{
  "openapi": "3.1.0",
  "info": {
    "title": "PhishDestroy Threat Intelligence API",
    "version": "1.0.0",
    "description": "Public read-only CTI API: platform stats, live-ping probes, threat feeds. Volunteer-driven anti-phishing intelligence — no auth required for public endpoints.",
    "contact": {
      "name": "PhishDestroy",
      "url": "https://phishdestroy.io",
      "email": "abuse@phishdestroy.io"
    },
    "license": {
      "name": "CC-BY-4.0",
      "url": "https://creativecommons.org/licenses/by/4.0/"
    }
  },
  "servers": [
    {
      "url": "https://phishdestroy.io",
      "description": "Production"
    }
  ],
  "paths": {
    "/api/stats.php": {
      "get": {
        "summary": "Platform counters (total / alive / dead / recent)",
        "operationId": "getStats",
        "tags": [
          "stats"
        ],
        "responses": {
          "200": {
            "description": "Aggregate counts",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Stats"
                }
              }
            }
          }
        }
      }
    },
    "/api/stats-cti.php": {
      "get": {
        "summary": "CTI-specific stats (campaigns, registrars, geo aggregates)",
        "operationId": "getCtiStats",
        "tags": [
          "stats"
        ],
        "responses": {
          "200": {
            "description": "CTI aggregate data",
            "content": {
              "application/json": {}
            }
          }
        }
      }
    },
    "/api/probe.php": {
      "get": {
        "summary": "Live-check a domain (liveping / redirect / cdnbypass)",
        "operationId": "probe",
        "tags": [
          "probe"
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Domain to probe, e.g. example.com"
          },
          {
            "name": "type",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "enum": [
                "liveping",
                "redirect",
                "cdnbypass"
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Probe result",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProbeResult"
                }
              }
            }
          },
          "400": {
            "description": "Bad domain or SSRF blocked"
          },
          "429": {
            "description": "Rate limited"
          }
        }
      }
    },
    "/feed.xml": {
      "get": {
        "summary": "Editorial Atom feed (news, investigations)",
        "operationId": "getFeed",
        "tags": [
          "feeds"
        ],
        "responses": {
          "200": {
            "description": "Atom 1.0 feed",
            "content": {
              "application/atom+xml": {}
            }
          }
        }
      }
    },
    "/feed-threats.xml": {
      "get": {
        "summary": "Threat detection Atom feed (newly flagged domains)",
        "operationId": "getThreatFeed",
        "tags": [
          "feeds"
        ],
        "parameters": [
          {
            "name": "brand",
            "in": "query",
            "schema": {
              "type": "string"
            },
            "description": "Filter by target brand"
          },
          {
            "name": "registrar",
            "in": "query",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Atom 1.0 feed of threats",
            "content": {
              "application/atom+xml": {}
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "Stats": {
        "type": "object",
        "properties": {
          "ok": {
            "type": "boolean"
          },
          "total": {
            "type": "integer",
            "description": "Total domains tracked"
          },
          "alive": {
            "type": "integer"
          },
          "dead": {
            "type": "integer"
          },
          "last_update": {
            "type": "string",
            "format": "date-time"
          }
        }
      },
      "ProbeResult": {
        "type": "object",
        "properties": {
          "ok": {
            "type": "boolean"
          },
          "domain": {
            "type": "string"
          },
          "type": {
            "type": "string"
          },
          "data": {
            "type": "object",
            "properties": {
              "live": {
                "type": "boolean"
              },
              "http": {
                "type": "integer"
              },
              "probed_at": {
                "type": "integer",
                "format": "unix-timestamp"
              },
              "method": {
                "type": "string"
              }
            }
          }
        }
      }
    }
  },
  "tags": [
    {
      "name": "stats",
      "description": "Platform aggregate counts"
    },
    {
      "name": "probe",
      "description": "Domain liveness / redirect / cloaking probes"
    },
    {
      "name": "feeds",
      "description": "Syndication feeds (Atom/RSS)"
    }
  ],
  "externalDocs": {
    "description": "Full LLM-readable documentation",
    "url": "https://phishdestroy.io/llms-full.txt"
  }
}