WebDiagnostic API & AI Pipeline Reference

WebDiagnostic provides a programmable edge diagnostic layer combined with an LLM-backed remediation engine powered by Anthropic's Claude API. Engineering teams use our endpoints to continuously audit public web infrastructure, extract third-party DOM asset graphs, and synthesize safe server configuration patches.

Authentication & Rate Limiting

Public sandbox calls to POST /api/v1/audit are rate-limited to 20 requests per minute per client IP. Production plans authenticate via Bearer API keys in the Authorization: Bearer wd_live_... header with configurable burst quotas and dedicated concurrency pools.

Run Infrastructure Telemetry Probe

Executes an SSRF-filtered HTTPS probe from the edge collector, measuring TTFB latency, inspecting OWASP security headers, and extracting external script, stylesheet, and frame origins from the document head/body.

Request Example

curl -X POST https://webdiagnostic-agency.com/api/v1/audit \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com"
  }'

Response Payload (200 OK)

{
  "api_version": "2026.10",
  "target": "example.com",
  "reachable": true,
  "status_code": 200,
  "response_time_ms": 78,
  "server_header": "cloudflare",
  "overall_health_score": 83,
  "performance_score": 100,
  "security_score": 50,
  "seo_score": 100,
  "detected_origins": {
    "scripts": ["'self'", "https://cdnjs.cloudflare.com"],
    "styles": ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
    "fonts": ["'self'", "https://fonts.gstatic.com"],
    "frames": ["'self'"]
  },
  "issues": [
    "Missing Strict-Transport-Security (HSTS) header.",
    "Missing X-Frame-Options / frame-ancestors protection.",
    "Missing Content-Security-Policy (CSP) header."
  ]
}

Synthesize Context-Aware Remediation Patch

Accepts a telemetry snapshot from /api/v1/audit and synthesizes stack-ready security configurations (Nginx, Apache .htaccess, and Cloudflare Transform Rules JSON) tailored to the target's actual detected DOM asset origins.

Anthropic Claude Integration Architecture

Traditional security scanners recommend static header strings that frequently break production applications (for example, blocking Stripe/Whop checkout frames, Google Fonts, or analytics bundles). Our backend orchestrates Claude (Anthropic Messages API) in a constrained, deterministic verification loop:

[Edge Collector Worker]
       │  1. Bounded HTTPS fetch (max 150 KB HTML stream, 5s AbortController)
       │  2. Parse HTTP headers + extract <script>, <link>, <iframe> origins
       ▼
[Telemetry Normalizer]
       │  3. Redact query tokens / PII; build structured AuditTelemetry JSON
       ▼
[Anthropic Claude API — claude-sonnet-4-5]
       │  4. Ephemeral Prompt Cache: OWASP Secure Headers + EU NIS2 Directives
       │  5. Forced Tool Use: `synthesize_remediation_patch` strict JSON schema
       ▼
[AST Directive Verifier]
       │  6. Validate CSP directive tokens, HSTS max-age bounds & Nginx grammar
       ▼
[REST Response / CI Webhook]

Python Backend Implementation

import anthropic

client = anthropic.Anthropic()

REMEDIATION_TOOL = {
    "name": "synthesize_remediation_patch",
    "description": "Generate non-breaking HTTP security headers and server config diffs.",
    "input_schema": {
        "type": "object",
        "properties": {
            "diagnostic_reasoning": {"type": "string"},
            "csp_header_value": {"type": "string"},
            "nginx_config": {"type": "string"},
            "apache_htaccess": {"type": "string"},
            "cloudflare_transform_rule": {"type": "object"},
            "regression_risk": {"type": "string", "enum": ["LOW", "MEDIUM", "HIGH"]}
        },
        "required": [
            "diagnostic_reasoning",
            "csp_header_value",
            "nginx_config",
            "regression_risk"
        ]
    }
}

def generate_verified_patch(telemetry_payload: dict) -> dict:
    msg = client.messages.create(
        model="claude-sonnet-4-5",
        max_tokens=2048,
        system=[{
            "type": "text",
            "text": "You are an infrastructure security compiler. Construct minimal, "
                    "non-breaking CSP and HSTS policies preserving all detected DOM origins.",
            "cache_control": {"type": "ephemeral"}
        }],
        tools=[REMEDIATION_TOOL],
        tool_choice={"type": "tool", "name": "synthesize_remediation_patch"},
        messages=[{"role": "user", "content": str(telemetry_payload)}]
    )
    for block in msg.content:
        if block.type == "tool_use":
            return block.input
    raise RuntimeError("Tool invocation missing from response")

Continuous Compliance Webhooks

Team and Enterprise workspaces can register webhook endpoints that trigger whenever scheduled probes detect a security score drop or missing HSTS/CSP header after a production deploy. Every webhook includes an X-WebDiagnostic-Signature HMAC-SHA256 digest computed over the raw request body.