openapi: 3.1.0
info:
  title: Innovative Future Solutions Application Security Demo
  version: 1.3.0
  description: Public-safe endpoints used by the Cloudflare application-security walkthrough.
servers:
  - url: https://innovativefuturesolutions.com
paths:
  /api/health:
    get:
      operationId: getHealth
      summary: Return live edge and control health
      responses:
        '200':
          description: Healthy
  /api/security-controls:
    get:
      operationId: getSecurityControls
      summary: Return the deployment control snapshot
      responses:
        '200':
          description: Current configured control summary
  /api/demo/preflight:
    get:
      operationId: getDemoPreflight
      summary: Run public-safe readiness checks using live edge and configured-control evidence
      responses:
        '200':
          description: Readiness evidence
  /api/demo/request-inspection:
    get:
      operationId: inspectDemoRequest
      summary: Return redacted request and Cloudflare edge execution context
      responses:
        '200':
          description: Redacted edge request context
  /api/demo/profile:
    get:
      operationId: getDemoProfile
      summary: Return a public, synthetic demo profile
      responses:
        '200':
          description: Demo profile
  /api/demo/burst-control:
    get:
      operationId: getBurstControlTarget
      summary: Return a lightweight response until the edge rate limit blocks the request
      responses:
        '200': { description: Request reached the Worker }
        '429': { description: Request was rate limited at the Cloudflare edge }
  /api/demo/login:
    post:
      operationId: submitDemoLogin
      summary: Verify a Turnstile token; does not create a session
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [username, turnstileToken]
              properties:
                username: { type: string, maxLength: 120 }
                turnstileToken: { type: string }
      responses:
        '200': { description: Turnstile accepted }
        '400': { description: Invalid request or Turnstile token }
        '503': { description: Turnstile is not configured }
  /api/mcp:
    get:
      operationId: getMcpMetadata
      summary: Return public MCP server metadata
      responses:
        '200': { description: MCP metadata }
    post:
      operationId: callMcp
      summary: Call the public read-only MCP server
      responses:
        '200': { description: JSON-RPC response }
