openapi: 3.0.3
info:
  title: SOC Demo Flask API
  version: 1.0.0
  description: OpenAPI-first Flask service for Shuffle testing.
servers:
  - url: http://localhost:8000
paths:
  /health:
    get:
      operationId: app.handlers.health_check
      summary: Health check
      responses:
        "200":
          description: Service is healthy
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/HealthResponse"
  /echo:
    post:
      operationId: app.handlers.echo_body
      summary: Echo request body
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EchoRequest"
      responses:
        "200":
          description: Echo response
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/EchoResponse"
  /ioc/{value}:
    get:
      operationId: app.handlers.lookup_ioc
      summary: Basic IOC classification demo
      parameters:
        - name: value
          in: path
          required: true
          schema:
            type: string
        - name: ioc_type
          in: query
          required: false
          schema:
            type: string
            default: auto
      responses:
        "200":
          description: IOC lookup result
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LookupResponse"
components:
  schemas:
    HealthResponse:
      type: object
      properties:
        status:
          type: string
          example: ok
        timestamp:
          type: string
          format: date-time
      required:
        - status
        - timestamp
    EchoRequest:
      type: object
      additionalProperties: true
      example:
        message: test from Shuffle
    EchoResponse:
      type: object
      properties:
        received:
          type: object
          additionalProperties: true
        length:
          type: integer
      required:
        - received
        - length
    LookupResponse:
      type: object
      properties:
        input:
          type: string
        type:
          type: string
        verdict:
          type: string
          example: domain-like
        source:
          type: string
      required:
        - input
        - type
        - verdict
        - source