Openapi security

What the provider says

Quoted from PayAI · source record · read 2026-10-28

---

Facts and where they come from

Price

0.001 USDC per call Provider claim

Recorded value: 0.001 USDC per call.

Unit

per call

Protocol

x402, REST · transport: HTTP Provider claim

Auth

x402

Endpoint

https://47-85-47-24.sslip.io/v1/openapi-security

Source

PayAI · Public discovery API (provider-published records)

Last checked

Not checked by us yet — the data is as the source published it

First seen

2026-10-26

Payments and earnings

No settled payment on record. Earnings for this service are unknown — not zero.

Payment rails

A payment rail is where the provider asks to be paid. It is not proof that anything was paid through it. See evidence levels.

Input and output, as published

Request

{
    "type": "http",
    "method": "GET",
    "queryParams": {
        "scenario": "insecure-admin-contract"
    }
}

Response

{
    "type": "json",
    "example": {
        "label": "paid-demo:insecure-admin-contract",
        "stats": {
            "low": 1,
            "high": 5,
            "medium": 2,
            "critical": 0,
            "findings": 8,
            "operations": 2,
            "security_schemes": 1,
            "write_operations": 1,
            "remote_references": 0,
            "protected_operations": 0,
            "anonymous_or_public_operations": 2
        },
        "profile": "internet",
        "summary": "BLOCK: 8 finding(s) across 2 operation(s); 5 high, 2 medium, 1 low.",
        "verdict": "BLOCK",
        "coverage": {
            "rules": [
                "authentication and authorization declarations",
                "security-scheme transport and flow choices",
                "resource bounds for pagination and request bodies",
                "sensitive response and privileged input fields",
                "deployment transport and API inventory hygiene",
                "external reference trust boundaries"
            ],
            "standard": "OWASP API Security Top 10 2023",
            "local_refs": true,
            "limitations": "A contract cannot prove runtime authorization, rate limiting, input enforcement, or exploitability; verify findings against implementation and gateway policy.",
            "active_scanning": false,
            "exploit_attempts": false,
            "contract_level_only": true,
            "remote_refs_fetched": false
        },
        "findings": [
            {
                "code": "api_key_in_query",
                "summary": "An API key is transmitted in the URL query string.",
                "evidence": "Security scheme 'queryKey' uses in=query.",
                "location": "$.components.securitySchemes/queryKey",
                "severity": "high",
                "remediation": "Move credentials to an Authorization or purpose-specific request header.",
                "risk_weight": 18,
                "owasp_api_2023": "API2:2023 Broken Authentication"
            },
            {
                "code": "sensitive_response_without_required_auth",
                "summary": "An unauthenticated success response documents sensitive-looking fields.",
                "evidence": "refresh_token",
                "location": "$.paths//accounts/get/responses",
                "severity": "high",
                "remediation": "Require object/property authorization and remove secrets from response schemas.",
                "risk_weight": 20,
                "owasp_api_2023": "API3:2023 Broken Object Property Level Authorization"
            },
            {
                "code": "write_operation_without_required_auth",
                "summary": "A state-changing operation does not require documented authentication.",
                "evidence": "Effective security mode is anonymous.",
                "location": "$.paths//admin/users/{id}/delete",
                "severity": "high",
                "remediation": "Require an appropriate security scheme and enforce function-level authorization.",
                "risk_weight": 22,
                "owasp_api_2023": "API5:2023 Broken Function Level Authorization"
            },
            {
                "code": "privileged_fields_client_writable",
                "summary": "Potentially privileged properties are client-writable.",
                "evidence": "role",
                "location": "$.paths//admin/users/{id}/delete/requestBody",
                "severity": "high",
                "remediation": "Use allow-listed input DTOs and derive ownership, roles, prices, and status server-side.",
                "risk_weight": 17,
                "owasp_api_2023": "API3:2023 Broken Object Property Level Authorization"
            },
            {
                "code": "insecure_server_transport",
                "summary": "A documented API server uses cleartext HTTP.",
                "evidence": "http://api.example.test",
                "location": "$.servers/0/url",
                "severity": "high",
                "remediation": "Use HTTPS with modern TLS for every non-local deployment.",
                "risk_weight": 16,
                "owasp_api_2023": "API8:2023 Security Misconfiguration"
            },
            {
                "code": "read_operation_without_documented_auth",
                "summary": "A read operation has no mandatory documented authentication.",
                "evidence": "Effective security mode is undocumented.",
                "location": "$.paths//accounts/get",
                "severity": "medium",
                "remediation": "Declare required authentication or list this operation explicitly as intentionally public.",
                "risk_weight": 10,
                "owasp_api_2023": "API2:2023 Broken Authentication"
            },
            {
                "code": "unbounded_pagination_parameter",
                "summary": "A pagination or result-count parameter has no maximum.",
                "evidence": "'limit' is numeric without maximum.",
                "location": "$.paths//accounts/get/parameters/query:limit",
                "severity": "medium",
                "remediation": "Set a conservative schema maximum and enforce the same server-side cap.",
                "risk_weight": 7,
                "owasp_api_2023": "API4:2023 Unrestricted Resource Consumption"
            },
            {
                "code": "security_schemes_unused",
                "summary": "Declared security schemes are not referenced by any operation.",
                "evidence": "queryKey",
                "location": "$.components.securitySchemes",
                "severity": "low",
                "remediation": "Remove stale schemes or attach them to the intended global/operation requirements.",
                "risk_weight": 3,
                "owasp_api_2023": "API9:2023 Improper Inventory Management"
            }
        ],
        "operations": [
            {
                "path": "/accounts",
                "method": "GET",
                "operation_id": "listAccounts",
                "security_mode": "undocumented",
                "write_operation": false
            },
            {
                "path": "/admin/users/{id}",
                "method": "DELETE",
                "operation_id": "deleteUser",
                "security_mode": "anonymous",
                "write_operation": true
            }
        ],
        "risk_score": 100,
        "analysis_id": "apisec-cbfa909ee1a1a22f",
        "analyzer_version": "apisec-openapi-owasp-2023/1.0",
        "remediation_plan": [
            "Move credentials to an Authorization or purpose-specific request header.",
            "Require object/property authorization and remove secrets from response schemas.",
            "Require an appropriate security scheme and enforce function-level authorization.",
            "Use allow-listed input DTOs and derive ownership, roles, prices, and status server-side.",
            "Use HTTPS with modern TLS for every non-local deployment.",
            "Declare required authentication or list this operation explicitly as intentionally public.",
            "Set a conservative schema maximum and enforce the same server-side cap.",
            "Remove stale schemes or attach them to the intended global/operation requirements."
        ]
    }
}

Examples are the provider's own, not a call we made.

Provenance

One row per statement. “Verified” means we checked it ourselves and the finding is quoted. “Provider claim” means we read it in the provider's own record. “Not found” is a statement about our search, not proof of absence.

Endpoint checks

We have not called this endpoint yet. Until we do, everything above is what the source published — no more.

Tags

---