{"version":"1.1.2","endpoint":"POST /api/v1/generate-baseline","report_endpoints":["POST /api/v1/report.md","POST /api/v1/report.pdf","GET /api/v1/report.{md,pdf}?profile=<base64url JSON body>"],"request":{"title":"GenerateBaselineRequest","type":"object","properties":{"data_classifications":{"type":"array","items":{"type":"string","enum":["PUBLIC","CREDENTIALS","PROTECTED_A","PROTECTED_B","FINANCIAL_TAX"]},"minItems":1},"app_archetypes":{"anyOf":[{"type":"array","items":{"type":"string","enum":["WEB_PORTAL","MOBILE_BACKEND","AI_GENAI_PORTAL","API_TO_API"]}},{"type":"null"}],"minItems":1,"description":"One or more archetypes the application combines (e.g. a web portal with an AI chatbot).","default":null},"app_archetype":{"anyOf":[{"type":"string","enum":["WEB_PORTAL","MOBILE_BACKEND","AI_GENAI_PORTAL","API_TO_API"]},{"type":"null"}],"deprecated":true,"description":"Single archetype (original contract). Give this or app_archetypes, not both.","default":null},"crs_version":{"type":"string","enum":["v4.0","v3.3"],"default":"v4.0"},"paranoia_override":{"anyOf":[{"type":"integer"},{"type":"null"}],"minimum":1,"maximum":4,"default":null},"mfa_required":{"type":"boolean","description":"MFA is mandatory on every login path. Items it neutralises (credential cracking and stuffing) are scored not applicable (mitigated by MFA); items it only reduces are highlighted.","default":false},"mfa_phishing_resistant":{"type":"boolean","description":"MFA uses phishing-resistant FIDO2 / WebAuthn credentials held in secure hardware: security keys (e.g. YubiKey) or passkeys in a device secure enclave / TPM. Implies mfa_required; adds the items phishing-resistant MFA reduces.","default":false},"threat_profiles":{"anyOf":[{"type":"array","items":{"type":"string","enum":["OWASP_TOP10_2025","OWASP_TOP10_2021","OWASP_API_2023","OWASP_LLM_2025","OWASP_LLM_2023","OWASP_MOBILE_2024","OWASP_AUTOMATED_THREATS"]}},{"type":"null"}],"description":"Specialized threat profiles. Defaults to the archetype's profiles.","default":null},"vendors":{"anyOf":[{"type":"array","items":{"type":"string","enum":["CADDY_CORAZA","APACHE_MODSECURITY","AWS_WAF","AZURE_WAF","F5_ADVANCED_WAF","ALTCHA","RECAPTCHA_V3","HCAPTCHA_ENTERPRISE","F5_BOT_DEFENSE","F5_BOT_DEFENSE_ONPREM"]}},{"type":"null"}],"description":"WAF / bot-protection products to map to OWASP (one or more). Defaults to CADDY_CORAZA.","default":null},"site_address":{"anyOf":[{"type":"string"},{"type":"null"}],"pattern":"^(?:[A-Za-z0-9](?:[A-Za-z0-9.\\-]{0,251}[A-Za-z0-9])?)?(?::\\d{1,5})?$","maxLength":253,"description":"Site address used in the generated Caddyfile (default app.example.gc.ca).","default":null},"upstream":{"anyOf":[{"type":"string"},{"type":"null"}],"pattern":"^(?:[A-Za-z0-9](?:[A-Za-z0-9.\\-]{0,251}[A-Za-z0-9])?)?(?::\\d{1,5})?$","maxLength":253,"description":"Upstream host:port for reverse_proxy (default localhost:8080).","default":null},"attested":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"maxItems":400,"items":{"type":"string","pattern":"^[A-Za-z0-9:.\\-]{1,32}$"},"description":"OWASP item IDs (e.g. A01:2025, OAT-008, CICD-SEC-1) the operator attests as implemented; they score full points in the protection coverage score.","default":null},"not_enabled":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"maxItems":400,"items":{"type":"string","pattern":"^[A-Za-z0-9:.\\-]{1,32}$"},"description":"OWASP item IDs that a selected product covers but that the operator reports as not enabled (e.g. the product's bot rule set is not switched on); they score 0.","default":null},"not_applicable":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"maxItems":400,"items":{"type":"string","pattern":"^[A-Za-z0-9:.\\-]{1,32}$"},"description":"OWASP item IDs the operator marks as not applicable to this application; they are left out of the score (no points earned or possible).","default":null},"score_layers":{"anyOf":[{"type":"array","items":{"type":"string","enum":["WAF","BOT","MOBILE","LLM","PIPELINE","APPLICATION"]}},{"type":"null"}],"minItems":1,"description":"Layers in scope for the protection coverage score (default all six). Layers left out are reported as excluded and do not count in the overall score, the families or the items.","default":null}},"required":["data_classifications"],"additionalProperties":false,"oneOf":[{"required":["app_archetypes"]},{"required":["app_archetype"]}]},"response":{"title":"GenerateBaselineResponse","type":"object","properties":{"summary":{"title":"Summary","type":"object","properties":{"recommended_paranoia_level":{"type":"integer"},"effective_paranoia_level":{"type":"integer"},"detection_paranoia_level":{"type":"integer"},"inbound_anomaly_threshold":{"type":"integer"},"outbound_anomaly_threshold":{"type":"integer"},"risk_profile":{"type":"string"},"crs_version":{"type":"string"},"archetype":{"type":"string"},"itsg33_profile":{"type":"string"},"archetypes":{"type":"array","items":{"type":"string"}},"asvs_level":{"type":"integer","default":1},"vendors":{"type":"array","items":{"type":"string"}},"primary_waf":{"type":"string","default":""},"mfa_required":{"type":"boolean","default":false},"mfa_phishing_resistant":{"type":"boolean","default":false}},"required":["recommended_paranoia_level","effective_paranoia_level","detection_paranoia_level","inbound_anomaly_threshold","outbound_anomaly_threshold","risk_profile","crs_version","archetype","itsg33_profile"]},"required_waf_rules":{"type":"array","items":{"title":"WafRule","type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"level":{"type":"string"},"reason":{"type":"string"},"source":{"type":"string","enum":["crs","local","edge"]},"status":{"type":"string","enum":["active","replaced","not-applicable"],"default":"active"}},"required":["id","name","level","reason","source"]}},"bot_controls":{"type":"array","items":{"type":"string"}},"bot_controls_detail":{"type":"array","items":{"title":"BotControl","type":"object","properties":{"id":{"type":"string"},"control":{"type":"string"},"owasp_refs":{"type":"array","items":{"type":"string"}},"enforcement":{"type":"string"}},"required":["id","control","owasp_refs","enforcement"]}},"rate_limit_zones":{"type":"array","items":{"title":"RateLimitZone","type":"object","properties":{"name":{"type":"string"},"path":{"type":"string"},"events":{"type":"integer"},"window":{"type":"string"},"key":{"type":"string"},"methods":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"default":null}},"required":["name","path","events","window","key"]}},"compliance_mapping":{"type":"array","items":{"title":"ComplianceMapping","type":"object","properties":{"standard":{"type":"string"},"control_id":{"type":"string"},"name":{"type":"string"},"implementation":{"type":"string"},"requirement":{"type":"string"},"owasp_reference":{"type":"string"}},"required":["standard","control_id","name","implementation","requirement","owasp_reference"]}},"threat_references":{"type":"array","items":{"title":"ThreatReference","type":"object","properties":{"framework":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"}},"required":["framework","id","name"]}},"threat_coverage":{"type":"array","items":{"title":"ThreatControl","type":"object","properties":{"framework":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"priority":{"type":"string","enum":["required","recommended"]},"layer":{"type":"string","enum":["edge","app","pipeline","client"]},"summary":{"type":"string"},"controls":{"type":"array","items":{"type":"string"}},"edge_enforcement":{"type":"string"},"mfa":{"anyOf":[{"type":"string"},{"type":"null"}],"enum":["mitigated","reduced",null],"description":"With mfa_required: 'mitigated' (scored N/A) or 'reduced' (still scored).","default":null},"mfa_note":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null}},"required":["framework","id","name","priority","layer","summary","controls","edge_enforcement"]}},"vendor_mappings":{"type":"array","items":{"title":"VendorMapping","type":"object","properties":{"vendor":{"type":"string"},"label":{"type":"string"},"kind":{"type":"string","enum":["waf","bot"]},"summary":{"type":"string"},"coverage":{"type":"array","items":{"title":"VendorCoverage","type":"object","properties":{"framework":{"type":"string"},"owasp_id":{"type":"string"},"owasp_name":{"type":"string"},"priority":{"type":"string"},"coverage":{"type":"string","enum":["edge","partial","none"]},"feature":{"type":"string"},"policy":{"type":"string","enum":["waf","bot"],"description":"Whether the feature is part of the product's WAF policy or its bot policy.","default":"waf"}},"required":["framework","owasp_id","owasp_name","priority","coverage","feature"]}},"notes":{"type":"array","items":{"type":"string"}},"config_snippet":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"snippet_name":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"waf_policy":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"bot_policy":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null}},"required":["vendor","label","kind","summary","coverage","notes"]}},"engineering":{"title":"EngineeringBaseline","type":"object","properties":{"asvs_level":{"type":"integer"},"asvs_name":{"type":"string"},"asvs_summary":{"type":"string"},"asvs_framework":{"type":"string"},"cicd_framework":{"type":"string"},"cicd_risks":{"type":"array","items":{"title":"EngineeringItem","type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"controls":{"type":"array","items":{"type":"string"}}},"required":["id","name","controls"]}},"pipeline_tests":{"type":"array","items":{"type":"string"}},"samm_framework":{"type":"string"},"samm_practices":{"type":"array","items":{"title":"SammPractice","type":"object","properties":{"function":{"type":"string"},"practice":{"type":"string"},"baseline":{"type":"string"}},"required":["function","practice","baseline"]}}},"required":["asvs_level","asvs_name","asvs_summary","asvs_framework","cicd_framework","cicd_risks","pipeline_tests","samm_framework","samm_practices"]},"score":{"title":"ProtectionScore","type":"object","properties":{"label":{"type":"string"},"method":{"type":"string"},"disclaimer":{"type":"string"},"earned":{"type":"number"},"possible":{"type":"integer"},"percent":{"type":"integer"},"target":{"type":"integer"},"meets_target":{"type":"boolean"},"attested_points":{"type":"number","description":"Points that come from attestations, not from products."},"mfa_mitigated_items":{"type":"array","items":{"type":"string"},"description":"Items scored not applicable because MFA is mandatory and mitigates them."},"not_applicable_items":{"type":"array","items":{"type":"string"},"description":"Items the operator marked not applicable (left out of the score)."},"not_enabled_points":{"type":"number","description":"Points the selected products would earn but that the operator reports as not enabled."},"scope":{"type":"array","items":{"type":"string"},"description":"Layers counted in the score (score_layers, default all)."},"layers":{"type":"array","items":{"title":"LayerScore","type":"object","properties":{"layer":{"type":"string"},"label":{"type":"string"},"applicable":{"type":"boolean"},"included":{"type":"boolean"},"earned":{"type":"number"},"possible":{"type":"integer"},"percent":{"anyOf":[{"type":"integer"},{"type":"null"}]},"target":{"type":"integer"},"meets_target":{"anyOf":[{"type":"boolean"},{"type":"null"}]},"items":{"type":"integer"},"gaps":{"type":"integer"},"note":{"type":"string","default":""}},"required":["layer","label","applicable","included","earned","possible","percent","target","meets_target","items","gaps"]}},"families":{"type":"array","items":{"title":"FamilyScore","type":"object","properties":{"family":{"type":"string"},"name":{"type":"string"},"earned":{"type":"number"},"possible":{"type":"integer"},"percent":{"type":"integer"}},"required":["family","name","earned","possible","percent"]}},"items":{"type":"array","items":{"title":"ScoreItem","type":"object","properties":{"owasp_id":{"type":"string"},"framework":{"type":"string"},"name":{"type":"string"},"layer":{"type":"string"},"priority":{"type":"string","enum":["required","recommended"]},"coverage":{"type":"string","enum":["edge","partial","none"],"description":"Best coverage by the selected products (and the generated Coraza baseline)."},"attested":{"type":"boolean"},"source":{"type":"string","enum":["product","attested","partial","gap","not_enabled","not_applicable","mfa_mitigated"],"description":"not_applicable and mfa_mitigated items have points and possible 0: not counted."},"points":{"type":"number"},"possible":{"type":"integer"},"families":{"type":"array","items":{"type":"string"}}},"required":["owasp_id","framework","name","layer","priority","coverage","attested","source","points","possible","families"]}},"ignored_attestations":{"type":"array","items":{"type":"string"},"description":"Attested IDs that are not part of this profile (ignored)."}},"required":["label","method","disclaimer","earned","possible","percent","target","meets_target","attested_points","mfa_mitigated_items","not_applicable_items","not_enabled_points","scope","layers","families","items","ignored_attestations"]},"warnings":{"type":"array","items":{"type":"string"}},"caddy_config_snippet":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Generated Caddyfile; null unless CADDY_CORAZA is among the vendors (or no WAF is selected).","default":null},"coraza_conf":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Generated coraza.conf; null unless CADDY_CORAZA is among the vendors (or no WAF is selected).","default":null},"ip_blocklist_snippet":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null}},"required":["summary","required_waf_rules","bot_controls","bot_controls_detail","rate_limit_zones","compliance_mapping","threat_references","threat_coverage","vendor_mappings","engineering","score","warnings"]}}