UNCLASSIFIED
UNCLASSIFIED

Public API Index

Every public claim on this site maps to a live endpoint. This page is the menu. Working code or it does not exist. Internal control-mapping and self-assessment artifacts are gated; access is available to authenticated federal evaluators on request via /evaluate#rfi. For the published standards and doctrine each claim aligns to, see /standards.

Legend. LIVE always-on, public. CACHED uses a cached corpus when the upstream feed is paid or rate-limited; corpus date returned in payload. GATED 403 without an evaluator token; x-evaluator-access: <token> or Authorization: Bearer <token>.

Live geospatial & hazard feeds

MethodPathDescription
GET/api/dual-use/fires LIVENASA FIRMS active-fire detections (VIIRS / MODIS). Always live.
GET/api/dual-use/earthquakes LIVEUSGS recent seismic events. Always live.
GET/api/dual-use/weather-alerts LIVENOAA NWS active CAP alerts. Always live.
GET/api/dual-use/space-weather LIVENOAA SWPC geomagnetic / solar conditions.

Vendor identity & capability

MethodPathDescription
GET/api/capability-brief LIVECanonical machine-readable capability statement: UEI, CAGE, NAICS, SDVOSB-pending status, vehicles, authorities not held.
GET/api/fema/manifest LIVEFEMA-facing manifest: integration surfaces, IPAWS posture, COG-ID status (honest).
GET/api/crada/jws-template LIVEJoint Work Statement template under 15 USC 3710a (CRADA).
GET/api/crada/target-labs LIVEFederal lab Technology Transfer office contact pattern (no agency-shopping).

Platform health & system map

MethodPathDescription
GET/api/health LIVELiveness check. Returns build, uptime, module count.
GET/api/system-map LIVEModule catalog with stage (live / cached / stub) per surface.
GET/sitemap.xml LIVEPublic sitemap. Internal pages are not listed.

Internal control-mapping — evaluator-gated

These endpoints return 403 without a token. They are not for the open web. They are available to authenticated federal evaluators on request. Submit an RFI at /evaluate#rfi and a token is issued by reply within one business day.

MethodPathDescription
GET/api/ai-security/compliance/cmmc-l2 GATEDCMMC L2 internal control-mapping (self-assessment, not certified).
GET/api/ai-security/compliance/fedramp GATEDFedRAMP control-intent mapping (no ATO claimed).
GET/api/ai-security/cmmc/l2-assessment GATEDL2 self-assessment evidence catalog.
GET/api/ai-security/fedramp/ssp-evidence GATEDSSP-shaped evidence pointers (internal).
GET/api/cmmc/evidence-collection GATEDHash-chained evidence collection log.
GET/api/compliance/evidence/export GATEDEvidence bundle export (NDA-on-request).

30-second smoke test

curl -s https://secureassure.app/api/health | jq .
curl -s "https://secureassure.app/api/dual-use/earthquakes?limit=5" | jq '.features | length'
curl -s "https://secureassure.app/api/dual-use/weather-alerts?limit=5" | jq '.alerts | length // .features | length'
curl -s https://secureassure.app/api/capability-brief | jq '.identity, .vehicles, .authoritiesNotHeld'

# Gated endpoint without token returns 403
curl -i https://secureassure.app/api/ai-security/compliance/cmmc-l2

# With evaluator token
curl -s -H "x-evaluator-access: $TOKEN" \
  https://secureassure.app/api/ai-security/compliance/cmmc-l2 | jq .
Honesty signals embedded in every response. The capability-brief endpoint enumerates the authorities ISS LLC does not hold (FedRAMP, IL-5, FIPS, CAC, SIPRNET, ATO, CMMC-L2 cert) so a contracting officer can verify in one curl. The FEMA manifest reports IPAWS COG-ID as not-issued until a sponsoring AO issues one. Self-assessment compliance artifacts are gated; the public surface only points at them.
CHEATSHEET
ASK AI
PRESENCE
⚠ SANDBOX / TRAINING MODE — Live read-only data. Write commands are inhibited (train as you fight, missile button safed).