{
  "openapi": "3.1.0",
  "info": {
    "title": "Walkaround API",
    "version": "1.0.0",
    "summary": "A dated receipt on whether a web app can be opened to strangers.",
    "description": "Twelve deterministic checks against the outside of a web app, returned as JSON. Free to scan. The unsealed receipt - evidence, fixes, and a security model's own read of the app - is paid for: a human with a card, or an agent spending API credit with a bearer token. A clean receipt is not a guarantee of safety, and the model's findings are not part of the verdict.",
    "license": {
      "name": "Proprietary"
    }
  },
  "servers": [
    {
      "url": "https://staging.walkaround.dev"
    }
  ],
  "x-mcp-server": {
    "name": "dev.walkaround/walkaround",
    "transport": "streamable-http",
    "url": "https://staging.walkaround.dev/mcp",
    "manifest": "https://staging.walkaround.dev/mcp.json",
    "tools": {
      "scan_app": "createScan",
      "get_receipt": "getReceipt"
    }
  },
  "tags": [
    {
      "name": "scans",
      "description": "Run the twelve checks."
    },
    {
      "name": "receipts",
      "description": "Read a receipt back, and pay to unseal it."
    }
  ],
  "paths": {
    "/api/v1/scans": {
      "post": {
        "operationId": "createScan",
        "x-mcp-tool": "scan_app",
        "tags": [
          "scans"
        ],
        "summary": "Run the twelve checks and return the free verdict as JSON.",
        "description": "No token and no account. Rate limited per IP: 429 with retry_after_seconds.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "url"
                ],
                "properties": {
                  "url": {
                    "type": "string",
                    "format": "uri",
                    "description": "The app to check. https is assumed when the scheme is left off."
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "The folded receipt.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReceiptEnvelope"
                }
              }
            }
          },
          "400": {
            "description": "The address cannot be checked.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limited.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    },
    "/api/v1/receipts/{id}": {
      "get": {
        "operationId": "getReceipt",
        "x-mcp-tool": "get_receipt",
        "tags": [
          "receipts"
        ],
        "summary": "Read a receipt. With a bearer token, unseal it.",
        "description": "A token we issued unseals a report for a fixed 0.25 GBP, spent from its balance, and is not charged again for the same receipt by the same token. A receipt already paid for with a card is returned unsealed at no cost.",
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "pattern": "^[a-f0-9]{6,32}$"
            }
          },
          {
            "name": "authorization",
            "in": "header",
            "required": false,
            "schema": {
              "type": "string",
              "examples": [
                "Bearer wa_live_..."
              ]
            },
            "description": "API credit token, bought by a human at /api-credit."
          }
        ],
        "responses": {
          "200": {
            "description": "The receipt, folded or unsealed.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ReceiptEnvelope"
                }
              }
            }
          },
          "401": {
            "description": "The bearer token was not issued by us.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "402": {
            "description": "The token has no credit left for an unsealed report.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "404": {
            "description": "No such receipt.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "429": {
            "description": "Rate limited.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "ReceiptEnvelope": {
        "type": "object",
        "required": [
          "api_version",
          "receipt",
          "unsealed"
        ],
        "properties": {
          "api_version": {
            "type": "string",
            "const": "v1"
          },
          "receipt": {
            "type": "object",
            "required": [
              "id",
              "url",
              "verdict",
              "counts",
              "lines",
              "receipt_url"
            ],
            "properties": {
              "id": {
                "type": "string"
              },
              "url": {
                "type": "string",
                "format": "uri"
              },
              "host": {
                "type": "string"
              },
              "created_at": {
                "type": "string",
                "format": "date-time"
              },
              "kind": {
                "type": "string",
                "enum": [
                  "first",
                  "rescan"
                ]
              },
              "verdict": {
                "type": "string",
                "description": "DO NOT SHIP, OK TO SHIP, NOT CHECKED, or N STILL OPEN on a rescan."
              },
              "stamp": {
                "type": "string"
              },
              "counts": {
                "type": "object",
                "properties": {
                  "open": {
                    "type": "integer"
                  },
                  "closed": {
                    "type": "integer"
                  },
                  "not_checked": {
                    "type": "integer"
                  },
                  "total": {
                    "type": "integer"
                  }
                }
              },
              "lines": {
                "type": "array",
                "items": {
                  "type": "object",
                  "required": [
                    "id",
                    "name",
                    "state",
                    "label",
                    "consequence"
                  ],
                  "properties": {
                    "id": {
                      "type": "string",
                      "examples": [
                        "key_in_page"
                      ]
                    },
                    "name": {
                      "type": "string",
                      "examples": [
                        "KEY IN PAGE"
                      ]
                    },
                    "state": {
                      "type": "string",
                      "enum": [
                        "open",
                        "closed",
                        "not_checked"
                      ]
                    },
                    "label": {
                      "type": "string",
                      "examples": [
                        "EXPOSED"
                      ]
                    },
                    "consequence": {
                      "type": "string"
                    },
                    "signed_in": {
                      "type": "boolean"
                    },
                    "evidence": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "fix": {
                      "type": [
                        "string",
                        "null"
                      ]
                    }
                  }
                }
              },
              "skipped": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "not_reachable": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "scan_ms": {
                "type": "integer"
              },
              "receipt_url": {
                "type": "string",
                "format": "uri"
              },
              "receipt_url_unsealed": {
                "type": "string",
                "format": "uri"
              }
            }
          },
          "unsealed": {
            "type": "boolean"
          },
          "sota": {
            "type": [
              "object",
              "null"
            ],
            "properties": {
              "status": {
                "type": "string",
                "enum": [
                  "queued",
                  "running",
                  "done",
                  "failed"
                ]
              },
              "model": {
                "type": "string"
              },
              "pages_fetched": {
                "type": "integer"
              },
              "findings": {
                "type": "array",
                "items": {
                  "type": "object",
                  "required": [
                    "id",
                    "title",
                    "severity",
                    "evidence"
                  ],
                  "properties": {
                    "id": {
                      "type": "string"
                    },
                    "title": {
                      "type": "string"
                    },
                    "severity": {
                      "type": "string",
                      "enum": [
                        "high",
                        "medium",
                        "low",
                        "noted"
                      ]
                    },
                    "evidence": {
                      "type": "string"
                    },
                    "seen_at": {
                      "type": [
                        "string",
                        "null"
                      ],
                      "description": "The page this was seen at, when it is a page the model actually fetched."
                    },
                    "seen_at_claimed": {
                      "type": [
                        "string",
                        "null"
                      ]
                    },
                    "fix": {
                      "type": "string",
                      "description": "A paragraph to paste back into the builder that made the app."
                    }
                  }
                }
              },
              "count": {
                "type": "integer"
              },
              "model_verdict": {
                "type": [
                  "string",
                  "null"
                ],
                "description": "What the model concluded. Never the receipt verdict."
              },
              "verdict_from_this": {
                "type": "boolean"
              },
              "reason": {
                "type": "string"
              },
              "could_not_see": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "note": {
                "type": "string"
              }
            }
          },
          "pay": {
            "type": "object",
            "properties": {
              "price_pence": {
                "type": "integer",
                "examples": [
                  3900
                ]
              },
              "currency": {
                "type": "string",
                "examples": [
                  "GBP"
                ]
              },
              "checkout_url": {
                "type": "string",
                "format": "uri"
              },
              "note": {
                "type": "string"
              }
            }
          },
          "charged": {
            "type": "object",
            "properties": {
              "pence": {
                "type": "integer"
              },
              "balance_after_pence": {
                "type": "integer"
              }
            }
          },
          "honesty": {
            "type": "object",
            "properties": {
              "verdict_source": {
                "type": "string"
              },
              "sota_can_change_verdict": {
                "type": "boolean"
              },
              "a_clean_receipt_is_not_a_guarantee": {
                "type": "boolean"
              }
            }
          }
        }
      },
      "Error": {
        "type": "object",
        "required": [
          "error"
        ],
        "properties": {
          "error": {
            "type": "object",
            "required": [
              "code",
              "message"
            ],
            "properties": {
              "code": {
                "type": "string",
                "enum": [
                  "bad_url",
                  "rate_limited",
                  "not_found",
                  "invalid_token",
                  "insufficient_credit",
                  "scan_failed",
                  "bad_request"
                ]
              },
              "message": {
                "type": "string"
              },
              "retry_after_seconds": {
                "type": "integer"
              },
              "price_pence": {
                "type": "integer"
              },
              "balance_pence": {
                "type": "integer"
              }
            }
          }
        }
      },
      "Finding": {
        "type": "object",
        "required": [
          "id",
          "title",
          "severity",
          "evidence"
        ],
        "properties": {
          "id": {
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "severity": {
            "type": "string",
            "enum": [
              "high",
              "medium",
              "low",
              "noted"
            ]
          },
          "evidence": {
            "type": "string"
          },
          "seen_at": {
            "type": [
              "string",
              "null"
            ],
            "description": "The page this was seen at, when it is a page the model actually fetched."
          },
          "seen_at_claimed": {
            "type": [
              "string",
              "null"
            ]
          },
          "fix": {
            "type": "string",
            "description": "A paragraph to paste back into the builder that made the app."
          }
        }
      }
    }
  }
}