# Walkaround

> Paste a web app's URL and get a dated receipt on whether it can be opened to strangers:
> twelve deterministic checks, a verdict, and a plain-English consequence for every line.
> Paid receipts unseal the evidence, a fix paragraph per open line, and a second read by a
> security model that browses the app like a stranger.

This is not a penetration test. It looks at what a stranger can fetch: pages, scripts,
config files, public records, and file storage. A clean receipt is not a guarantee of safety.
It never signs in unless the owner asks it to, and it never guesses a password.

## What is free

- POST https://staging.walkaround.dev/api/v1/scans with {"url": "..."} - the verdict, the twelve lines, the counts,
  what was skipped, a receipt id and its URL. No token, no account.
- Rate limited per IP address: 429 with {"error":{"code":"rate_limited","retry_after_seconds":N}}.
- The HTML receipt at https://staging.walkaround.dev/r/<receipt id> is the same result, printed.
- A paid receipt also has a full printable report at https://staging.walkaround.dev/r/<receipt id>/report: the
  method, a section per line with the request and the response, what could not be checked,
  and the model's read. It is for a human to read or save as a PDF; an agent reads the JSON.
  It 404s for a receipt that is not paid, and for our own sample receipts.

## What costs money

- The unsealed receipt: the exact request and response behind each open line, a fix paragraph
  to paste back into the AI builder that made the app, and the SOTA Security Model's read.
- A human buys it at https://staging.walkaround.dev/checkout/<receipt id> for £39 (or £19 a month, which includes rescans).
- An agent buys it with API credit: a human tops up £10.00 of credit once at https://staging.walkaround.dev/api-credit,
  and the agent then spends it at £0.25 per unsealed report with a bearer token.
  There is no crypto payment here and no card an agent holds.

## The API

POST https://staging.walkaround.dev/api/v1/scans
  Content-Type: application/json
  {"url": "https://example.com"}
  -> 200, the folded receipt. 400 for an address that cannot be checked,
     429 for the rate limit.

GET https://staging.walkaround.dev/api/v1/receipts/<receipt id>
  authorization: Bearer <token>     optional
  -> 200 with "unsealed": true and a "sota" object when the report is open.
     Without a token (or for a receipt that is not paid): "unsealed": false and a
     "pay" object naming the checkout URL and the price.
     401 for a token we did not issue. 402 when the token's balance will not cover
     £0.25, with balance_pence and price_pence in the body.

## One worked call

  curl -s -X POST https://staging.walkaround.dev/api/v1/scans \
    -H 'content-type: application/json' \
    -d '{"url":"https://walkaround.dev"}'

  200 OK
  {
    "api_version": "v1",
    "receipt": {
      "id": "0a1b2c3d4e5f6071",
      "verdict": "DO NOT SHIP",
      "counts": { "open": 3, "closed": 9, "not_checked": 0, "total": 12 },
      "lines": [
        { "id": "key_in_page", "name": "KEY IN PAGE", "state": "open",
          "label": "EXPOSED", "consequence": "A stranger can read a key from your page." }
      ],
      "skipped": [],
      "receipt_url": "https://staging.walkaround.dev/r/0a1b2c3d4e5f6071"
    },
    "unsealed": false,
    "sota": null,
    "pay": { "price_pence": 3900, "checkout_url": "https://staging.walkaround.dev/checkout/0a1b2c3d4e5f6071" },
    "honesty": { "verdict_source": "the twelve deterministic checks", "sota_can_change_verdict": false }
  }

  # then, with credit bought by a human at /api-credit:
  curl -s -H "authorization: Bearer wa_live_..." https://staging.walkaround.dev/api/v1/receipts/<id>
  -> the same receipt with "unsealed": true, every open line carrying "evidence" and
     "fix", and "sota": {"status":"done","model":"...","pages_fetched":34,"findings":[...]}.

## Errors

Every error is {"error":{"code":"...","message":"...","...":"..."}} with the status that
matches, so a caller can branch on code: bad_url, rate_limited, not_found, invalid_token,
insufficient_credit, scan_failed.

## Machine-readable contract

https://staging.walkaround.dev/openapi.json (OpenAPI 3.1). The HTML site is at https://staging.walkaround.dev/.