Crawler-Transparenz für Betreiber prüfen. Scope: reports.public:read. No-Secret: keine echten Keys oder privaten Zielsysteme eintragen."
            },
            "event": [
                {
                    "listen": "test",
                    "script": {
                        "type": "text/javascript",
                        "exec": [
                            "const expected = [200];",
                            "pm.test(\"expected status contract\", function () {",
                            "  pm.expect(expected).to.include(pm.response.code);",
                            "});",
                            "pm.test(\"no raw secret in request\", function () {",
                            "  pm.expect(pm.request.url.toString()).to.not.include(\"sp_live_\");",
                            "});"
                        ]
                    }
                }
            ],
            "x-saferpage-id": "crawler_status_public",
            "x-saferpage-scope": "reports.public:read",
            "x-saferpage-expected-status": [
                200
            ]
        },
        {
            "name": "Full Report Read",
            "request": {
                "method": "GET",
                "header": [
                    {
                        "key": "Accept",
                        "value": "application/json"
                    },
                    {
                        "key": "X-SaferPage-Request-Id",
                        "value": "req_postman_contract"
                    }
                ],
                "url": {
                    "raw": "{{baseUrl}}/api/report?id=%3Cfull-scan-id%3E",
                    "host": [
                        "{{baseUrl}}"
                    ],
                    "path": [
                        "api",
                        "report"
                    ],
                    "query": [
                        {
                            "key": "id",
                            "value": "<full-scan-id>"
                        }
                    ]
                },
                "description": "Maschinenlesbaren Full-Check abrufen und Mini-Check-Exportgrenze prüfen. Scope: reports.public:read. No-Secret: keine echten Keys oder privaten Zielsysteme eintragen."
            },
            "event": [
                {
                    "listen": "test",
                    "script": {
                        "type": "text/javascript",
                        "exec": [
                            "const expected = [200,402,404];",
                            "pm.test(\"expected status contract\", function () {",
                            "  pm.expect(expected).to.include(pm.response.code);",
                            "});",
                            "pm.test(\"no raw secret in request\", function () {",
                            "  pm.expect(pm.request.url.toString()).to.not.include(\"sp_live_\");",
                            "});"
                        ]
                    }
                }
            ],
            "x-saferpage-id": "report_public_read",
            "x-saferpage-scope": "reports.public:read",
            "x-saferpage-expected-status": [
                200,
                402,
                404
            ]
        },
        {
            "name": "Operator Probe ohne Authorization",
            "request": {
                "method": "GET",
                "header": [
                    {
                        "key": "Accept",
                        "value": "application/json"
                    },
                    {
                        "key": "X-SaferPage-Request-Id",
                        "value": "req_postman_contract"
                    }
                ],
                "url": {
                    "raw": "{{baseUrl}}/api/operator/probe",
                    "host": [
                        "{{baseUrl}}"
                    ],
                    "path": [
                        "api",
                        "operator",
                        "probe"
                    ],
                    "query": []
                },
                "description": "Deny-Verhalten ohne Bearer-Key absichern. Scope: keys:rotate. No-Secret: keine echten Keys oder privaten Zielsysteme eintragen."
            },
            "event": [
                {
                    "listen": "test",
                    "script": {
                        "type": "text/javascript",
                        "exec": [
                            "const expected = [401];",
                            "pm.test(\"expected status contract\", function () {",
                            "  pm.expect(expected).to.include(pm.response.code);",
                            "});",
                            "pm.test(\"no raw secret in request\", function () {",
                            "  pm.expect(pm.request.url.toString()).to.not.include(\"sp_live_\");",
                            "});"
                        ]
                    }
                }
            ],
            "x-saferpage-id": "operator_probe_missing_auth",
            "x-saferpage-scope": "keys:rotate",
            "x-saferpage-expected-status": [
                401
            ]
        },
        {
            "name": "Operator Probe mit Bearer Placeholder",
            "request": {
                "method": "GET",
                "header": [
                    {
                        "key": "Accept",
                        "value": "application/json"
                    },
                    {
                        "key": "X-SaferPage-Request-Id",
                        "value": "req_postman_contract"
                    },
                    {
                        "key": "Authorization",
                        "value": "Bearer {{SAFERPAGE_API_KEY}}"
                    }
                ],
                "url": {
                    "raw": "{{baseUrl}}/api/operator/probe",
                    "host": [
                        "{{baseUrl}}"
                    ],
                    "path": [
                        "api",
                        "operator",
                        "probe"
                    ],
                    "query": []
                },
                "description": "Protected Contract mit serverseitig gesetztem Placeholder-Key testen. Scope: keys:rotate. No-Secret: keine echten Keys oder privaten Zielsysteme eintragen."
            },
            "event": [
                {
                    "listen": "test",
                    "script": {
                        "type": "text/javascript",
                        "exec": [
                            "const expected = [200,403];",
                            "pm.test(\"expected status contract\", function () {",
                            "  pm.expect(expected).to.include(pm.response.code);",
                            "});",
                            "pm.test(\"no raw secret in request\", function () {",
                            "  pm.expect(pm.request.url.toString()).to.not.include(\"sp_live_\");",
                            "});"
                        ]
                    }
                }
            ],
            "x-saferpage-id": "operator_probe_bearer_placeholder",
            "x-saferpage-scope": "keys:rotate",
            "x-saferpage-expected-status": [
                200,
                403
            ]
        },
        {
            "name": "Full-Check-Export mit Bearer Placeholder",
            "request": {
                "method": "GET",
                "header": [
                    {
                        "key": "Accept",
                        "value": "application/json"
                    },
                    {
                        "key": "X-SaferPage-Request-Id",
                        "value": "req_postman_contract"
                    },
                    {
                        "key": "Authorization",
                        "value": "Bearer {{SAFERPAGE_API_KEY}}"
                    }
                ],
                "url": {
                    "raw": "{{baseUrl}}/api/report/export?id=%3Cfull-scan-id%3E&format=json",
                    "host": [
                        "{{baseUrl}}"
                    ],
                    "path": [
                        "api",
                        "report",
                        "export"
                    ],
                    "query": [
                        {
                            "key": "id",
                            "value": "<full-scan-id>"
                        },
                        {
                            "key": "format",
                            "value": "json"
                        }
                    ]
                },
                "description": "Full-Check-Exportvertrag und Mini-Check-Zahlungsschranke prüfen. Scope: exports:read. No-Secret: keine echten Keys oder privaten Zielsysteme eintragen."
            },
            "event": [
                {
                    "listen": "test",
                    "script": {
                        "type": "text/javascript",
                        "exec": [
                            "const expected = [200,402,403,404];",
                            "pm.test(\"expected status contract\", function () {",
                            "  pm.expect(expected).to.include(pm.response.code);",
                            "});",
                            "pm.test(\"no raw secret in request\", function () {",
                            "  pm.expect(pm.request.url.toString()).to.not.include(\"sp_live_\");",
                            "});"
                        ]
                    }
                }
            ],
            "x-saferpage-id": "report_export_bearer_placeholder",
            "x-saferpage-scope": "exports:read",
            "x-saferpage-expected-status": [
                200,
                402,
                403,
                404
            ]
        }
    ],
    "variable": [
        {
            "key": "baseUrl",
            "value": "https://saferpage.de",
            "type": "string"
        },
        {
            "key": "SAFERPAGE_API_KEY",
            "value": "<redacted-placeholder-set-server-side>",
            "type": "secret"
        }
    ],
    "auth": {
        "type": "noauth"
    },
    "event": [
        {
            "listen": "prerequest",
            "script": {
                "type": "text/javascript",
                "exec": [
                    "pm.request.headers.upsert({ key: \"X-SaferPage-Collection\", value: \"no-secret-smoke\" });"
                ]
            }
        }
    ],
    "x-saferpage-no-secret-policy": {
        "contains_api_key_values": false,
        "uses_bearer_placeholder": true,
        "contains_private_target_urls": false,
        "contains_recipients": false,
        "contains_raw_payloads": false,
        "contains_visitor_logs": false
    },
    "x-saferpage-claim-boundary": "No-Secret-Postman Collection als Dry-run-/Smoke-Vertrag mit Placeholdern. Sie enthält keine echten Keys, keine privaten Ziel-URLs, keine Empfänger und keine Servicezusage."
}