Sample on example input
API Authentication, OAuth2/JWT & Rate-Limit Composite Suite
Composite 6-check API authentication audit chaining OAuth2 PKCE S256, OIDC discovery, JWT claims, API key checksum format, rate limits, and OWASP API Top 10.
What you get
- Executive grade B, posture score 83/100 on this example input
- 6 sub-check results; failed on this example:
jwt_claims- Prioritized remediation checklist and disclaimer
Example input
{
"issuer": "https://auth.example.com",
"alg": "none",
"ttl_seconds": "86400"
}
Parameters this suite reads
All parameters this suite reads. Pass your real values as query or JSON parameters; omitted ones use defaults. The suite evaluates the values you pass; it does not crawl or scan live URLs.
code_verifier, code_challenge_method, issuer, jwks_uri, id_token_signing_alg_values_supported, alg, iss, sub, ttl_seconds, prefix, payload, requests_per_min, writes_per_min, retry_after_header, object_level_auth_checked, rate_limiting_enabled, ssrf_outbound_filtered, response_fields_allowlisted
How to call it (0.05 USDC)
x402: Returns HTTP 402 with a base64 PAYMENT-REQUIRED header (x402 v2, USDC on Base, eip155:8453). Use any x402 v2 client (it signs an EIP-3009 authorization and retries with PAYMENT-SIGNATURE). Fallback: send the USDC yourself, then retry with header X-PAYMENT-TX: <tx hash>.
curl -i 'https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening?issuer=https%3A%2F%2Fauth.example.com&alg=none&ttl_seconds=86400'
Prepaid key:
curl -s -H 'X-Bazaar-Key: bz_live_YOUR_KEY' 'https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening?issuer=https%3A%2F%2Fauth.example.com&alg=none&ttl_seconds=86400'
MCP (streamable HTTP, tool suite_api_and_auth_hardening):
curl -s https://bot-bazaar.fly.dev/mcp -H 'content-type: application/json' -H 'X-Bazaar-Key: bz_live_YOUR_KEY' -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "suite_api_and_auth_hardening", "arguments": {"issuer": "https://auth.example.com", "alg": "none", "ttl_seconds": "86400"}}}'OpenAI-compatible
Not routed by the chat-completions endpoint; call the x402 route or the MCP tool.
Full sample report (JSON)
{
"suite": "api-and-auth-hardening",
"tool": "suite/api-and-auth-hardening",
"title": "API Authentication, JWT/OAuth2 & Rate-Limit Hardening Suite",
"valid": true,
"composite_risk_score": 17,
"composite_posture_score": 83,
"executive_grade": "B",
"sub_check_count": 6,
"sub_checks": {
"oauth2_pkce": {
"valid": true,
"code_challenge_method": "S256",
"s256_challenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
"verifier_length_valid": true,
"pkce_s256_enforced": true
},
"oidc_discovery": {
"valid": true,
"compliant": true,
"issuer": "https://auth.example.com",
"jwks_uri": "https://auth.example.com/.well-known/jwks.json",
"checks": {
"https_issuer": true,
"https_jwks_uri": true,
"asymmetric_signing_algs": true
}
},
"jwt_claims": {
"valid": false,
"alg": "none",
"ttl_seconds": 86400,
"checks": {
"strong_algorithm": false,
"issuer_present": true,
"subject_present": true,
"short_lived_ttl": false
}
},
"api_key_format": {
"valid": true,
"prefix": "bzr_live",
"crc32_hex": "a2e54612",
"formatted_token_example": "bzr_live_9f86d081884c7d659a2feaa0c55ad015_a2e54612",
"secret_scanner_friendly": true
},
"rate_limit_policy": {
"valid": true,
"requests_per_min": 60,
"writes_per_min": 20,
"checks": {
"read_rpm_reasonable": true,
"write_rpm_stricter_than_read": true,
"includes_retry_after_429_header": true
}
},
"owasp_api_top10": {
"valid": true,
"score": 100,
"compliant": true,
"checks": {
"API1_bola_mitigated": true,
"API3_bopla_allowlisted": true,
"API4_rate_limited": true,
"API7_ssrf_guarded": true
}
}
},
"passed_sub_checks": [
"oauth2_pkce",
"oidc_discovery",
"api_key_format",
"rate_limit_policy",
"owasp_api_top10"
],
"failed_sub_checks": [
"jwt_claims"
],
"informational_sub_checks": [],
"prioritized_remediation_checklist": [
"Require PKCE S256 on all OAuth 2.1 public/native flows and reject JWT alg=none.",
"Use prefixed CRC32-checksummed API keys stored as SHA-256 hashes in the database.",
"Return HTTP 429 with Retry-After headers on per-bot and per-IP write rate limits."
],
"remediation_note": "General hardening checklist for this suite; failed_sub_checks lists the findings specific to the input you passed.",
"input_note": "This suite evaluates the configuration values passed as query or JSON parameters; it does not crawl or scan live URLs. Omitted parameters fall back to the documented defaults.",
"disclaimer": "Automated composite analytical & schema audit only \u2014 not legal advice, not financial or investment advice, not tax advice, and not a formal third-party security certification.",
"generated_at": 1793508429
}