{ "openapi": "3.0.1", "info": { "title": "Browser API CORS Allowlist and Credential Exposure Gate", "description": "Sends a real OPTIONS preflight and a real cross-origin GET from each origin that you name, against each API path that you name. Reports which origins the API accepts, which accept credentials, and every violation class: wildcard with credentials, origin r", "version": "0.1", "x-build-id": "lLWHBCyMW5uni2CbP" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/kingii98~browser-api-cors-allowlist-and-credential-exposure-gate/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-kingii98-browser-api-cors-allowlist-and-credential-exposure-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/kingii98~browser-api-cors-allowlist-and-credential-exposure-gate/runs": { "post": { "operationId": "runs-sync-kingii98-browser-api-cors-allowlist-and-credential-exposure-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/kingii98~browser-api-cors-allowlist-and-credential-exposure-gate/run-sync": { "post": { "operationId": "run-sync-kingii98-browser-api-cors-allowlist-and-credential-exposure-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "apiBaseUrl", "paths", "expectedAllowOrigins", "expectedDenyOrigins", "methods", "requestHeaders", "authorizationStatement" ], "properties": { "apiBaseUrl": { "title": "API base URL", "type": "string", "description": "The base URL of an API that you own, or that you are authorized to test. The Actor joins each path to this base URL. Private, loopback and reserved addresses are refused.", "default": "https://api.github.com" }, "paths": { "title": "Endpoint paths", "minItems": 1, "maxItems": 25, "type": "array", "description": "1 to 25 endpoint paths, for example /v1/account and /v1/orders. Every path is probed from every origin.", "default": [ "/", "/rate_limit" ], "items": { "type": "string" } }, "expectedAllowOrigins": { "title": "Origins that must be accepted", "maxItems": 12, "type": "array", "description": "The origins of your own browser applications, for example https://app.example.com. An origin of this list that the API refuses gives the violation class allow_list_origin_refused.", "default": [ "https://app.example.com" ], "items": { "type": "string" } }, "expectedDenyOrigins": { "title": "Origins that must be refused", "maxItems": 12, "type": "array", "description": "The origins that the API must never accept. The value null is a real origin value that a sandboxed frame sends. An origin of this list that the API accepts gives the violation class deny_list_origin_accepted.", "default": [ "https://evil.example.com", "null", "http://attacker.example" ], "items": { "type": "string" } }, "includeSubdomainProbe": { "title": "Add a subdomain of your own domain to the deny list", "type": "boolean", "description": "Add https://cors-probe. to the deny list. A gateway that matches the host with a loose suffix rule accepts that origin, and an attacker who takes one subdomain then reads your API.", "default": true }, "methods": { "title": "Methods to request in the preflight", "maxItems": 10, "type": "array", "description": "The methods that your application uses. The first method is named in Access-Control-Request-Method. Every method is compared against Access-Control-Allow-Methods. The Actor itself sends only OPTIONS and GET, so it never changes data.", "default": [ "GET", "POST", "PUT", "DELETE" ], "items": { "type": "string" } }, "requestHeaders": { "title": "Headers to request in the preflight", "maxItems": 20, "type": "array", "description": "The header names that your application sends. They are named in Access-Control-Request-Headers and compared against Access-Control-Allow-Headers.", "default": [ "authorization", "content-type" ], "items": { "type": "string" } }, "authorizationStatement": { "title": "Authorization statement", "type": "string", "description": "Free text. Confirm that you own the target, or that you are authorized to test it. The Actor writes this text to the run log and to the summary record.", "default": "I own this API, or I am authorized to test it. The Actor sends only OPTIONS and GET requests." }, "trackMatrix": { "title": "Keep the verdict matrix between runs", "type": "boolean", "description": "Store the verdict of each origin and path pair in the key-value store, and report every change in the next run. The first run writes the matrix and reports no diff.", "default": true }, "matrixKey": { "title": "Matrix record key", "type": "string", "description": "Leave this empty to derive the record key from the base URL. Set it to keep more than one matrix for the same API, for example one for staging and one for production.", "default": "" }, "timeoutSeconds": { "title": "Request timeout in seconds", "minimum": 3, "maximum": 60, "type": "integer", "description": "The Actor stops one request after this time.", "default": 15 }, "maxConcurrency": { "title": "Maximum parallel pairs", "minimum": 1, "maximum": 10, "type": "integer", "description": "How many origin and path pairs the Actor probes at the same time.", "default": 5 }, "maxRequests": { "title": "Maximum HTTP requests", "minimum": 10, "maximum": 2000, "type": "integer", "description": "A hard bound on the run. Each pair costs two requests, and each confirmed reflection costs two more. A pair above the bound is reported as skipped.", "default": 900 }, "maxRedirects": { "title": "Maximum redirects", "minimum": 0, "maximum": 3, "type": "integer", "description": "Zero is the right value for a CORS test, because a browser preflight does not follow a redirect. The Actor tests each redirect hop against the public-address guard, and it never follows more hops than this number.", "default": 0 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }