{"openapi":"3.1.0","info":{"title":"PasswordAudit API","version":"0.1.0","description":"A password-hygiene/breach-awareness checklist extending keyforge: a real reuse-risk score from self-reported account counts, a credential-stuffing explainer, a password-manager migration guide, a breach-exposure awareness guide, and a hygiene checklist. All local -- never accepts an actual password or performs a live breach lookup.\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://passwordaudit.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"hr@unifydynamics.com","url":"https://connectorbay.com/passwordaudit/docs"},"termsOfService":"https://connectorbay.com/passwordaudit/terms"},"servers":[{"url":"https://passwordaudit.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/passwordaudit/docs"},"security":[{},{"bearer":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/reuse_risk_score":{"post":{"operationId":"reuse_risk_score","summary":"A REAL computed reuse-risk assessment from self-reported COUNTS -- never an actual password. Given a","description":"A REAL computed reuse-risk assessment from self-reported COUNTS -- never an actual password. Given a\n    total account count and how many use a unique password, computes the percentage of accounts that share a\n    password with another account, the average number of accounts one leaked password would expose, and a\n    risk tier (excellent/low/moderate/high/critical). Use for \"I have 30 accounts and maybe 8 unique\n    passwords, how bad is that\", \"how many of my accounts probably share a password\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"total_accounts":{"description":"How many online accounts you're assessing in total.","maximum":100000,"minimum":1,"title":"Total Accounts","type":"integer"},"unique_passwords":{"description":"Of those, how many use a password unique to that one account (not shared with any other).","maximum":100000,"minimum":1,"title":"Unique Passwords","type":"integer"}},"required":["total_accounts","unique_passwords"],"title":"reuse_risk_scoreArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/credential_stuffing_explainer":{"post":{"operationId":"credential_stuffing_explainer","summary":"Explains credential stuffing: the automated attack that takes leaked email/password pairs from one","description":"Explains credential stuffing: the automated attack that takes leaked email/password pairs from one\n    breach and tries them against many other sites, and why password reuse across accounts is dangerous even\n    when no single account is individually targeted. Use for \"what is credential stuffing\", \"why does\n    reusing my password matter if I'm not a target\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"credential_stuffing_explainerArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/password_manager_migration_guide":{"post":{"operationId":"password_manager_migration_guide","summary":"A practical, staged plan for moving from memorized/reused passwords to a password manager: set a","description":"A practical, staged plan for moving from memorized/reused passwords to a password manager: set a\n    strong master password, import what you can, triage by account value (email and the manager itself\n    first), then migrate the rest as you naturally log in. Use for \"how do I switch to a password manager\",\n    \"where do I even start migrating my passwords\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"password_manager_migration_guideArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/breach_exposure_awareness_guide":{"post":{"operationId":"breach_exposure_awareness_guide","summary":"Explains what a breach-check service (like Have I Been Pwned) generally does, how privacy-preserving","description":"Explains what a breach-check service (like Have I Been Pwned) generally does, how privacy-preserving\n    password checks (k-anonymity) work conceptually, and what to do if you learn an account or password has\n    been exposed. This connector never performs a live breach-database lookup itself -- it's education on\n    using one safely. Use for \"what does a breach-check service actually do\", \"is it safe to check my\n    password on a breach site\", \"I got a breach notification, what do I do\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"breach_exposure_awareness_guideArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/password_hygiene_checklist":{"post":{"operationId":"password_hygiene_checklist","summary":"Ongoing password-hygiene habits -- unique password per account, encrypted storage only, 2FA","description":"Ongoing password-hygiene habits -- unique password per account, encrypted storage only, 2FA\n    everywhere it's offered, no scheduled rotation without cause, never sharing over chat/email -- separate\n    from how any single password is generated or scored. Use for \"password hygiene checklist\", \"good\n    password habits\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"password_hygiene_checklistArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}