{"openapi":"3.1.0","info":{"title":"decoy.day dashboard API","version":"1.0.0","description":"Read-only data behind the decoy.day honeypot dashboard. No key needed. Responses are cached for a few seconds."},"servers":[{"url":"https://decoy.day"}],"paths":{"/api/stats":{"get":{"operationId":"getStats","summary":"Totals and breakdowns for a period","parameters":[{"name":"days","in":"query","schema":{"type":"integer","enum":[1,7,30],"default":7}}],"responses":{"200":{"description":"Stats","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/leaderboard":{"get":{"operationId":"getLeaderboard","summary":"Visits sorted by intent (attacker, explorer, scanner, indexer) and the most advanced actors","parameters":[{"name":"days","in":"query","schema":{"type":"integer","enum":[1,7,30],"default":7}}],"responses":{"200":{"description":"Leaderboard","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/events":{"get":{"operationId":"getEvents","summary":"The latest 40 events, newest first","responses":{"200":{"description":"Events","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/replay":{"get":{"operationId":"getReplay","summary":"Every event between two times (whole minutes, last 30 days), oldest first, as compact rows: at, country, surface, stage, intent, visit, client, kind, name, asn, network, agent, flags (1 secret taken, 2 reused, 4 attack), repeats. Built from fixed time tiles of at most 400 rows each, evenly sampled (flagged rows get half the room)","parameters":[{"name":"from","in":"query","schema":{"type":"integer","description":"Start, ms since the epoch"}},{"name":"to","in":"query","schema":{"type":"integer","description":"End, ms since the epoch"}}],"responses":{"200":{"description":"Replay","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/agents":{"get":{"operationId":"getAgents","summary":"Which agents bite: MCP visits grouped by client (directory and health checkers left out), with how often each called a tool and bit. A client is listed only with 5 visits from 3 networks","parameters":[{"name":"days","in":"query","schema":{"type":"integer","enum":[7,30],"default":30}}],"responses":{"200":{"description":"clients, with visits, networks, called, bit and per-check counts","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/reuses":{"get":{"operationId":"getReuses","summary":"Stolen secrets: fake secrets that came back, newest first (at most 30), with the visit that took each one and the visit that used it, and totals for the period","parameters":[{"name":"days","in":"query","schema":{"type":"integer","enum":[1,7,30],"default":7}}],"responses":{"200":{"description":"Reuses","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/reports/{week}.json":{"get":{"operationId":"getWeek","summary":"One week's numbers (the weekly report as data), CC BY 4.0","parameters":[{"name":"week","in":"path","required":true,"schema":{"type":"string","pattern":"^\\d{4}-w\\d{2}$"}}],"responses":{"200":{"description":"The week","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"No such week"}}}},"/api/flows":{"get":{"operationId":"getFlows","summary":"The first five moves of every MCP visit, merged","parameters":[{"name":"days","in":"query","schema":{"type":"integer","enum":[1,7,30],"default":7}}],"responses":{"200":{"description":"Flows","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/sessions":{"get":{"operationId":"getSessions","summary":"Recent visits","parameters":[{"name":"surface","in":"query","schema":{"type":"string","enum":["mcp","web"]}},{"name":"min_stage","in":"query","schema":{"type":"integer","minimum":0,"maximum":6}},{"name":"before","in":"query","description":"Epoch ms, for paging","schema":{"type":"integer"}},{"name":"limit","in":"query","schema":{"type":"integer","enum":[40,100],"default":40}}],"responses":{"200":{"description":"Visits","content":{"application/json":{"schema":{"type":"object"}}}}}}},"/api/session/{id}":{"get":{"operationId":"getSession","summary":"One visit, step by step","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[mw]_[a-z2-7]{12}$"}}],"responses":{"200":{"description":"The visit","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"No such visit"}}}}}}