{
  "openapi": "3.0.3",
  "info": {
    "title": "Waltsoft ShieldForm API",
    "version": "1.1",
    "description": "ShieldForm is a bot detection API for web forms. The ShieldForm browser SDK (https://shieldform.waltsoft.net/sdk/v1/sf.js) records how the visitor used the page and getToken() returns a token; POST /verify scores that token 0-100 and returns allow, challenge or block. The token is base64 of JSON {\"s\": site, \"t\": ms, \"sg\": {\"m\": mouse moves, \"k\": keystrokes, \"kt\": average ms between keystrokes, \"f\": field focus events, \"sc\": scroll depth %, \"to\": touches, \"v\": tab switches, \"tp\": ms on page, \"fi\": ms since the first field was used}, \"fp\": fingerprint}, so a server or an agent can also build it. Authenticate with your AWS Marketplace key (mp_...) as X-API-Key or Authorization: Bearer. Without a key the API answers 402 with an x402 challenge ($0.005 in USDC on Base or Solana). Only successful calls are billed.\n"
  },
  "servers": [
    {
      "url": "https://shieldform.waltsoft.net",
      "description": "ShieldForm production API"
    }
  ],
  "security": [
    {
      "ApiKeyAuth": []
    }
  ],
  "paths": {
    "/verify": {
      "post": {
        "operationId": "verifySubmission",
        "summary": "Score a form submission for bot behavior",
        "description": "Scores one form submission from its ShieldForm SDK token. Start at 100 and subtract for bot-like behavior: under 3 s on the page (-40), no mouse and no touch (-25), no keystrokes (-15), no field focus (-20), no scroll after 5 s (-10), keystrokes under 30 ms apart on average (-15), the form filled in under 1 s (-15), a fingerprint seen more than 5 times whose most recent score was under 40 (-30), and for the optional email four or more dots (-15) or seven or more consonants in a row (-10) in the local part. decision is allow at 70 or more, challenge at 40-69, block under 40. With no token, or a token without behavioral signals, the score is the neutral 50 (challenge) and token_valid is false. Billed per successful call.\n",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "token"
                ],
                "properties": {
                  "token": {
                    "type": "string",
                    "description": "The ShieldForm SDK token (ShieldForm.getToken() in the browser), base64 JSON as described above."
                  },
                  "email": {
                    "type": "string",
                    "description": "Optional. The email address submitted with the form."
                  },
                  "siteKey": {
                    "type": "string",
                    "description": "Optional. Your own label for the form or site; events are grouped under it."
                  }
                }
              },
              "example": {
                "token": "eyJzIjogIiIsICJ0IjogMTc2MDU1MDAwMDAwMCwgInNnIjogeyJtIjogNDIsICJzYyI6IDM1LCAiayI6IDI0LCAia3QiOiAxNDAsICJmIjogMywgInRvIjogMCwgInYiOiAwLCAidHAiOiA5MjAwLCAiZmkiOiA1MTAwfSwgImZwIjogImszajl4MiJ9",
                "email": "jane.doe@example.com"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "The submission's score and decision",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Verdict"
                },
                "example": {
                  "score": 100,
                  "decision": "allow",
                  "requestId": "3f2a9c1d7b4e",
                  "token_valid": true
                }
              }
            }
          },
          "400": {
            "description": "The body is not a JSON object, or token, email or siteKey is not a string (not billed)",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "error": {
                      "type": "string"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Invalid or inactive API key (not billed)",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "402": {
            "description": "No API key sent. The body and the PAYMENT-REQUIRED header carry the x402 challenge ($0.005 USDC on Base or Solana)."
          },
          "429": {
            "description": "Too many requests (API Gateway stage throttle)"
          },
          "503": {
            "description": "The API key service is unavailable; retry (not billed)",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key"
      }
    },
    "schemas": {
      "Verdict": {
        "type": "object",
        "properties": {
          "score": {
            "type": "integer",
            "minimum": 0,
            "maximum": 100,
            "description": "0-100, higher is more human"
          },
          "decision": {
            "type": "string",
            "enum": [
              "allow",
              "challenge",
              "block"
            ],
            "description": "allow at 70 or more, challenge at 40-69, block under 40"
          },
          "requestId": {
            "type": "string",
            "description": "12 hex characters identifying this verification"
          },
          "token_valid": {
            "type": "boolean",
            "description": "false when no token or a token without behavioral signals was sent (the score is then the neutral 50)"
          }
        }
      },
      "Error": {
        "type": "object",
        "properties": {
          "error": {
            "type": "object",
            "properties": {
              "code": {
                "type": "integer"
              },
              "message": {
                "type": "string"
              }
            }
          }
        }
      }
    }
  }
}