{"openapi":"3.1.0","info":{"title":"HubVibe Site Compliance Auditing Suite","description":"Machine-payable site compliance audits. Four deterministic audit dimensions -- accessibility (axe-core), SEO, security headers, and performance -- callable a la carte at $0.03/call or as a single $0.10 bundle.\n\nBuilt for agent-to-agent use: every paid route answers an unauthenticated request with HTTP 402 carrying a machine-readable payment challenge, so a paying agent can discover the price and settle without a human in the loop. The challenge names the rails this deployment can actually settle; see /.well-known/agent.json.\n\nEvery result is a rule-based check against the actual page. Nothing here is an LLM judging quality, and a check that could not run is reported as an error, never as a passing result.\n\nDiscovery: /.well-known/agent.json, /llms.txt, /mcp.json, /openapi.json","version":"1.2.0"},"servers":[{"url":"https://hubvibe-io.com","description":"Production"}],"paths":{"/":{"get":{"summary":"Landing Page","operationId":"landing_page__get","responses":{"200":{"description":"Successful Response"}}}},"/billing/success":{"get":{"summary":"Checkout Success Page","operationId":"checkout_success_page_billing_success_get","responses":{"200":{"description":"Successful Response"}}}},"/billing/cancel":{"get":{"summary":"Checkout Cancel Page","operationId":"checkout_cancel_page_billing_cancel_get","responses":{"200":{"description":"Successful Response"}}}},"/llms.txt":{"get":{"summary":"Llms Txt","operationId":"llms_txt_llms_txt_get","responses":{"200":{"description":"Successful Response"}}}},"/mcp.json":{"get":{"tags":["discovery"],"summary":"Mcp Manifest","description":"The MCP tool manifest, with prices and rails taken from live config.\n\nThe tool names, descriptions and input schemas come from the static file\n-- they are documentation and change with the product, not with the\ndeployment. Two things do NOT come from it, because they are deployment\nstate and the file cannot know them:\n\n`auth.methods`, because the static file asserted x402 unconditionally. It\nwent on asserting it after x402 was switched off, so an agent reading this\nmanifest -- which is what the MCP registry points at -- would construct a\npayment for a rail this deployment cannot settle. That is the one thing\nthis codebase refuses to do everywhere else: /.well-known/agent.json and\nevery 402 already omit rails that cannot settle. This route was the hole\nin that rule.\n\nPer-tool prices, because _CATALOG exists precisely so the manifest, the\nprice an agent reads, and the price the route actually charges cannot\ndrift apart -- and a second hand-maintained copy of the numbers defeats\nthat by construction.\n\nPer-tool SCHEMAS, for the same reason and it is not hypothetical: this\nfile already carried its own inputSchema copies, and they had drifted\nfrom what /mcp serves -- the file omitted the html-or-url either-or that\nthe routes enforce, so an agent reading this manifest could construct a\nbody the route rejects. Schemas, titles and annotations are now taken from\n_mcp_tools(), the same function the live MCP endpoint answers\ntools/list with, so the two cannot disagree again. What the static file\nstill owns is the prose: tool names and descriptions.","operationId":"mcp_manifest_mcp_json_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/favicon.svg":{"get":{"tags":["discovery"],"summary":"Favicon","operationId":"favicon_favicon_svg_get","responses":{"200":{"description":"Successful Response"}}}},"/og-image.png":{"get":{"tags":["discovery"],"summary":"Og Image","operationId":"og_image_og_image_png_get","responses":{"200":{"description":"Successful Response"}}}},"/robots.txt":{"get":{"tags":["discovery"],"summary":"Robots Txt","operationId":"robots_txt_robots_txt_get","responses":{"200":{"description":"Successful Response"}}}},"/sitemap.xml":{"get":{"summary":"Sitemap Xml","operationId":"sitemap_xml_sitemap_xml_get","responses":{"200":{"description":"Successful Response"}}}},"/healthz":{"get":{"tags":["discovery"],"summary":"Health Check","operationId":"health_check_healthz_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/health":{"get":{"tags":["discovery"],"summary":"Health Check","operationId":"health_check_health_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/.well-known/agent.json":{"get":{"tags":["discovery"],"summary":"Agent Manifest","operationId":"agent_manifest__well_known_agent_json_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/mcp":{"post":{"tags":["discovery"],"summary":"Mcp Streamable Http","description":"MCP Streamable HTTP endpoint.\n\nDiscovery (initialize, tools/list) is free and unauthenticated -- an agent\nmust be able to find out what this node sells and what it costs before\ndeciding to buy. Execution (tools/call) goes through exactly the same\nfail-closed authorisation as the REST routes, including verify-then-settle,\nrather than a second copy of the payment logic that could drift from it.\n\nA coroutine, like every other discovery route: see _mcp_tools_call for\nwhy. The handshake and the tool list are answered on the event loop;\nonly tools/call is handed to the audit thread pool.","operationId":"mcp_streamable_http_mcp_post","parameters":[{"name":"x-api-key","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Api-Key"}},{"name":"x-payment","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Payment"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"title":"Payload"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/billing/checkout":{"post":{"summary":"Start Checkout","operationId":"start_checkout_billing_checkout_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckoutRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/billing/report":{"post":{"tags":["billing"],"summary":"Start Report Checkout","description":"One-time purchase of a single full-bundle report on one URL.","operationId":"start_report_checkout_billing_report_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReportCheckoutRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/report":{"get":{"tags":["billing"],"summary":"Report Page","description":"Render a purchased report.\n\nPayment is re-verified against Stripe on every view rather than trusting\nthat a webhook landed, because this URL is the only thing between a\nstranger and a free audit -- an unpaid or unknown session gets nothing.\n\nThe audit runs on first view and is then cached, so a refresh re-reads\nthe stored result instead of re-running (and re-costing) an audit the\nbuyer already paid for exactly once.","operationId":"report_page_report_get","parameters":[{"name":"session_id","in":"query","required":true,"schema":{"type":"string","title":"Session Id"}}],"responses":{"200":{"description":"Successful Response","content":{"text/html":{"schema":{"type":"string"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/billing/api-key":{"get":{"summary":"Get Api Key","operationId":"get_api_key_billing_api_key_get","parameters":[{"name":"session_id","in":"query","required":true,"schema":{"type":"string","title":"Session Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/billing/webhook":{"post":{"summary":"Stripe Webhook","operationId":"stripe_webhook_billing_webhook_post","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}}}}},"/audit":{"post":{"summary":"Audit","operationId":"audit_audit_post","parameters":[{"name":"x-api-key","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Api-Key"}},{"name":"x-payment","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Payment"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditRequest"},"example":{"url":"https://example.com"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}},"402":{"description":"Payment Required"}},"x-payment-info":{"offers":[{"method":"x402","scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"30000","currency":"USDC","payTo":"0x837C40E2B4e976f43Ffb4451eE281A00fA9477dd","x402Versions":[1,2],"detail":"Sign an EIP-3009 USDC authorization for `amount` to `payTo` and send it as PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1); the 402 carries the full challenge."}]}}},"/audit/wcag":{"post":{"summary":"Audit Wcag","description":"Identical to /audit -- same axe-core check, same $0.03 price, kept\nas its own path alongside the other 4 audit dimensions so a caller can\nrequest accessibility specifically without relying on /audit's name.","operationId":"audit_wcag_audit_wcag_post","parameters":[{"name":"x-api-key","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Api-Key"}},{"name":"x-payment","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Payment"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditRequest"},"example":{"url":"https://example.com"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}},"402":{"description":"Payment Required"}},"x-payment-info":{"offers":[{"method":"x402","scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"30000","currency":"USDC","payTo":"0x837C40E2B4e976f43Ffb4451eE281A00fA9477dd","x402Versions":[1,2],"detail":"Sign an EIP-3009 USDC authorization for `amount` to `payTo` and send it as PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1); the 402 carries the full challenge."}]}}},"/audit/seo":{"post":{"summary":"Audit Seo","operationId":"audit_seo_audit_seo_post","parameters":[{"name":"x-api-key","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Api-Key"}},{"name":"x-payment","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Payment"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditRequest"},"example":{"url":"https://example.com"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}},"402":{"description":"Payment Required"}},"x-payment-info":{"offers":[{"method":"x402","scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"30000","currency":"USDC","payTo":"0x837C40E2B4e976f43Ffb4451eE281A00fA9477dd","x402Versions":[1,2],"detail":"Sign an EIP-3009 USDC authorization for `amount` to `payTo` and send it as PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1); the 402 carries the full challenge."}]}}},"/audit/security":{"post":{"summary":"Audit Security","operationId":"audit_security_audit_security_post","parameters":[{"name":"x-api-key","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Api-Key"}},{"name":"x-payment","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Payment"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UrlAuditRequest"},"example":{"url":"https://example.com"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}},"402":{"description":"Payment Required"}},"x-payment-info":{"offers":[{"method":"x402","scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"30000","currency":"USDC","payTo":"0x837C40E2B4e976f43Ffb4451eE281A00fA9477dd","x402Versions":[1,2],"detail":"Sign an EIP-3009 USDC authorization for `amount` to `payTo` and send it as PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1); the 402 carries the full challenge."}]}}},"/audit/performance":{"post":{"summary":"Audit Performance","operationId":"audit_performance_audit_performance_post","parameters":[{"name":"x-api-key","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Api-Key"}},{"name":"x-payment","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Payment"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UrlAuditRequest"},"example":{"url":"https://example.com"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}},"402":{"description":"Payment Required"}},"x-payment-info":{"offers":[{"method":"x402","scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"30000","currency":"USDC","payTo":"0x837C40E2B4e976f43Ffb4451eE281A00fA9477dd","x402Versions":[1,2],"detail":"Sign an EIP-3009 USDC authorization for `amount` to `payTo` and send it as PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1); the 402 carries the full challenge."}]}}},"/audit/bundle":{"post":{"summary":"Audit Bundle","description":"Runs all four audits against one URL. Priced and billed as a single\n$0.10 unit, not four separate $0.03 charges -- if any dimension fails\nto run, the whole call fails (502) and nothing is billed, since a\npartial bundle isn't the product being sold here.","operationId":"audit_bundle_audit_bundle_post","parameters":[{"name":"x-api-key","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Api-Key"}},{"name":"x-payment","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"X-Payment"}},{"name":"authorization","in":"header","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Authorization"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UrlAuditRequest"},"example":{"url":"https://example.com"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}},"402":{"description":"Payment Required"}},"x-payment-info":{"offers":[{"method":"x402","scheme":"exact","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","amount":"100000","currency":"USDC","payTo":"0x837C40E2B4e976f43Ffb4451eE281A00fA9477dd","x402Versions":[1,2],"detail":"Sign an EIP-3009 USDC authorization for `amount` to `payTo` and send it as PAYMENT-SIGNATURE (v2) or X-PAYMENT (v1); the 402 carries the full challenge."}]}}}},"components":{"schemas":{"AuditRequest":{"properties":{"html":{"anyOf":[{"type":"string","maxLength":2097152},{"type":"null"}],"title":"Html","description":"Raw HTML source to audit"},"url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Url","description":"Live URL to audit instead of raw HTML"}},"type":"object","title":"AuditRequest"},"CheckoutRequest":{"properties":{"email":{"type":"string","title":"Email"},"plan":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Plan"}},"type":"object","required":["email"],"title":"CheckoutRequest"},"HTTPValidationError":{"properties":{"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"type":"array","title":"Detail"}},"type":"object","title":"HTTPValidationError"},"ReportCheckoutRequest":{"properties":{"email":{"type":"string","title":"Email"},"url":{"type":"string","title":"Url"}},"type":"object","required":["email","url"],"title":"ReportCheckoutRequest"},"UrlAuditRequest":{"properties":{"url":{"type":"string","title":"Url"}},"type":"object","required":["url"],"title":"UrlAuditRequest","description":"For audit routes that need a live, fetchable URL -- security and\nperformance checks inspect real HTTP responses and real network\nbehavior, so raw HTML alone (no server to talk to) isn't enough."},"ValidationError":{"properties":{"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"type":"array","title":"Location"},"msg":{"type":"string","title":"Message"},"type":{"type":"string","title":"Error Type"}},"type":"object","required":["loc","msg","type"],"title":"ValidationError"}}},"tags":[{"name":"audit","description":"Paid, machine-payable audit routes."},{"name":"discovery","description":"Manifests agents use to find and price these tools."},{"name":"billing","description":"Human subscription checkout and key issuance."}],"x-service-info":{"categories":["accessibility","seo","security","performance"],"docs":{"apiReference":"/docs","homepage":"/","llms":"/llms.txt"}}}