# Cyber Private Eye — API Documentation

Cyber Private Eye exposes a small REST API for payments and service health.
The API base path is `https://cyberprivateeye.com/hcgi/api`.

## Authentication

Protected operations require a bearer token issued by the site's OAuth
authorization server. See
`/.well-known/oauth-authorization-server` for endpoints and
`/.well-known/oauth-protected-resource` for the scopes accepted by this
resource. Agent registration instructions are in [`/auth.md`](/auth.md).

## Endpoints

### `GET /health`

Liveness probe. Returns `200` with `{ "status": "ok" }`.

### `GET /stripe/status`

Returns `{ "configured": true|false }` indicating whether Stripe payments are
active. Agents should call this before initiating checkout.

### `POST /stripe/checkout`

Starts a Stripe Checkout session for a service tier.

**Request body**

```json
{ "tier": "Trace" }
```

`tier` is one of `Trace` ($99), `Dossier` ($199), or `Deep Sweep` ($299).

**Response**

```json
{ "url": "https://checkout.stripe.com/..." }
```

Redirect the user to `url` to complete payment. On success the user is
redirected to `/inquiry?tier=<tier>&session_id={CHECKOUT_SESSION_ID}` where
they submit the confidential inquiry form.

## Service tiers

| Tier       | Price | Delivery         |
| ---------- | ----- | ---------------- |
| Trace      | $99   | 48 hours         |
| Dossier    | $199  | 48 hours + call  |
| Deep Sweep | $299  | 48 hours         |

## OpenAPI

A machine-readable OpenAPI 3.1 specification is available at
[`/openapi.json`](/openapi.json), and a linkset catalog at
[`/.well-known/api-catalog`](/.well-known/api-catalog).