Reference

API reference

The whole corpus is public JSON under /v1 — no keys, no rate cards, open cross-origin access. Read the SECURITY_UNIT model, the volumetric matrix, the schemas, the worked examples, the deny rules and the standards register; validate your own documents; and evaluate the governing authorization rule as code.

This material is a defensive specification and reference set. It is not an attack tool, a scanner, a certification, or evidence of a completed assessment. It does not automate exploitation; active or state-changing operations require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.

Base URL: https://security.bowtiekreative.com · Machine description: OpenAPI 3.1 · Agent guide: /llms.txt

Endpoints

Method	Path	What it returns
`GET`	`/v1`	This index
`GET`	`/v1/health`	Liveness and corpus counts
`GET`	`/v1/openapi.json`	OpenAPI 3.1 description of this API
`GET`	`/v1/manifest`	Package manifest, inventory and boundaries
`GET`	`/v1/unit`	The SECURITY_UNIT model and the governing production rule
`GET`	`/v1/matrix`	The volumetric matrix: variables, meta-variables and five change levels
`GET`	`/v1/schemas`	The eight JSON Schemas, listed
`GET`	`/v1/schemas/{name}`	One schema in full, e.g. finding
`GET`	`/v1/deny-rules`	The deny-first policy rules
`GET`	`/v1/standards`	The adopted, version-pinned standards register
`GET`	`/v1/tools`	Registered tool classes — names and safety posture only
`GET`	`/v1/examples`	The worked example documents, listed
`GET`	`/v1/examples/{id}`	One example: JSON document plus YAML original
`GET`	`/v1/docs`	The fifteen chapters, listed
`GET`	`/v1/docs/{slug}`	One chapter, as markdown
`GET`	`/v1/sources`	Standards and chapter sources
`POST`	`/v1/validate`	Validate {schema, document} against a published schema
`POST`	`/v1/authorize-check`	Evaluate the governing authorization rule; returns allow/deny with failed conditions

Validating a document

POST {"schema": <name>, "document": {…}} to /v1/validate. The named schema is one of the 8 published schemas (authorization, change-plan, control-profile, finding, security-program, test-plan, threat-model, tool-registry). The response reports valid plus a list of errors with JSON paths.

Request body shape — see /v1/examples for complete, valid documents

{
  "schema": "finding",
  "document": {
    "finding_id": "FIND-EX-001",
    "client_id": "client-demo",
    "title": "…"
  }
}

curl -X POST https://security.bowtiekreative.com/v1/validate \
  -H 'content-type: application/json' \
  --data '{"schema":"authorization","document":'"$(curl -s https://security.bowtiekreative.com/v1/examples/client-authorization | jq .document)"'}'

Evaluating the governing rule

POST the state of the gates to /v1/authorize-check and the governing production rule is evaluated: it returns allowed, the decision, and every failed condition by name. Missing inputs count as false — the default is deny. This is a decision function only; it never executes, scans or changes anything.

Request body — this one is denied because rollback_verified is false while change_possible is true

{
  "authorized": true,
  "target_in_scope": true,
  "mode_allowed": true,
  "preconditions_true": true,
  "change_possible": true,
  "rollback_verified": false
}

curl -X POST https://security.bowtiekreative.com/v1/authorize-check \
  -H 'content-type: application/json' \
  --data '{"authorized":true,"target_in_scope":true,"mode_allowed":true,"preconditions_true":true,"change_possible":false}'

Caching & access

Read endpoints are cacheable and served with permissive cross-origin headers. There is no authentication and no usage charge — this is a free public reference. The two POST endpoints are stateless and store nothing.