Security posture shield report

GET

/security-posture/summary

const url = 'https://example.com/api/v1/security-posture/summary';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://example.com/api/v1/security-posture/summary

The live “Shield Check” for this deployment: an overall 0–100 shield score and band (with any critical band-cap), a per-check breakdown, the per-instance connection-transport table, always-on assurances, unscored advisories, and the ranked “to reach Hardened” actions. Read-only, computed on demand, zero network probing. The payload NEVER contains a secret value — only presence booleans, host strings, and key-version identifiers. Non-blocking: it informs, it never blocks.

Responses

200

The security posture shield report.

application/json

The live shield report for one deployment — computed on demand, never persisted.

object

engineVersion

required

string

generatedAt

required

string format: date-time

score

required

integer

<= 100

band

required

Shield band derived from the 0–100 rollup. unknown only when every check was skipped.

string

Allowed values: hardened guarded exposed unknown

bandCappedBy

required

One of:

object
null

object

checkId

required

string

Allowed values: control_plane_auth arr_transport app_key_at_rest credential_rotation log_redaction proxy_trust

label

required

string

checks

required

Array<object>

One scored check’s contribution to the shield report.

object

required

string

Allowed values: control_plane_auth arr_transport app_key_at_rest credential_rotation log_redaction proxy_trust

label

required

string

score

required

One of:

integer
null

integer

<= 100

weight

required

integer

contribution

required

integer

recoverablePoints

required

integer

status

required

Presentation status derived from the check’s score and severity.

string

Allowed values: pass advisory attention action assured na

critical

required

boolean

detail

required

Array<string>

recommendations

required

Array<object>

A non-shaming remediation line paired with its concrete fix.

object

headline

required

string

detail

required

Array<string>

tone

required

string

Allowed values: neutral info warning danger

templateVersion

required

string

fix

required

A concrete remediation target. kind discriminates which optional fields are present.

object

kind

required

string

Allowed values: settings-link instance-link env-var docs none

href

Present for settings-link, instance-link, and docs.

string

label

string

name

The environment variable name (env-var kind).

string

docHref

Optional documentation link (env-var kind).

string

instanceId

Present for instance-link.

integer

transport

required

Array<object>

One enabled Arr connection’s transport posture (host only — never the API key).

object

instanceId

required

integer

instanceName

required

string

arrType

required

string

Allowed values: radarr sonarr lidarr

scheme

required

string

Allowed values: http https

host

required

string

tier

required

How an Arr connection’s target host is classified from Praxrr’s own knowledge (no probing).

string

Allowed values: encrypted loopback docker-alias private unknown public mixed

score

required

One of:

integer
null

integer

<= 100

status

required

Presentation status derived from the check’s score and severity.

string

Allowed values: pass advisory attention action assured na

dns

required

Safe aggregate DNS evidence; excludes addresses, resolver details, CNAMEs, and error text.

object

outcome

required

Closed result of bounded DNS evidence gathering for one stored Arr hostname.

string

Allowed values: not-applicable resolved partial timeout failed empty budget-exceeded

source

required

Provenance of a DNS observation; cache hits retain the original observation time.

string

Allowed values: none fresh cache

ipv4

required

Bounded address-class counts for one DNS record family; raw addresses are never exposed.

object

loopback

required

integer

<= 16

private

required

integer

<= 16

linkLocal

required

integer

<= 16

public

required

integer

<= 16

special

required

integer

<= 16

ipv6

required

Bounded address-class counts for one DNS record family; raw addresses are never exposed.

object

loopback

required

integer

<= 16

private

required

integer

<= 16

linkLocal

required

integer

<= 16

public

required

integer

<= 16

special

required

integer

<= 16

retainedCount

required

integer

<= 16

observedAt

required

One of:

string
null

string format: date-time

incomplete

required

boolean

truncated

required

boolean

addressClassesChanged

required

boolean

fix

required

A concrete remediation target. kind discriminates which optional fields are present.

object

kind

required

string

Allowed values: settings-link instance-link env-var docs none

href

Present for settings-link, instance-link, and docs.

string

label

string

name

The environment variable name (env-var kind).

string

docHref

Optional documentation link (env-var kind).

string

instanceId

Present for instance-link.

integer

assurances

required

Array<object>

An always-on protection surfaced as a verified affirmation (contributes zero to the score).

object

required

string

label

required

string

verified

required

boolean

note

required

string

advisories

required

Array<object>

A real posture note whose exploitability Praxrr cannot observe, so it informs without a score.

object

required

string

label

required

string

detail

required

Array<string>

fix

required

A concrete remediation target. kind discriminates which optional fields are present.

object

kind

required

string

Allowed values: settings-link instance-link env-var docs none

href

Present for settings-link, instance-link, and docs.

string

label

string

name

The environment variable name (env-var kind).

string

docHref

Optional documentation link (env-var kind).

string

instanceId

Present for instance-link.

integer

topActions

required

Array<object>

A ranked “to reach Hardened” step derived from a scored check below 100.

object

checkId

required

string

Allowed values: control_plane_auth arr_transport app_key_at_rest credential_rotation log_redaction proxy_trust

headline

required

string

tone

required

string

Allowed values: neutral info warning danger

recoverablePoints

required

integer

fix

required

A concrete remediation target. kind discriminates which optional fields are present.

object

kind

required

string

Allowed values: settings-link instance-link env-var docs none

href

Present for settings-link, instance-link, and docs.

string

label

string

name

The environment variable name (env-var kind).

string

docHref

Optional documentation link (env-var kind).

string

instanceId

Present for instance-link.

integer

Example

{
  "band": "hardened",
  "bandCappedBy": {
    "checkId": "control_plane_auth"
  },
  "checks": [
    {
      "id": "control_plane_auth",
      "status": "pass",
      "recommendations": [
        {
          "tone": "neutral",
          "fix": {
            "kind": "settings-link"
          }
        }
      ]
    }
  ],
  "transport": [
    {
      "arrType": "radarr",
      "scheme": "http",
      "tier": "encrypted",
      "status": "pass",
      "dns": {
        "outcome": "not-applicable",
        "source": "none"
      },
      "fix": {
        "kind": "settings-link"
      }
    }
  ],
  "advisories": [
    {
      "fix": {
        "kind": "settings-link"
      }
    }
  ],
  "topActions": [
    {
      "checkId": "control_plane_auth",
      "tone": "neutral",
      "fix": {
        "kind": "settings-link"
      }
    }
  ]
}

500

Internal error.

application/json

object

error

required

Error message

string

Example^generated

{
  "error": "example"
}

Security posture shield report

Responses

200

Example

500

Examplegenerated

Example^generated