{
  "aod": "0.1",
  "provider": {
    "name": "Ironfang Ltd - Ironfang Audit API",
    "url": "https://ironfang.com/audit",
    "portalUrl": "https://portal.ironfang.com",
    "apisJsonUrl": "https://ironfang.com/apis.json"
  },
  "maturity": "console-only",
  "account": {
    "required": true,
    "signupUrl": "https://id.ironfang.com/signup?return_to=https%3A%2F%2Fportal.ironfang.com%2Fproducts%2Faudit",
    "agentPolicy": "unspecified",
    "prerequisites": [
      "An email address (or a Google account).",
      "Your country, declared at signup."
    ],
    "plans": [
      {
        "name": "Free",
        "requiredFor": "Every account, with no card: a free allowance on every meter, renewed on the first day of each UTC calendar month. When an allowance runs out, that work stops until the next month and nothing is charged.",
        "url": "https://ironfang.com/pricing#audit"
      },
      {
        "name": "Pay as you go",
        "requiredFor": "Usage past the free allowances at graduated rates, within the monthly usage limit before VAT the account sets and any product limit; work that would pass a limit is refused before it starts. Switched on, paused and limited in the portal by a person with billing rights; one itemised invoice a month for every product.",
        "url": "https://ironfang.com/pricing#audit"
      }
    ],
    "termsOfService": {
      "url": "https://ironfang.com/legal/terms",
      "acceptance": "implicit"
    }
  },
  "verification": [
    {
      "name": "Email verification",
      "description": "A verification link is emailed at signup. It confirms the address; API keys can be minted before it is clicked.",
      "blocking": false,
      "expectedLatency": "minutes"
    }
  ],
  "registration": {
    "applicationNoun": "API key",
    "owner": "organization",
    "mechanisms": [
      {
        "type": "console-only",
        "description": "Sign in to the portal, open API keys under Developers, choose the scopes (audit:* or narrower) and mint. The key belongs to the organisation and is shown once.",
        "baseUrl": "https://portal.ironfang.com/developers/api-keys",
        "docsUrls": [
          "https://ironfang.com/audit/docs#api-keys"
        ],
        "auth": "Browser session at id.ironfang.com (email and password, or Google)."
      },
      {
        "type": "dcr",
        "description": "MCP clients only: OAuth 2.1 dynamic client registration for the Ironfang MCP server. It does not issue API keys for the HTTP APIs.",
        "baseUrl": "https://mcp.ironfang.com/mcp",
        "docsUrls": [
          "https://ironfang.com/docs/mcp"
        ],
        "auth": "OAuth 2.1 with PKCE, approved by the person in the browser."
      }
    ]
  },
  "authentication": {
    "methods": [
      {
        "id": "platform-api-key",
        "type": "bearer-env",
        "env": [
          "IRONFANG_API_KEY"
        ],
        "header": "Authorization",
        "scheme": "Bearer",
        "tokenPrefix": "if_live_",
        "bootstrap": "A person signs in to https://portal.ironfang.com/developers/api-keys and mints a key with the scopes it needs. The key is shown once.",
        "notes": "Send the key as a bearer token to https://api.ironfang.com/audit. Scopes: audit:*, audit:read, audit:run, audit:manage, audit:evidence, audit:integrations."
      },
      {
        "id": "mcp-oauth",
        "type": "oauth-pkce-browser",
        "bootstrap": "An MCP client registers itself (dynamic client registration) and completes an OAuth 2.1 PKCE flow against https://id.ironfang.com; the person approves the scopes in the browser.",
        "notes": "For the MCP server at https://mcp.ironfang.com/mcp only. Resource metadata: https://mcp.ironfang.com/.well-known/oauth-protected-resource/mcp. Documentation: https://ironfang.com/docs/mcp"
      }
    ]
  },
  "credentials": [
    {
      "type": "api-key",
      "fields": {
        "key": "The secret, prefixed if_live_, sent as a bearer token."
      },
      "ttl": "Until revoked.",
      "rotation": "Mint a replacement in the portal, move traffic to it, revoke the old key. No API for either step.",
      "oneTimeDisplay": true
    },
    {
      "type": "webhook-secret",
      "fields": {
        "signing_secret": "HMAC secret for the signatures on webhook deliveries."
      },
      "ttl": "Until rotated.",
      "rotation": "POST https://api.ironfang.com/audit/v1/webhooks/{endpointId}/rotate-secret returns the new secret once.",
      "oneTimeDisplay": true
    }
  ],
  "scopes": {
    "model": "scope-strings",
    "vocabularyUrl": "https://ironfang.com/audit/docs#api-keys",
    "notes": "Ironfang Audit API: audit:*, audit:read, audit:run, audit:manage, audit:evidence, audit:integrations"
  },
  "gaps": [
    "API keys are minted, scoped and revoked by a person in the portal; there is no API to create or rotate them.",
    "There is no sandbox: the free monthly allowances are the trial, against production.",
    "No changelog page is published yet; the OpenAPI contracts carry the current version."
  ],
  "securityProfile": {
    "tier": "normal",
    "oauthMetadataUrl": "https://mcp.ironfang.com/.well-known/oauth-protected-resource/mcp",
    "senderConstraining": "none"
  },
  "flow": {
    "args": [
      {
        "name": "IRONFANG_API_KEY",
        "description": "An API key minted in the portal with the audit:read scope (or audit:*).",
        "required": true
      }
    ],
    "steps": [
      {
        "id": "verify-key",
        "description": "Prove the key works and read this month's Ironfang Audit usage. Requires audit:read.",
        "auth": "platform-api-key",
        "request": {
          "method": "GET",
          "url": "https://api.ironfang.com/audit/v1/usage",
          "headers": {
            "Authorization": "Bearer {args.IRONFANG_API_KEY}",
            "Accept": "application/json"
          }
        },
        "onStatus": {
          "200": {
            "action": "continue",
            "message": "The key is valid; the body holds this month's Ironfang Audit usage."
          },
          "401": {
            "action": "fail",
            "message": "The key is missing, malformed or revoked."
          },
          "403": {
            "action": "fail",
            "message": "The key exists but lacks audit:read."
          }
        }
      }
    ],
    "outputs": {
      "usage": "{steps.verify-key.body}"
    }
  },
  "economics": {
    "pricingUrl": "https://ironfang.com/pricing#audit",
    "freeTier": "Free each UTC calendar month on every account, with no card: 100 page captures. Page captures are kept 30 days as standard. A page capture is counted once its evidence record is finalised and stored; the number of sites and the schedule are not priced. Retention beyond the standard period is quoted as a fixed price for the evidence chosen, before it is bought.",
    "rateLimitsUrl": "https://ironfang.com/audit/docs#usage-api"
  }
}