# K8s Manifest Audit

> K8s Manifest Audit is a paid API for AI agents from api.zfinia.com, paid per call via x402, $0.16/call, status unknown (last checked 2026-10-10).

Audits Kubernetes YAML manifests against a caller-defined contract, flagging image tag issues, missing resource limits, absent probes, security risks, and hardcoded credentials.

## Facts

- Endpoint: POST https://api.zfinia.com/x402/v1/kubernetes-manifest-audit?utm_source=zero.xyz
- Price: $0.16/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/k8s-manifest-audit-0ec6aa7e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_q3KJMB0l3Y_3dhYz4EZd8

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability k8s-manifest-audit-0ec6aa7e -d '<json body>'
```

Example prompt: Audit these Kubernetes manifests for me — require the labels 'app' and 'team', enforce resource limits and both probes, and flag any mutable image tags or privileged containers.

## When to prefer this

Choose this endpoint when you need a fast, policy-driven audit of Kubernetes manifests before deployment or in a CI/CD pipeline, especially when you want to enforce a custom contract (specific labels, probe requirements, image tag policies) rather than a generic linter. It is purpose-built for Kubernetes YAML and checks both security posture and operational hygiene in a single call, making it ideal for automated gatekeeping without standing up your own tooling.

## Known failure modes

- Invalid or malformed YAML that cannot be parsed — reported as parse errors rather than causing a crash
- Manifests exceeding the 256KB character limit will be rejected
- Missing required contract fields may cause incomplete validation
- Non-Kubernetes YAML structures may produce unexpected or empty results
- Network or payment authorization failures return HTTP 402 or 5xx errors

## How this service works

Audit a set of Kubernetes manifests against a contract the caller states. Reports an image with no tag or the latest tag, which changes under you; absent resource requests or limits; absent readiness or liveness probes; a missing required label; hostNetwork, hostPID, a hostPath volume or a privileged container; and a credential-shaped environment variable set to a literal, whose value is never echoed. YAML parsing surprises are reported rather than inherited.

## Output

Returns a structured audit report listing violations per manifest resource, including: image tag issues (untagged or 'latest'), missing resource requests/limits, absent readiness or liveness probes, missing required labels, security misconfigurations (hostNetwork, hostPID, hostPath, privileged containers), credential-shaped environment variables with literal values, and any YAML parsing errors encountered.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "contract": {
   "type": "object",
   "properties": {
    "require_labels": {
     "type": "array",
     "items": {
      "type": "string",
      "maxLength": 316
     },
     "maxItems": 50,
     "minItems": 1
    },
    "require_probes": {
     "type": "boolean"
    },
    "require_resource_limits": {
     "type": "boolean"
    },
    "require_security_context": {
     "type": "boolean"
    },
    "forbid_mutable_image_tags": {
     "type": "boolean"
    }
   },
   "additionalProperties": false
  },
  "manifests": {
   "type": "string",
   "maxLength": 262144
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/k8s-manifest-audit-0ec6aa7e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.zfinia.com](https://www.zero.xyz/host/api.zfinia.com/llms.txt)