{"name":"Cloak Harbor Personal Exposure Defense","tagline":"Personal exposure defense for authorized clients","version":"0.10.3","mode":"production-authorized-client","posture":"defensive","magicRule":"One authorized client, one real exposure-defense loop, zero fake actions.","notForUse":["people-search","doxxing","osint-crawling","surveillance"],"docs":{"overview":"https://cloak.platphormnews.com/docs","personalExposureDefense":"https://cloak.platphormnews.com/docs/personal-exposure-defense","sigreduce":"https://cloak.platphormnews.com/docs/sigreduce","architecture":"https://cloak.platphormnews.com/docs/architecture","responsibleUse":"https://cloak.platphormnews.com/docs/responsible-use","faq":"https://cloak.platphormnews.com/faq"},"api":{"openapi":"https://cloak.platphormnews.com/openapi.yaml","openapiJson":"https://cloak.platphormnews.com/openapi.json","health":"https://cloak.platphormnews.com/api/health","platphormManifest":"https://cloak.platphormnews.com/.well-known/platphorm.json","endpoints":[{"method":"GET","path":"/api/v1/findings","auth":"public","paginated":true,"description":"Case findings from the Postgres case-state store when configured; empty persisted stores return an honest empty list"},{"method":"GET","path":"/api/v1/findings/{id}","auth":"public"},{"method":"GET","path":"/api/v1/principal","auth":"public","description":"Authorized-local principal summary follows CLOAK_VISIBILITY_MODE; configured Postgres without clients returns an honest empty state"},{"method":"GET","path":"/api/v1/principals/{id}","auth":"public","description":"Principal detail with protected fields only when PLATPHORM_API_KEY is supplied"},{"method":"GET","path":"/api/v1/evidence","auth":"public","description":"Authorized-local evidence follows CLOAK_VISIBILITY_MODE; configured Postgres without evidence returns an honest empty list"},{"method":"GET","path":"/api/v1/evidence/{id}","auth":"public","description":"Evidence detail with protected evidence only when PLATPHORM_API_KEY is supplied"},{"method":"GET","path":"/api/v1/stealthscore","auth":"public","description":"Case-derived StealthScore when Postgres self-case state exists"},{"method":"GET","path":"/api/v1/risk/summary","auth":"public","description":"Explainable case-derived risk summary"},{"method":"GET","path":"/api/v1/calendar","auth":"public","description":"Case-derived cadence from persisted tasks"},{"method":"GET","path":"/api/v1/reports","auth":"public","description":"Case-derived executive report summary"},{"method":"GET","path":"/api/v1/production-readiness","auth":"public","description":"Production readiness from real runtime, selected-client, case, and Vercel ecosystem state","externalActionTaken":false},{"method":"GET","path":"/api/v1/vercel/notebook","auth":"public","description":"Public-safe Vercel Observability Notebook blueprint for cron, Function, runtime-cache, Stripe, and middleware operations","externalActionTaken":false},{"method":"POST","path":"/api/v1/portal/session/role","auth":"public","description":"Create a scoped RBAC role session for Admin User, Case Manager, or Customer Michael Barbine view","externalActionTaken":false},{"method":"POST","path":"/api/v1/portal/session/pilot-role","auth":"public","description":"Legacy compatibility alias for scoped RBAC role sessions","externalActionTaken":false},{"method":"GET","path":"/api/v1/paywall/status","auth":"public","description":"Stripe paywall readiness using CLOAK3D_STRIPE_* server env names without exposing key values","externalActionTaken":false},{"method":"POST","path":"/api/v1/paywall/checkout","auth":"public","description":"Create a Stripe Checkout session for Custom Cloak when CLOAK3D_STRIPE_SECRET_KEY is configured; Base Cloak returns a free-plan result","externalActionTaken":"true only when Stripe Checkout is called and accepts the session"},{"method":"POST","path":"/api/v1/paywall/webhook","auth":"stripe-signature","description":"Receive verified Stripe webhook events and record protected billing intents","externalActionTaken":false},{"method":"GET","path":"/api/v1/integrations","auth":"public","description":"Runtime integration registry with missing env and handoff readiness"},{"method":"GET","path":"/api/v1/integrations/status","auth":"public","description":"Runtime integration status from the shared registry"},{"method":"GET","path":"/api/v1/integrations/vercel-connect","auth":"public","description":"Vercel Connect connector and callback readiness with token non-exposure metadata","externalActionTaken":false},{"method":"GET","path":"/api/v1/trust-artifacts","auth":"public","description":"Public-safe platform trust artifact links for AgentOps, TrustOps, WebhookLab, and Sandbox","externalActionTaken":false},{"method":"GET","path":"/api/v1/ui","auth":"public","description":"Product UI route registry and capability state"},{"method":"GET","path":"/api/v1/ui/screens","auth":"public","description":"Product screen registry"},{"method":"GET","path":"/api/v1/capabilities","auth":"public","description":"PED OS capability catalog, screen bindings, and Docker/Vercel support flags"},{"method":"GET","path":"/api/v1/cockpit/actions","auth":"public","description":"List allowlisted cockpit action surfaces backed by server-side PLATPHORM_API_KEY"},{"method":"POST","path":"/api/v1/cockpit/actions","auth":"public-server-key","description":"Execute an allowlisted cockpit action through backend operator routes; browser never receives PLATPHORM_API_KEY"},{"method":"GET","path":"/api/v1/setup","auth":"public","description":"Persistent backend setup status"},{"method":"GET","path":"/api/v1/loop","auth":"public","description":"Defense loop ledger from principal to report"},{"method":"GET","path":"/api/v1/intents","auth":"public","description":"Protected intent ledger backed by Postgres when configured"},{"method":"GET","path":"/api/v1/actions","auth":"public","description":"Case-derived action packet list from Postgres when configured"},{"method":"POST","path":"/api/v1/capabilities","auth":"api-key","description":"Bootstrap Postgres capability support"},{"method":"POST","path":"/api/v1/setup","auth":"api-key","description":"Initialize Cloudflare D1 persistence tables for Vercel production"},{"method":"POST","path":"/api/v1/workloads/self-case","auth":"api-key","description":"Execute authorized self-case workload with protected profile, evidence, case findings, case tasks, and audit intent","externalActionTaken":false},{"method":"POST","path":"/api/v1/kanban/tasks","auth":"api-key","description":"Create a persisted local case task when Postgres is configured","externalActionTaken":false},{"method":"POST","path":"/api/v1/kanban/tasks/{id}/move","auth":"api-key","description":"Move a persisted local case task between lanes","externalActionTaken":false},{"method":"POST","path":"/api/v1/loop","auth":"api-key","description":"Record a Postgres loop ledger checkpoint"},{"method":"GET","path":"/api/events","auth":"public","description":"event outbox"},{"method":"POST","path":"/api/v1/action-packets/draft","auth":"api-key","description":"Generate and persist a dry-run action packet draft from active case findings","dryRun":true,"externalActionTaken":false},{"method":"POST","path":"/api/v1/actions/{id}/approve","auth":"api-key","description":"Persist local human approval for a dry-run action packet","externalActionTaken":false},{"method":"POST","path":"/api/v1/actions/{id}/reject","auth":"api-key","description":"Persist local human rejection for a dry-run action packet","externalActionTaken":false},{"method":"POST","path":"/api/v1/actions/{id}/send","auth":"api-key","description":"Blocked external send intent; no external action executes","externalActionTaken":false},{"method":"POST","path":"/api/v1/reports/RPT-EXEC-001/review","auth":"api-key","description":"Record local case-derived report review intent","externalActionTaken":false},{"method":"POST","path":"/api/v1/reports/RPT-EXEC-001/publish-docs","auth":"api-key","description":"Publish a visibility-policy report to PlatPhorm Docs through server-side PLATPHORM_API_KEY; returns downstreamActionTaken"},{"method":"GET","path":"/api/v1/reports/RPT-EXEC-001/export-sheets","auth":"public","description":"Read-only Sheets export preview with clickable evidence references","externalActionTaken":false},{"method":"POST","path":"/api/v1/reports/RPT-EXEC-001/export-sheets","auth":"api-key","description":"Export report rows to PlatPhorm Sheets through server-side PLATPHORM_API_KEY; returns downstreamActionTaken"},{"method":"POST","path":"/api/v1/reports/RPT-EXEC-001/upload-files","auth":"api-key","description":"Upload report markdown to PlatPhorm Files through server-side PLATPHORM_API_KEY; returns downstreamActionTaken"},{"method":"POST","path":"/api/v1/reports/RPT-EXEC-001/run-browserops","auth":"api-key","description":"Run a BrowserOps journey for the Cloak case surface through server-side PLATPHORM_API_KEY; returns downstreamActionTaken"},{"method":"POST","path":"/api/v1/reports/RPT-EXEC-001/run-sandbox","auth":"api-key","description":"Start a Sandbox lifecycle run with visibility-policy report context through server-side PLATPHORM_API_KEY; returns downstreamActionTaken"},{"method":"GET","path":"/api/v1/operator/workflows/self-case","auth":"public","description":"Inspect Vercel Workflow readiness for the authorized self-case pipeline","externalActionTaken":false},{"method":"POST","path":"/api/v1/operator/workflows/self-case","auth":"server-operator","description":"Queue the durable Vercel Workflow self-case pipeline on Vercel, or record a blocked workflow intent locally","externalActionTaken":false},{"method":"POST","path":"/api/v1/operator/clients","auth":"server-operator","description":"Save an authorized client profile through server-side PLATPHORM_API_KEY and Postgres","externalActionTaken":false},{"method":"GET","path":"/api/v1/operator/osint/connectors","auth":"server-operator","description":"List Sherlock, SpiderFoot, Epieos, IntelTechniques, recovery-answer review, Hunchly, Overpass, public filings, and ACE connector readiness","externalActionTaken":false},{"method":"POST","path":"/api/v1/operator/osint/connectors","auth":"server-operator","description":"Run authorized OSINT connector adapters and persist real findings, evidence, tasks, protected intents, and recovery-answer human-review opportunities without storing answer values","externalActionTaken":"true only when a bounded external source fetch is requested and succeeds"},{"method":"GET","path":"/api/v1/operator/osint/runs","auth":"server-operator","description":"List persisted OSINT run ledger rows under the active visibility policy","externalActionTaken":false},{"method":"POST","path":"/api/v1/operator/phone/numverify","auth":"server-operator","description":"Queue or run APILayer Numverify validation for an authorized phone identifier and persist evidence, task, webhook, Sandbox, and intent records","externalActionTaken":"true when Numverify or downstream platform handoffs are attempted"},{"method":"POST","path":"/api/v1/operator/schedules/osint","auth":"server-operator","description":"Create persisted daily, weekly, monthly, or one-time OSINT approval schedules","externalActionTaken":false},{"method":"POST","path":"/api/v1/operator/schedules/osint/progress","auth":"server-operator","description":"Advance due OSINT schedules and linked Kanban cards","externalActionTaken":false},{"method":"POST","path":"/api/v1/operator/infrastructure/aws","auth":"server-operator","description":"Plan or execute AWS S3/RDS infrastructure actions with server-side AWS credentials","externalActionTaken":"true when AWS creates or confirms a resource"},{"method":"POST","path":"/api/v1/operator/webhooks/test","auth":"server-operator","description":"Emit or record a protected Cloak webhook event using server-side signing configuration","externalActionTaken":"true only when a webhook target is configured and attempted"},{"method":"POST","path":"/api/v1/integrations/{service}/{action}","auth":"api-key","description":"Record a protected integration intent, delegate supported report handoffs, or return an honest missing-config/no-executor state"},{"method":"POST","path":"/api/v1/integrations/vercel-connect","auth":"rbac-or-api-key","description":"Start Vercel Connect authorization or inspect token metadata without returning provider tokens to the browser","externalActionTaken":false},{"method":"POST","path":"/api/webhooks","auth":"hmac-signature","idempotent":true}]},"ui":{"scaffolded":false,"externalActionTaken":false,"routes":[{"path":"/","url":"https://cloak.platphormnews.com"},{"path":"/onboarding","url":"https://cloak.platphormnews.com/onboarding"},{"path":"/case","url":"https://cloak.platphormnews.com/case"},{"path":"/case/exposures","url":"https://cloak.platphormnews.com/case/exposures"},{"path":"/case/evidence","url":"https://cloak.platphormnews.com/case/evidence"},{"path":"/case/risk","url":"https://cloak.platphormnews.com/case/risk"},{"path":"/case/kanban","url":"https://cloak.platphormnews.com/case/kanban"},{"path":"/case/calendar","url":"https://cloak.platphormnews.com/case/calendar"},{"path":"/case/actions","url":"https://cloak.platphormnews.com/case/actions"},{"path":"/portal/customer","url":"https://cloak.platphormnews.com/portal/customer"},{"path":"/portal/management","url":"https://cloak.platphormnews.com/portal/management"},{"path":"/case/report","url":"https://cloak.platphormnews.com/case/report"},{"path":"/case/trace","url":"https://cloak.platphormnews.com/case/trace"},{"path":"/case/settings","url":"https://cloak.platphormnews.com/case/settings"},{"path":"/docs","url":"https://cloak.platphormnews.com/docs"},{"path":"/api/docs","url":"https://cloak.platphormnews.com/api/docs"}],"states":"authorized_local, fixture_fallback, local_preview, dry_run, connected, configured, missing_env, protected_required, human_review_required, waiting_client, waiting_partner, waiting_operator, ready_for_review, approved, blocked, degraded, unavailable, future, complete"},"auth":{"readEndpoints":"public-safe redacted authorized-local case data, with fixture fallback only when persistence is unconfigured","stateChanging":"Authorization: Bearer $PLATPHORM_API_KEY or X-PlatPhorm-API-Key: $PLATPHORM_API_KEY","webhooks":"HMAC x-cloak-signature"},"guardrails":{"humanApproval":"required for all external actions","aiAutoSubmit":false,"aiFallback":"deterministic template draft when AI Gateway unavailable"},"feeds":{"rss":"https://cloak.platphormnews.com/rss.xml","sitemap":"https://cloak.platphormnews.com/sitemap.xml"}}