# ANB Data Consultancy — Preflight APIs

> Checklist tools for AI agents shipping web apps. Not a penetration test.
> Free to use. Designed for evaluation and improvement based on observed usage.
> No data is retained or saved; privacy-first approach.

## Discovery

- Human landing (examples): /
- Terms of Service: /terms
- Privacy Policy: /privacy
- Agent card: /.well-known/agent.json
- OpenAPI: /openapi.json
- This file: /llms.txt
- Health: /health
- robots.txt: /robots.txt
- sitemap: /sitemap.xml

## Tools (all POST JSON, max 64KB body)

### preflight_secrets
POST /v1/preflight/secrets — { "app_name"?: string, "blobs": [ { "name"?: string, "content": string } ] }

### preflight_authz
POST /v1/preflight/authz — { "app_name"?: string, "ownership_model"?: string, "routes": [ { "method", "path", "auth"?, "notes"?, "ownership_check"? } ] } (max 25 routes)

### preflight_webhooks
POST /v1/preflight/webhooks — { "callbacks": [ { "path", "verification": "signature"|"shared_secret"|"none"|"unknown", "provider"?, "notes"?, "raw_body"?, "idempotency"?, "secret_url_only"? } ] }

### preflight_openapi
POST /v1/preflight/openapi — { "document": "<openapi json/yaml string or object>" }

### preflight_deps
POST /v1/preflight/deps — { "lockfile_excerpt"?: string, "packages"?: [ { "name", "version"? } ] } (max 40 packages)

### preflight_supplychain
POST /v1/preflight/supplychain — { "packages": [ "pkg-name", ... ] } (max 40)

## Response shape

request_id, product, risk_band (low|medium|high|critical), flags[].code/hint, summary_for_agent, disclaimer

## Pricing

- Current: free (Base service; no API key; no SLA)
- Planned: MPP machine payments if demand is proven for premium tier

## Claim boundary

Checklist heuristics only. Findings and guidance are not a security certification.

Service: ANB Data Consultancy (anb-data-consultancy)

## Disputes (paid tier later)

Human owners: keep request_id always. After a paid call keep receipt_id + payment_ref.