{"openapi":"3.0.3","info":{"title":"Decoy API","version":"1.0.0","description":"Security tripwires for AI agents"},"servers":[{"url":"https://app.decoy.run"}],"paths":{"/api/signup":{"post":{"summary":"Create account","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string"}},"required":["email"]}}}},"responses":{"200":{"description":"Account created","content":{"application/json":{"schema":{"type":"object","properties":{"token":{"type":"string"},"dashboardUrl":{"type":"string"},"existing":{"type":"boolean"}}}}}}}}},"/api/triggers":{"get":{"summary":"Get triggers","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Trigger list","content":{"application/json":{"schema":{"type":"object","properties":{"count":{"type":"integer"},"triggers":{"type":"array","items":{"type":"object","properties":{"tool":{"type":"string"},"severity":{"type":"string"},"timestamp":{"type":"string"}}}}}}}}}}}},"/api/upgrade":{"post":{"summary":"Upgrade to Team plan with card payment","description":"Agent-native upgrade. Accepts card details (compatible with agentcard.sh virtual cards). Creates a Stripe subscription and upgrades the account to Team immediately.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"token":{"type":"string","description":"Your Decoy API token"},"card":{"type":"object","properties":{"number":{"type":"string"},"exp_month":{"type":"integer"},"exp_year":{"type":"integer"},"cvc":{"type":"string"}},"required":["number","exp_month","exp_year","cvc"]},"billing":{"type":"string","enum":["monthly","annually"],"default":"monthly"}},"required":["token","card"]}}}},"responses":{"200":{"description":"Upgrade successful","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean"},"plan":{"type":"string"},"subscription":{"type":"string"}}}}}}}}},"/api/billing":{"get":{"summary":"Check billing status and plan features","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Billing status","content":{"application/json":{"schema":{"type":"object","properties":{"plan":{"type":"string"},"status":{"type":"string"},"features":{"type":"object"},"upgrade":{"type":"object"}}}}}}}}},"/api/agents/{name}/profile":{"get":{"summary":"Get agent behavioral profile","parameters":[{"name":"name","in":"path","required":true,"schema":{"type":"string"}},{"name":"token","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Agent behavioral profile with risk score, tool counts, daily activity, argument patterns"}}}},"/api/risk":{"get":{"summary":"Get account risk assessment (Pro)","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Account risk assessment with per-agent scores, matched patterns, recommendations"}}}},"/api/feed":{"get":{"summary":"Threat intelligence feed (Pro+)","description":"Structured threat data: CVEs, attack patterns, MCP advisories. Filter by category, severity, source, date range. Paginated.","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}},{"name":"days","in":"query","schema":{"type":"integer","default":30}},{"name":"category","in":"query","schema":{"type":"string"}},{"name":"severity","in":"query","schema":{"type":"string"}},{"name":"page","in":"query","schema":{"type":"integer","default":1}},{"name":"limit","in":"query","schema":{"type":"integer","default":50}}],"responses":{"200":{"description":"Threat feed with pagination, attack patterns, and MCP advisories"}}}},"/api/test":{"post":{"summary":"Run security test against MCP server (Pro+)","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string","description":"Target MCP server URL"},"categories":{"type":"array","items":{"type":"string"}}},"required":["url"]}}}},"parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Test results with pass/fail per category and overall score"}}}},"/api/test/results":{"get":{"summary":"Get security test results (Pro+)","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}},{"name":"id","in":"query","schema":{"type":"string","description":"Test run ID. Omit to list all tests."}}],"responses":{"200":{"description":"Test results or test history"}}}},"/api/scan/schedule":{"post":{"summary":"Configure scan schedule (Pro+)","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"targetUrl":{"type":"string"},"frequency":{"type":"string","enum":["daily","weekly"]},"enabled":{"type":"boolean"}},"required":["targetUrl","frequency"]}}}},"parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Scan schedule configuration"}}}},"/api/discovery":{"get":{"summary":"List discovered MCP servers (Pro+)","description":"Shadow MCP discovery — shows all MCP servers reported by agents, with risk status flags.","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"List of discovered servers with status counts"}}},"patch":{"summary":"Update discovered server status (Pro+)","description":"Vet, flag, or reset a discovered MCP server's status.","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"},"command":{"type":"string"},"url":{"type":"string"},"status":{"type":"string","enum":["vetted","flagged","unknown"]}},"required":["status"]}}}},"responses":{"200":{"description":"Updated server entry"}}}},"/api/compliance/report":{"get":{"summary":"OWASP Agentic Top 10 compliance report (Business+)","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}},{"name":"format","in":"query","schema":{"type":"string","enum":["json","html"]}}],"responses":{"200":{"description":"Compliance report with per-control pass/fail status"}}}},"/api/integrations":{"patch":{"summary":"Configure gateway integrations (Business+)","parameters":[{"name":"token","in":"query","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"auth0":{"type":"object"},"runlayer":{"type":"object"},"pagerduty":{"type":"object"}}}}}},"responses":{"200":{"description":"Updated integration configuration"}}}},"/monitor/patterns":{"get":{"summary":"Attack pattern corpus (public)","responses":{"200":{"description":"Anonymized attack patterns aggregated across all Decoy deployments"}}}},"/monitor/mcp":{"get":{"summary":"MCP supply chain advisories (public)","responses":{"200":{"description":"Security advisories affecting MCP server packages and AI agent frameworks"}}}},"/mcp/{token}":{"post":{"summary":"MCP honeypot endpoint","parameters":[{"name":"token","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"description":"MCP JSON-RPC response"}}}}}}