UNCLASSIFIED
UNCLASSIFIED

Public API Index

Every public claim on this site maps to a live endpoint. This page is the menu. Working code or it does not exist. Internal control-mapping and self-assessment artifacts are gated; access is available to authenticated federal evaluators on request via /evaluate#rfi. For the published standards and doctrine each claim aligns to, see /standards.

Legend. LIVE always-on, public. CACHED uses a cached corpus when the upstream feed is paid or rate-limited; corpus date returned in payload. GATED 403 without an evaluator token; x-evaluator-access: <token> or Authorization: Bearer <token>.

Live geospatial & hazard feeds

MethodPathDescription
GET/api/dual-use/fires LIVENASA FIRMS active-fire detections (VIIRS / MODIS). Always live.
GET/api/dual-use/earthquakes LIVEUSGS recent seismic events. Always live.
GET/api/dual-use/weather-alerts LIVENOAA NWS active CAP alerts. Always live.
GET/api/dual-use/space-weather LIVENOAA SWPC geomagnetic / solar conditions.

Vendor identity & capability

MethodPathDescription
GET/api/capability-brief LIVECanonical machine-readable capability statement: UEI, CAGE, NAICS status, vehicles, authorities not held.
GET/api/fema/manifest LIVEFEMA-facing manifest: integration surfaces, IPAWS posture, COG-ID status (honest).
GET/api/crada/jws-template LIVEJoint Work Statement template under 15 USC 3710a (CRADA).
GET/api/crada/target-labs LIVEFederal lab Technology Transfer office contact pattern (no agency-shopping).

Data architecture & platform map

MethodPathDescription
GET/evaluate/architecture LIVEOV-2 data architecture surface — external feeds → internal layers → dissemination. Branch/WFF/echelon matrix. DARPA-level specs. Legal foundation (MOSA § 4401 + JADC2 JROC 2019).
GET/api/architecture/ov2 LIVEOV-2 Part 1 JSON — external data sources, internal processing layers, lines of effort, branch/WFF/echelon matrix.
GET/api/architecture/ov2/flows LIVEOV-2 Part 2 — eight interconnected technical pipelines with per-hop module, endpoint, and design budgets + last measured witness summary.
GET/api/architecture/ov2/flows/benchmark LIVEMeasured latency witness — bounded HTTP probes per flow hop with p50/p95 vs design budget (Iron Rule 10). Query: ?fresh=1&samples=3
GET/api/architecture/ov2/live-audit LIVEHonest LIVE vs PLANNED endpoint audit — Iron Rule 10 evidence for architecture status claims.
GET/api/architecture/ov2/legal LIVELegal slice only — MOSA (10 U.S.C. § 4401), JADC2 JROC 2019, NDAA FY2021 §832, DoDD 3000.09 mandates that answer why DoD systems must interoperate.
GET/api/architecture/ov2/domain/:domain LIVESingle OV-2 domain slice. Domains: air-space, maritime, tactical-sensor, environmental, osint-doctrine, ai-inference, military-systems, processing, lines-of-effort, branch-wff, darpa, summary.

Platform health & system map

MethodPathDescription
GET/api/health LIVELiveness check. Returns build, uptime, module count.
GET/api/system-map LIVEModule catalog with stage (live / cached / stub) per surface.
GET/sitemap.xml LIVEPublic sitemap. Internal pages are not listed.

Internal control-mapping — evaluator-gated

These endpoints return 403 without a token. They are not for the open web. They are available to authenticated federal evaluators on request. Submit an RFI at /evaluate#rfi and a token is issued by reply within one business day.

MethodPathDescription
GET/api/ai-security/compliance/cmmc-l2 GATEDCMMC L2 internal control-mapping (self-assessment, not certified).
GET/api/ai-security/compliance/fedramp GATEDFedRAMP control-intent mapping (no ATO claimed).
GET/api/ai-security/cmmc/l2-assessment GATEDL2 self-assessment evidence catalog.
GET/api/ai-security/fedramp/ssp-evidence GATEDSSP-shaped evidence pointers (internal).
GET/api/cmmc/evidence-collection GATEDHash-chained evidence collection log.
GET/api/compliance/evidence/export GATEDEvidence bundle export (NDA-on-request).

30-second smoke test

curl -s https://secureassure.app/api/health | jq.
curl -s "https://secureassure.app/api/dual-use/earthquakes?limit=5" | jq '.features | length'
curl -s "https://secureassure.app/api/dual-use/weather-alerts?limit=5" | jq '.alerts | length //.features | length'
curl -s https://secureassure.app/api/capability-brief | jq '.identity,.vehicles,.authoritiesNotHeld'

# Gated endpoint without token returns 403
curl -i https://secureassure.app/api/ai-security/compliance/cmmc-l2

# With evaluator token
curl -s -H "x-evaluator-access: $TOKEN" \
 https://secureassure.app/api/ai-security/compliance/cmmc-l2 | jq.
Honesty signals embedded in every response. The capability-brief endpoint enumerates the authorities ISS LLC does not hold (FedRAMP, IL-5, FIPS, CAC, SIPRNET, ATO, CMMC-L2 cert) so a contracting officer can verify in one curl. The FEMA manifest reports IPAWS COG-ID as not-issued until a sponsoring AO issues one. Self-assessment compliance artifacts are gated; the public surface only points at them.
CHEATSHEET
ASK AI
PRESENCE
⚠ SANDBOX / TRAINING MODE — Live read-only data. Write commands are inhibited (train as you fight, missile button safed).