# OpenAPI Security Audit — OWASP API Top 10 2023 Contract Checks > OpenAPI Security Audit — OWASP API Top 10 2023 Contract Checks is a paid API for AI agents from 47-85-47-24.sslip.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-16). Audits a built-in vulnerable OpenAPI 3.1 contract against deterministic OWASP API Security Top 10 2023 checks and returns risk score, findings, and remediation plan without active scanning ## Facts - Endpoint: GET https://47-85-47-24.sslip.io/v1/openapi-security - Price: $0.001/call - Payment: x402 - Status: unknown - Last checked: 2026-09-16 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/openapi-security-audit-owasp-api-top-10-2023-contract-checks-cda7f921 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_JsM9UmotrctxCX-AtfHC9 Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability openapi-security-audit-owasp-api-top-10-2023-contract-checks-cda7f921 ``` Example prompt: Run an OWASP API Security Top 10 audit on the insecure-admin-contract scenario and give me the risk score, verdict, and remediation steps — no active scanning, just static contract analysis. ## When to prefer this Choose this endpoint when you need a deterministic, static OWASP API Security Top 10 2023 contract-level audit without spinning up active scanners or sending live traffic to a target API. Ideal for CI/CD pipelines, security demos, or evaluating what a full API audit report looks like before implementing against real specs. ## Known failure modes - Invalid or missing scenario param returns an error — only 'insecure-admin-contract' is accepted - Unsupported HTTP method returns 405 — only GET/HEAD/DELETE are allowed - Payment failure or missing x402 header returns 402 Payment Required - Service unavailable returns 503 with no analysis output ## How this service works An autonomous paid API accepting USDC on Base mainnet. ## Output Returns a JSON object with analysis_id, analyzer_version, label, profile (internet/internal), verdict (BLOCK/WARN/PASS), integer risk_score (0-100), summary text, per-operation analysis array, findings array with OWASP-mapped issues, a remediation_plan list, and a coverage object showing which checks were applied. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET", "HEAD", "DELETE" ], "type": "string" }, "queryParams": { "type": "object", "properties": { "scenario": { "enum": [ "insecure-admin-contract" ], "type": "string", "description": "Built-in paid OpenAPI security-review scenario" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "analysis_id", "analyzer_version", "label", "profile", "verdict", "risk_score", "summary", "stats", "operations", "findings", "remediation_plan", "coverage" ], "properties": { "label": { "type": "string" }, "stats": { "type": "object" }, "profile": { "enum": [ "internet", "internal" ], "type": "string" }, "summary": { "type": "string" }, "verdict": { "enum": [ "BLOCK", "WARN", "PASS" ], "type": "string" }, "coverage": { "type": "object" }, "findings": { "type": "array", "items": { "type": "object" } }, "operations": { "type": "array", "items": { "type": "object" } }, "risk_score": { "type": "integer", "maximum": 100, "minimum": 0 }, "analysis_id": { "type": "string" }, "analyzer_version": { "type": "string" }, "remediation_plan": { "type": "array", "items": { "type": "string" } } } } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "label": "paid-demo:insecure-admin-contract", "stats": { "low": 1, "high": 5, "medium": 2, "critical": 0, "findings": 8, "operations": 2, "security_schemes": 1, "write_operations": 1, "remote_references": 0, "protected_operations": 0, "anonymous_or_public_operations": 2 }, "profile": "internet", "summary": "BLOCK: 8 finding(s) across 2 operation(s); 5 high, 2 medium, 1 low.", "verdict": "BLOCK", "coverage": { "rules": [ "authentication and authorization declarations", "security-scheme transport and flow choices", "resource bounds for pagination and request bodies", "sensitive response and privileged input fields", "deployment transport and API inventory hygiene", "external reference trust boundaries" ], "standard": "OWASP API Security Top 10 2023", "local_refs": true, "limitations": "A contract cannot prove runtime authorization, rate limiting, input enforcement, or exploitability; verify findings against implementation and gateway policy.", "active_scanning": false, "exploit_attempts": false, "contract_level_only": true, "remote_refs_fetched": false }, "findings": [ { "code": "api_key_in_query", "summary": "An API key is transmitted in the URL query string.", "evidence": "Security scheme 'queryKey' uses in=query.", "location": "$.components.securitySchemes/queryKey", "severity": "high", "remediation": "Move credentials to an Authorization or purpose-specific request header.", "risk_weight": 18, "owasp_api_2023": "API2:2023 Broken Authentication" }, { "code": "sensitive_response_without_required_auth", "summary": "An unauthenticated success response documents sensitive-looking fields.", "evidence": "refresh_token", "location": "$.paths//accounts/get/responses", "severity": "high", "remediation": "Require object/property authorization and remove secrets from response schemas.", "risk_weight": 20, "owasp_api_2023": "API3:2023 Broken Object Property Level Authorization" }, { "code": "write_operation_without_required_auth", "summary": "A state-changing operation does not require documented authentication.", "evidence": "Effective security mode is anonymous.", "location": "$.paths//admin/users/{id}/delete", "severity": "high", "remediation": "Require an appropriate security scheme and enforce function-level authorization.", … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/openapi-security-audit-owasp-api-top-10-2023-contract-checks-cda7f921/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from 47-85-47-24.sslip.io](https://www.zero.xyz/host/47-85-47-24.sslip.io/llms.txt)