{ "openapi": "3.0.1", "info": { "title": "Third-Party Script Integrity Pin and Content Drift Gate", "description": "Reads the served HTML of each page, lists every external script and stylesheet, and judges each one against your origin allowlist, your integrity policy and a rule that rejects mutable CDN paths such as 'latest', 'main' or a bare major version. It then fe", "version": "0.1", "x-build-id": "MYeNr0987ZCXAdlLC" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/kingii98~third-party-script-integrity-pin-and-content-drift-gate/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-kingii98-third-party-script-integrity-pin-and-content-drift-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/kingii98~third-party-script-integrity-pin-and-content-drift-gate/runs": { "post": { "operationId": "runs-sync-kingii98-third-party-script-integrity-pin-and-content-drift-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/kingii98~third-party-script-integrity-pin-and-content-drift-gate/run-sync": { "post": { "operationId": "run-sync-kingii98-third-party-script-integrity-pin-and-content-drift-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "urls" ], "properties": { "urls": { "title": "Page URLs", "minItems": 1, "maxItems": 200, "type": "array", "description": "1 to 200 public page URLs. The Actor reads the served HTML of each page. It does not crawl the site, and it does not run JavaScript. Private, loopback and reserved addresses are refused, and so are URLs that hold credentials.", "default": [ "https://getbootstrap.com/", "https://jquery.com/" ], "items": { "type": "string" } }, "allowedScriptOrigins": { "title": "Allowed script origins", "type": "array", "description": "Hosts that may serve a script or a stylesheet to your pages. Write a host (cdn.example.com), an origin (https://cdn.example.com) or a wildcard (*.example.com). The page origin is always allowed. An empty list turns the origin check into a warning, because there is then nothing to judge against.", "default": [ "code.jquery.com", "cdn.jsdelivr.net", "cdnjs.cloudflare.com", "unpkg.com" ], "items": { "type": "string" } }, "integrityPolicy": { "title": "Integrity policy", "enum": [ "required", "warn", "off" ], "type": "string", "description": "How hard the Actor is on a cross-origin tag that carries no integrity attribute.", "default": "required" }, "allowedHashAlgorithms": { "title": "Allowed integrity hash algorithms", "type": "array", "description": "The SRI hash algorithms that your policy accepts. A hash outside this list is a warning, because it is weaker than the policy asks for.", "items": { "type": "string", "enum": [ "sha256", "sha384", "sha512" ], "enumTitles": [ "sha256", "sha384", "sha512" ] }, "default": [ "sha384", "sha512" ] }, "requireCrossorigin": { "title": "Require the crossorigin attribute", "type": "boolean", "description": "A cross-origin tag that carries integrity also needs crossorigin, or the browser cannot check the hash. Turn this off to stop the warning.", "default": true }, "mutablePathTokens": { "title": "Mutable path tokens", "type": "array", "description": "Words that name a moving target instead of one release. A path segment or a version query value that holds one of these words fails the immutable_path check. The words 'latest', 'current', 'stable', 'edge', 'canary' and 'nightly' are also matched inside a file name, such as jquery-latest.min.js.", "default": [ "latest", "main", "master", "next", "canary", "beta", "edge", "dev", "current", "stable", "nightly", "head" ], "items": { "type": "string" } }, "rejectBareMajorVersion": { "title": "Reject a bare major version", "type": "boolean", "description": "Treat a path such as /v3/ or /npm/package@3/ as mutable, because the file behind it changes with every patch release. A minor-only path such as @1.2 is treated the same way.", "default": true }, "checks": { "title": "Checks", "type": "array", "description": "The checks that decide the gate. An empty list runs every check.", "items": { "type": "string", "enum": [ "https_scheme", "origin_allowlist", "integrity_present", "integrity_algorithm", "crossorigin_attribute", "immutable_path", "content_drift" ], "enumTitles": [ "HTTPS scheme (no plain HTTP asset)", "Origin allowlist (the host may serve code to this page)", "Integrity present (the tag carries an SRI hash)", "Integrity algorithm (the SRI hash is strong enough)", "Crossorigin attribute (the browser can check the hash)", "Immutable path (no 'latest', no branch name, no bare major version)", "Content drift (the bytes behind a fixed URL did not change)" ] }, "default": [ "https_scheme", "origin_allowlist", "integrity_present", "integrity_algorithm", "crossorigin_attribute", "immutable_path", "content_drift" ] }, "includeSameOrigin": { "title": "Include same-origin assets", "type": "boolean", "description": "Also list and hash the scripts and stylesheets that your own origin serves. Your own files change with every deploy, so this is off by default.", "default": false }, "hashAssets": { "title": "Fetch and hash each asset", "type": "boolean", "description": "Fetch every listed asset in full, hash the bytes with SHA-256 and compare the hash with the last run. Turn this off for a markup-only audit that charges no asset event.", "default": true }, "maxAssetsPerPage": { "title": "Maximum references for one page", "minimum": 1, "maximum": 200, "type": "integer", "description": "Hard cap on the references judged on one page. References above the cap are counted in the page record and are not judged.", "default": 40 }, "maxAssets": { "title": "Maximum hashed assets for one run", "minimum": 1, "maximum": 1000, "type": "integer", "description": "Hard cap on the assets fetched and hashed in one run. One asset URL that many pages share is fetched once and charged once.", "default": 200 }, "maxAssetBytes": { "title": "Maximum asset bytes", "minimum": 1024, "maximum": 10485760, "type": "integer", "description": "Hard cap on the bytes read from one asset. A larger asset is reported without a hash, because a hash of a part of the file cannot prove that the whole file is unchanged.", "default": 2097152 }, "maxHtmlBytes": { "title": "Maximum HTML bytes", "minimum": 65536, "maximum": 10485760, "type": "integer", "description": "Hard cap on the bytes read from one page. A larger document is cut, and the references in the part that was read are still judged.", "default": 2097152 }, "maxRedirects": { "title": "Maximum redirects", "minimum": 0, "maximum": 10, "type": "integer", "description": "Hop limit for one page fetch and for one asset fetch. Every hop passes the private-address guard.", "default": 5 }, "timeoutSeconds": { "title": "Request timeout (seconds)", "minimum": 1, "maximum": 60, "type": "integer", "description": "Timeout for one HTTP request, both for a page fetch and for an asset fetch.", "default": 20 }, "concurrency": { "title": "Concurrent requests", "minimum": 1, "maximum": 8, "type": "integer", "description": "How many page or asset requests run at the same time. Keep this low, so your site and your CDN are not put under load.", "default": 4 }, "stateStoreName": { "title": "Asset hash key-value store name", "type": "string", "description": "Name of the named key-value store that keeps the last accepted SHA-256 hash of each asset URL. Use one name for each environment, so the drift state compares the correct history.", "default": "script-asset-hashes" }, "updateState": { "title": "Update the stored hashes", "type": "boolean", "description": "Write the hash of this run into the store, so that it becomes the accepted hash for the next run. Turn it off for a dry run that must not accept a change.", "default": true }, "userAgent": { "title": "User agent", "pattern": "^[\\x20-\\x7E]*$", "type": "string", "description": "User-Agent header sent with every request, so your site and your CDN can identify this Actor in their logs. ASCII characters only.", "default": "ScriptIntegrityPinGate/0.1 (+https://apify.com)" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }