{
  "openapi": "3.1.0",
  "info": {
    "title": "PlatPhorm Atlas API",
    "version": "0.4.0",
    "description": "The working PlatPhorm Atlas surface: ingest JA4-family observations, browse public-safe telemetry, look up fingerprints, inspect sensors, and use the same operations through MCP. Public responses redact IP addresses and secret-bearing metadata."
  },
  "servers": [
    {
      "url": "https://atlas.platphormnews.com",
      "description": "Production"
    }
  ],
  "tags": [
    {
      "name": "Status",
      "description": "Health and real persisted counts"
    },
    {
      "name": "Intelligence",
      "description": "Public-safe observation and fingerprint reads"
    },
    {
      "name": "Ingestion",
      "description": "Authenticated observation ingestion"
    },
    {
      "name": "MCP",
      "description": "JSON-RPC 2.0 access to the same Atlas capabilities"
    },
    {
      "name": "Network",
      "description": "Canonical PlatPhormNews topology reads"
    }
  ],
  "paths": {
    "/api/health": {
      "get": {
        "tags": [
          "Status"
        ],
        "summary": "Inspect Atlas health",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          }
        }
      }
    },
    "/api/v1/health": {
      "get": {
        "tags": [
          "Status"
        ],
        "summary": "Inspect Atlas health through the versioned alias",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          }
        }
      }
    },
    "/api/stats": {
      "get": {
        "tags": [
          "Status"
        ],
        "summary": "Read persisted Atlas counts",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/observations": {
      "get": {
        "tags": [
          "Intelligence"
        ],
        "summary": "List public-safe observations",
        "parameters": [
          {
            "name": "limit",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 100,
              "default": 50
            }
          },
          {
            "name": "offset",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 0,
              "default": 0
            }
          },
          {
            "name": "sensor",
            "in": "query",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "fingerprint",
            "in": "query",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/fingerprints": {
      "get": {
        "tags": [
          "Intelligence"
        ],
        "summary": "List catalogued fingerprints",
        "parameters": [
          {
            "name": "search",
            "in": "query",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "type",
            "in": "query",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "limit",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 100,
              "default": 50
            }
          },
          {
            "name": "offset",
            "in": "query",
            "schema": {
              "type": "integer",
              "minimum": 0,
              "default": 0
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/fingerprints/label": {
      "post": {
        "tags": [
          "Intelligence"
        ],
        "summary": "Create or update a fingerprint label",
        "security": [
          {
            "bearerAuth": []
          },
          {
            "platformApiKey": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "ja4_value",
                  "fingerprint_type"
                ],
                "properties": {
                  "ja4_value": {
                    "type": "string"
                  },
                  "fingerprint_type": {
                    "type": "string"
                  },
                  "label": {
                    "type": [
                      "string",
                      "null"
                    ]
                  },
                  "severity": {
                    "type": [
                      "integer",
                      "null"
                    ],
                    "minimum": 0,
                    "maximum": 100
                  },
                  "notes": {
                    "type": [
                      "string",
                      "null"
                    ]
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/lookup": {
      "get": {
        "tags": [
          "Intelligence"
        ],
        "summary": "Correlate one fingerprint",
        "parameters": [
          {
            "name": "fingerprint",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/sensors": {
      "get": {
        "tags": [
          "Intelligence"
        ],
        "summary": "List observation sensors",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/ja4/validate": {
      "get": {
        "tags": [
          "Intelligence"
        ],
        "summary": "List supported JA4-family formats",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          }
        }
      },
      "post": {
        "tags": [
          "Intelligence"
        ],
        "summary": "Validate a JA4-family fingerprint",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "fingerprint"
                ],
                "properties": {
                  "fingerprint": {
                    "type": "string"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          }
        }
      }
    },
    "/api/ingest/http": {
      "get": {
        "tags": [
          "Ingestion"
        ],
        "summary": "Inspect HTTP ingest requirements",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          }
        }
      },
      "post": {
        "tags": [
          "Ingestion"
        ],
        "summary": "Ingest one observation",
        "security": [
          {
            "bearerAuth": []
          },
          {
            "platformApiKey": []
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ObservationInput"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "201": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/ingest/batch": {
      "get": {
        "tags": [
          "Ingestion"
        ],
        "summary": "Inspect batch ingest requirements",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          }
        }
      },
      "post": {
        "tags": [
          "Ingestion"
        ],
        "summary": "Ingest a bounded observation batch",
        "security": [
          {
            "bearerAuth": []
          },
          {
            "platformApiKey": []
          }
        ],
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/ingest/zeek": {
      "get": {
        "tags": [
          "Ingestion"
        ],
        "summary": "Inspect Zeek ingest requirements",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          }
        }
      },
      "post": {
        "tags": [
          "Ingestion"
        ],
        "summary": "Ingest Zeek records",
        "security": [
          {
            "bearerAuth": []
          },
          {
            "platformApiKey": []
          }
        ],
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/ingest/suricata": {
      "get": {
        "tags": [
          "Ingestion"
        ],
        "summary": "Inspect Suricata ingest requirements",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          }
        }
      },
      "post": {
        "tags": [
          "Ingestion"
        ],
        "summary": "Ingest Suricata EVE records",
        "security": [
          {
            "bearerAuth": []
          },
          {
            "platformApiKey": []
          }
        ],
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/ingest/syslog": {
      "get": {
        "tags": [
          "Ingestion"
        ],
        "summary": "Inspect syslog ingest requirements",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          }
        }
      },
      "post": {
        "tags": [
          "Ingestion"
        ],
        "summary": "Ingest syslog records",
        "security": [
          {
            "bearerAuth": []
          },
          {
            "platformApiKey": []
          }
        ],
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "500": {
            "$ref": "#/components/responses/InternalError"
          }
        }
      }
    },
    "/api/mcp": {
      "get": {
        "tags": [
          "MCP"
        ],
        "summary": "Inspect MCP metadata and usage",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          }
        }
      },
      "post": {
        "tags": [
          "MCP"
        ],
        "summary": "Send a JSON-RPC 2.0 request or batch",
        "responses": {
          "200": {
            "description": "JSON-RPC 2.0 response"
          },
          "400": {
            "description": "JSON parse error"
          }
        }
      }
    },
    "/api/v1/network/graph": {
      "get": {
        "tags": [
          "Network"
        ],
        "summary": "Read the canonical PlatPhormNews network graph",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "502": {
            "description": "Canonical source unavailable"
          }
        }
      }
    },
    "/api/v1/network/sites": {
      "get": {
        "tags": [
          "Network"
        ],
        "summary": "List sites from the canonical network graph",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          },
          "502": {
            "description": "Canonical source unavailable"
          }
        }
      }
    },
    "/api/v1/network/trusted-domains": {
      "get": {
        "tags": [
          "Network"
        ],
        "summary": "Read Atlas trusted-domain policy",
        "responses": {
          "200": {
            "description": "Request completed. The data field contains real persisted data or an explicit degraded state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SuccessEnvelope"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "description": "Bearer value is PLATPHORM_API_KEY."
      },
      "platformApiKey": {
        "type": "apiKey",
        "in": "header",
        "name": "X-PlatPhorm-API-Key",
        "description": "Value is PLATPHORM_API_KEY."
      }
    },
    "schemas": {
      "SuccessEnvelope": {
        "type": "object",
        "required": [
          "ok",
          "data"
        ],
        "properties": {
          "ok": {
            "const": true
          },
          "data": {}
        }
      },
      "ErrorEnvelope": {
        "type": "object",
        "required": [
          "ok",
          "error"
        ],
        "properties": {
          "ok": {
            "const": false
          },
          "error": {
            "type": "object",
            "required": [
              "code",
              "message"
            ],
            "properties": {
              "code": {
                "type": "string"
              },
              "message": {
                "type": "string"
              },
              "details": {
                "type": "object"
              }
            }
          }
        }
      },
      "ObservationInput": {
        "type": "object",
        "properties": {
          "ts": {
            "oneOf": [
              {
                "type": "integer"
              },
              {
                "type": "string",
                "format": "date-time"
              }
            ]
          },
          "sensor": {
            "type": "string"
          },
          "ja4": {
            "type": "string"
          },
          "ja4h": {
            "type": "string"
          },
          "ja4s": {
            "type": "string"
          },
          "path": {
            "type": "string"
          },
          "method": {
            "type": "string"
          },
          "ip": {
            "type": "string",
            "description": "Stored only in protected persistence and redacted from public responses."
          }
        },
        "anyOf": [
          {
            "required": [
              "ja4"
            ]
          },
          {
            "required": [
              "ja4h"
            ]
          },
          {
            "required": [
              "ja4s"
            ]
          }
        ]
      }
    },
    "responses": {
      "BadRequest": {
        "description": "Invalid request",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      },
      "Unauthorized": {
        "description": "PLATPHORM_API_KEY required",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      },
      "InternalError": {
        "description": "Internal failure without stack-trace disclosure",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorEnvelope"
            }
          }
        }
      }
    }
  }
}