{ "openapi": "3.0.1", "info": { "title": "Deployed Frontend Secret and Debug Endpoint Exposure Gate", "description": "Reads the script bundles that your deployed pages load from their own origin and probes a fixed set of debug and schema paths. Reports each leaked key and each exposed endpoint with a redacted match, and gives one gate_pass verdict for your build step. HT", "version": "0.1", "x-build-id": "YRxcL3XkiKpIyKliw" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/kingii98~deployed-frontend-secret-and-debug-endpoint-exposure-gate/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-kingii98-deployed-frontend-secret-and-debug-endpoint-exposure-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/kingii98~deployed-frontend-secret-and-debug-endpoint-exposure-gate/runs": { "post": { "operationId": "runs-sync-kingii98-deployed-frontend-secret-and-debug-endpoint-exposure-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/kingii98~deployed-frontend-secret-and-debug-endpoint-exposure-gate/run-sync": { "post": { "operationId": "run-sync-kingii98-deployed-frontend-secret-and-debug-endpoint-exposure-gate", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "urls", "ownershipConfirmed" ], "properties": { "urls": { "title": "Page URLs", "minItems": 1, "maxItems": 20, "type": "array", "description": "1 to 20 page URLs on domains that you own. The Actor reads each page, reads the scripts that the page loads from the same origin, and probes the path set against the origin of the page. Private, loopback and reserved addresses are refused.", "default": [ "https://example.com/", "https://www.iana.org/" ], "items": { "type": "string" } }, "ownershipConfirmed": { "title": "I own these domains", "type": "boolean", "description": "Confirm that you own, or are authorized to test, every domain in the list. The Actor probes debug and schema paths, so it must run only against your own deployment. When this is false the Actor audits nothing and reports the reason.", "default": true }, "scanBundles": { "title": "Read the script bundles", "type": "boolean", "description": "Read each script that the page loads from the same origin and search it for secret patterns. Inline script text is always searched, because the page body already holds it.", "default": true }, "maxBundleBytes": { "title": "Maximum bundle bytes", "minimum": 1000, "maximum": 5000000, "type": "integer", "description": "The Actor stops the read of one script at this size. A larger bundle is searched up to this many bytes.", "default": 2000000 }, "maxScriptsPerPage": { "title": "Maximum scripts for each page", "minimum": 0, "maximum": 50, "type": "integer", "description": "The Actor reads at most this many same-origin scripts for each page. The page record reports how many scripts were left out.", "default": 10 }, "probePaths": { "title": "Probe paths", "maxItems": 30, "type": "array", "description": "Paths that the Actor probes against the origin of each page, with a HEAD first and a GET only when the HEAD may be open. A path in the default set is reported only when the body proves the exposure, so a single page application that answers 200 for every path is not reported. A path that you add yourself is reported when it answers 200 with a non-HTML body. Maximum 30 paths.", "default": [ "/.env", "/.env.local", "/.git/config", "/actuator/env", "/debug/vars", "/swagger.json", "/openapi.json", "/api-docs", "/swagger-ui.html", "/graphql", "/graphiql", "/server-status" ], "items": { "type": "string" } }, "failOn": { "title": "Severity that fails the gate", "enum": [ "info", "low", "medium", "high", "critical", "never" ], "type": "string", "description": "The gate reports gatePass false when a finding reaches this severity. Select \"never\" to report findings without a gate verdict.", "default": "high" }, "timeoutSeconds": { "title": "Request timeout (seconds)", "minimum": 3, "maximum": 60, "type": "integer", "description": "Timeout of one HTTP request.", "default": 15 }, "maxRequests": { "title": "Maximum requests for the run", "minimum": 10, "maximum": 2000, "type": "integer", "description": "The Actor stops when it has sent this many requests. A page that was left out is reported in the summary record.", "default": 400 }, "maxRedirects": { "title": "Maximum redirects for a page", "minimum": 0, "maximum": 5, "type": "integer", "description": "The page request follows at most this many same-origin redirect hops. A script read and a probe never follow a redirect.", "default": 2 }, "trackBaseline": { "title": "Mark findings that are new", "type": "boolean", "description": "Compare this run against the fingerprints of the last run in the key-value store, mark each finding with isNew, and then store this run. Use it to accept a known false positive once.", "default": false }, "baselineKey": { "title": "Baseline key", "type": "string", "description": "Key of the baseline record in the key-value store. Use one key for each deployment that you gate.", "default": "baseline" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }