CipherShift365 — REST API /v1

cd src/Portal/CipherShift365.Portal.Api
dotnet restore
dotnet run --urls http://localhost:5000

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*"
}

# Step 1 — Obtain a JWT token
curl -s -X POST http://localhost:5000/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"clientId":"admin-001","secret":"any"}'

# Response: { "token": "eyJhbGciOiJIUzI1NiIs..." }

# Step 2 — Use the token
curl -s http://localhost:5000/v1/findings?project=. \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

Client                          API
  |                               |
  |-- POST /v1/auth/token ------->|
  |   { clientId, secret }        |
  |                               |-- Lookup in LocalIdentityProvider
  |                               |-- Issue JWT (8h expiry, HMAC-SHA256)
  |<---- { token } ---------------|
  |                               |
  |-- GET /v1/findings?project=. ->|
  |   Authorization: Bearer <tok>  |
  |                               |-- Validate JWT (iss, aud, sig, exp)
  |                               |-- Extract role claim
  |                               |-- Authorize against EndpointPermissions
  |                               |-- If authorized: run scan, return JSON
  |<---- { findings: [...] } -----|

{
  "clientId": "admin-001",
  "secret": "any"
}

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

{
  "error": "Invalid credentials."
}

{
  "header": {
    "version": "1.0.0",
    "projectPath": ".",
    "kbVersion": "1.0.0",
    "generatedAt": "2026-06-29T12:00:00Z"
  },
  "assets": [
    {
      "logicalId": "abc123",
      "locationalId": "abc123::Program.cs:42",
      "role": "Signature",
      "algorithm": "RSA",
      "parameters": { "keySize": 2048 },
      "riskLevel": "QuantumBroken"
    }
  ],
  "signature": "base64-signature"
}

{
  "title": "Scan incomplete",
  "status": 500
}

{
  "count": 42,
  "quantumBroken": 18,
  "quantumVulnerable": 12,
  "mitigable": 8,
  "quantumSafe": 4,
  "findings": [
    {
      "algorithm": "RSA",
      "role": "Signature",
      "risk": "QuantumBroken",
      "confidence": "High",
      "location": "C:\\src\\Program.cs",
      "line": 42,
      "description": "RSA-2048 is vulnerable to Shor's algorithm."
    }
  ]
}

{
  "systemScore": 0.72,
  "componentCount": 12,
  "findingCount": 42
}

{
  "verdict": "NonCompliant",
  "compliant": 4,
  "nonCompliant": 14,
  "gaps": [
    {
      "algorithm": "RSA",
      "gapDescription": "RSA is not an approved CNSA 2.0 signature algorithm.",
      "recommendedAction": "Migrate to ML-DSA-65 (FIPS 204) or LMS/XMSS for code-signing."
    },
    {
      "algorithm": "ECDH",
      "gapDescription": "ECDH is not an approved CNSA 2.0 key establishment algorithm.",
      "recommendedAction": "Migrate to ML-KEM-768 (FIPS 203) or ECDH-NIST with PQC hybrid."
    }
  ],
  "evidence": {
    "profileName": "CNSA 2.0",
    "profileVersion": "1.0.0"
  }
}

{
  "totalEffortDays": 64,
  "itemCount": 18,
  "items": [
    {
      "urgency": "Critical",
      "algorithm": "RSA",
      "target": "ML-DSA-65",
      "effortDays": 3,
      "rationale": "RSA-2048 in key signing path — quantum-broken, must migrate before 2030."
    }
  ]
}

{
  "project": ".",
  "organization": "Acme Corp"
}

{
  "project": "/path/to/repo"
}

{
  "id": "a1b2c3d4e5f6",
  "status": "completed",
  "findings": 42
}

{
  "id": "a1b2c3d4e5f6",
  "status": "failed",
  "findings": 0
}

[
  {
    "id": "a1b2c3d4e5f6",
    "path": ".",
    "findingCount": 42,
    "score": 0.72,
    "status": "completed",
    "timestamp": "2026-06-29T12:00:00Z"
  }
]

[
  {
    "actor": "Security Admin",
    "action": "POST",
    "target": "/v1/scans",
    "timestamp": "2026-06-29T12:00:00Z",
    "detail": "Status: 200"
  }
]

{
  "error": "Internal server error",
  "id": "a1b2c3d4"
}

curl http://localhost:5000/openapi/v1.json

# Option A — npx serve + remote Swagger UI
npx swagger-ui-watcher openapi/v1.json --port 5500

# Option B — Use VS Code REST Client
# Option C — Download the spec and import into Postman/Insomnia

builder.Services.AddOpenApi();    // registers the document generator
app.MapOpenApi();                  // serves /openapi/v1.json

CipherShift365.Portal.Api/
├── Program.cs                  # Host builder, DI registration, middleware pipeline
├── Auth/
│   ├── JwtTokenService.cs      # JWT generation + validation (HMAC-SHA256)
│   ├── LocalIdentityProvider.cs # Pre-seeded identity store
│   └── RoleAuthorization.cs    # RBAC endpoint matrix
├── Controllers/V1/
│   ├── AuthController.cs       # POST /v1/auth/token
│   ├── ReadControllers.cs      # CBOM, Findings, Scores, CNSA (4 controllers)
│   ├── ActionControllers.cs    # Plan, Reports, Scan, History/Audit (5 controllers)
│   └── QuestionnaireController.cs # Questionnaire CRUD
├── Models/
│   └── ApiCredential.cs        # UserIdentity, ApiRole enum
├── Services/
│   └── ScanService.cs          # Scan orchestration + ScanHistoryService + AuditService
├── Middleware/
│   └── AuditMiddleware.cs      # Audit logging + ErrorHandlingMiddleware
├── Properties/
│   └── launchSettings.json
├── appsettings.json
└── CipherShift365.Portal.Api.csproj

[ApiController]
[Route("v1")]
public class CustomController : ControllerBase
{
    [HttpGet("custom")]
    [Authorize]
    public IActionResult Get() => Ok(new { message = "Hello" });
}

// In RoleAuthorization.cs:
["GET:/v1/custom"] = new[] { ApiRole.Executive, ApiRole.ConsultantAdmin },

// In Program.cs:
var kb = SignedKnowledgeBase.Load("kb-v2.signed");
builder.Services.AddSingleton<IKnowledgeBase>(kb);

# Full integration test
TOKEN=$(curl -s -X POST http://localhost:5000/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"clientId":"admin-001","secret":"any"}' | jq -r .token)

echo "--- FINDINGS ---"
curl -s http://localhost:5000/v1/findings?project=. \
  -H "Authorization: Bearer $TOKEN" | jq .

echo "--- SCORES ---"
curl -s http://localhost:5000/v1/scores?project=. \
  -H "Authorization: Bearer $TOKEN" | jq .

echo "--- CNSA ---"
curl -s http://localhost:5000/v1/cnsa-verdict?project=. \
  -H "Authorization: Bearer $TOKEN" | jq .

echo "--- PLAN ---"
curl -s http://localhost:5000/v1/plan?project=. \
  -H "Authorization: Bearer $TOKEN" | jq .

echo "--- AUDIT ---"
curl -s http://localhost:5000/v1/audit \
  -H "Authorization: Bearer $TOKEN" | jq .

$body = @{ clientId = "admin-001"; secret = "any" } | ConvertTo-Json
$tokenResp = Invoke-RestMethod -Uri "http://localhost:5000/v1/auth/token" -Method Post -Body$body -ContentType "application/json"
headers = @{ Authorization = "Bearer($tokenResp.token)" }
$findings = Invoke-RestMethod -Uri "http://localhost:5000/v1/findings?project=." -Headers$headers
Write-Host "Findings: $($findings.count) (Broken: $($findings.quantumBroken))"

import requests

BASE = "http://localhost:5000"
token = requests.post(f"{BASE}/v1/auth/token", json={"clientId": "admin-001", "secret": "any"}).json()["token"]
headers = {"Authorization": f"Bearer {token}"}

resp = requests.post(f"{BASE}/v1/questionnaire/submit", headers=headers, json={
    "templateId": "pqc-readiness-v1",
    "answers": [
        {"questionId": "q1.1", "value": "Yes, fully applicable", "score": 15},
        {"questionId": "q1.2", "value": "CNSA 2.0 compliance mandate", "score": 10},
    ]
})
print(resp.json()["score"]["readinessPercent"])

var client = new HttpClient { BaseAddress = new Uri("http://localhost:5000") };

// Authenticate
var authResp = await client.PostAsJsonAsync("/v1/auth/token", new { clientId = "admin-001", secret = "any" });
var authJson = await authResp.Content.ReadFromJsonAsync<JsonElement>();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", authJson.GetProperty("token").GetString());

// Render PDF
var pdfResp = await client.PostAsJsonAsync("/v1/reports/render", new { project = ".", organization = "Acme Corp" });
var pdf = await pdfResp.Content.ReadAsByteArrayAsync();
await File.WriteAllBytesAsync("report.pdf", pdf);