Remediation API

Authorization: Bearer $AI_PRIMED_API_KEY
Base URL: https://ai-primed.com/api/public/v1

{"error":{"code":"rate_limited","message":"Request rate exceeded.","request_id":"request UUID"}}

{"domain":"ai-primed.com"}

# Bash + curl + jq. Set AI_PRIMED_API_KEY securely first.
# Do not enable shell tracing or curl --verbose: they can expose the key.
set -euo pipefail
: "${AI_PRIMED_API_KEY:?Set a write-scoped key securely}"
BASE="https://ai-primed.com/api/public/v1"
AUDIT_DOMAIN="ai-primed.com" # Replace with your public hostname.

# Create an explicit JSON request file; jq escapes the hostname safely.
jq -n --arg domain "$AUDIT_DOMAIN" '{domain:$domain}' > audit-request.json
curl --fail-with-body --silent --show-error --max-time 30 \
  -X POST "$BASE/audits" \
  -H "Authorization: Bearer $AI_PRIMED_API_KEY" \
  -H 'Content-Type: application/json' \
  --data-binary @audit-request.json -o submission.json
AUDIT_ID=$(jq -er '.id' submission.json)

# Respect the submission's Retry-After: 60; poll at most 10 times.
# A 429 stops this script. Wait for Retry-After, then retrieve later.
done=false
for attempt in {1..10}; do
  sleep 60
  curl --fail-with-body --silent --show-error --max-time 30 \
    "$BASE/audits/$AUDIT_ID" \
    -H "Authorization: Bearer $AI_PRIMED_API_KEY" -o audit.json
  status=$(jq -r '.audit.status' audit.json)
  if [[ "$status" == completed || "$status" == failed ]]; then
    jq . audit.json
    done=true
    break
  fi
done
if [[ "$done" == false ]]; then
  printf 'Still pending. Retrieve later: %s\n' "$AUDIT_ID"
fi

# Both reads use saved data; neither starts a crawl or applies a fix.
curl --fail-with-body --silent --show-error --max-time 30 \
  "$BASE/audits/$AUDIT_ID/fixes" \
  -H "Authorization: Bearer $AI_PRIMED_API_KEY" -o fixes-export.json
curl --fail-with-body --silent --show-error --max-time 30 \
  "$BASE/domains/$AUDIT_DOMAIN/score" \
  -H "Authorization: Bearer $AI_PRIMED_API_KEY" -o score.json

{
  "id": "10000000-0000-4000-8000-000000000001",
  "domain": "ai-primed.com",
  "status": "queued",
  "result_url": "/api/public/v1/audits/10000000-0000-4000-8000-000000000001"
}

{
  "schema": "agentready.audit/v1",
  "exported_at": "2026-10-20T22:00:00Z",
  "audit": {
    "id": "10000000-0000-4000-8000-000000000001",
    "domain": "ai-primed.com",
    "status": "queued",
    "score": null,
    "grade": null,
    "started_at": "2026-10-20T22:00:00Z",
    "completed_at": null,
    "scoring_mode": {
      "siteType": "content_site",
      "detectedType": "content_site",
      "overridden": false
    },
    "category_scores": {}
  },
  "findings": [],
  "fixes": [],
  "fetch_log": [],
  "raw_signals": {}
}

{
  "domain": "ai-primed.com",
  "audit_id": "10000000-0000-4000-8000-000000000001",
  "score": null,
  "grade": null,
  "status": "failed",
  "observed_at": "2026-10-20T22:00:00Z"
}

# Python 3, standard library only. Set AI_PRIMED_API_KEY securely.
import os, json, time, urllib.request, urllib.error
BASE = "https://ai-primed.com/api/public/v1"
KEY = os.environ["AI_PRIMED_API_KEY"]
def call(path, data=None):
    body = json.dumps(data).encode() if data is not None else None
    req = urllib.request.Request(BASE + path, data=body,
        headers={"Authorization": "Bearer " + KEY, "Content-Type": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            return json.load(response)
    except urllib.error.HTTPError as error:
        raise RuntimeError(error.read().decode()) from None
job = call("/audits", {"domain": os.environ["AUDIT_DOMAIN"]})
for _ in range(20):
    time.sleep(60)
    result = call("/audits/" + job["id"])
    if result["audit"]["status"] in ("completed", "failed"):
        print(json.dumps(result, indent=2))
        break
else:
    print("Still pending; retrieve the audit later:", job["id"])

// Node 22+. Set AI_PRIMED_API_KEY and AUDIT_DOMAIN securely.
const base = "https://ai-primed.com/api/public/v1";
const key = process.env.AI_PRIMED_API_KEY;
if (!key || !process.env.AUDIT_DOMAIN) throw new Error("Missing environment values");
async function call(path, data) {
  const response = await fetch(base + path, {
    method: data ? "POST" : "GET",
    headers: { Authorization: "Bearer " + key, "Content-Type": "application/json" },
    ...(data ? { body: JSON.stringify(data) } : {})
  });
  const result = await response.json();
  if (!response.ok) throw new Error(JSON.stringify(result.error));
  return result;
}
const job = await call("/audits", { domain: process.env.AUDIT_DOMAIN });
let done = false;
for (let i = 0; i < 20; i++) {
  await new Promise(resolve => setTimeout(resolve, 60000));
  const result = await call("/audits/" + job.id);
  if (["completed", "failed"].includes(result.audit.status)) {
    console.log(JSON.stringify(result, null, 2)); done = true; break;
  }
}
if (!done) console.log("Still pending; retrieve later:", job.id);

{
  "id": "20000000-0000-4000-8000-000000000002",
  "type": "audit.completed",
  "created_at": "2026-10-20T22:00:00Z",
  "data": {
    "audit_id": "10000000-0000-4000-8000-000000000001",
    "domain": "ai-primed.com",
    "score": null,
    "grade": null,
    "previous_score": null,
    "observed_at": "2026-10-20T22:00:00Z"
  }
}

// Save as verify-webhook.mjs. Node 22+, no dependencies.
import { createHmac, timingSafeEqual } from 'node:crypto';
export function verifyWebhook(secret, timestamp, signature, rawBody, now = Date.now()) {
  if (typeof secret !== 'string' || Buffer.byteLength(secret) < 32) return false;
  if (typeof timestamp !== 'string' || !/^[0-9]{1,12}$/.test(timestamp)) return false;
  if (Math.abs(Math.floor(now / 1000) - Number(timestamp)) > 300) return false;
  if (typeof signature !== 'string' || !/^sha256=[a-f0-9]{64}$/.test(signature)) return false;
  if (!Buffer.isBuffer(rawBody)) return false;
  const expected = createHmac('sha256', secret)
    .update(timestamp + '.').update(rawBody).digest();
  const received = Buffer.from(signature.slice(7), 'hex');
  return received.length === expected.length && timingSafeEqual(received, expected);
}

// Save as receiver.mjs beside verify-webhook.mjs.
// Local verification harness only: not a production delivery service.
import { createServer } from 'node:http';
import { verifyWebhook } from './verify-webhook.mjs';
const secret = process.env.AI_PRIMED_WEBHOOK_SECRET;
if (!secret || Buffer.byteLength(secret) < 32) throw new Error('Set a 32+ byte signing secret');
const seen = new Set(); // Production: durable, atomic event-ID deduplication.
createServer(async (req, res) => {
  const reply = (status) => { res.writeHead(status); res.end(); };
  if (req.method !== 'POST' || req.url !== '/webhook') return reply(404);
  if (!req.headers['content-type']?.startsWith('application/json')) return reply(415);
  const chunks = []; let size = 0;
  try {
    for await (const chunk of req) {
      size += chunk.length;
      if (size > 65536) return reply(413);
      chunks.push(chunk);
    }
    const body = Buffer.concat(chunks);
    if (!verifyWebhook(secret, req.headers['x-ai-primed-timestamp'],
        req.headers['x-ai-primed-signature'], body)) return reply(401);
    // Parse only after verifying the exact bytes, never reserialized JSON.
    const event = JSON.parse(body.toString('utf8'));
    if (typeof event.id !== 'string' || event.id !== req.headers['x-ai-primed-id'] ||
        !['audit.completed', 'score.changed'].includes(event.type) ||
        !event.data || typeof event.data.audit_id !== 'string') return reply(400);
    if (seen.has(event.id)) return reply(204);
    // Production: atomically persist event + ID before returning 2xx.
    seen.add(event.id);
    reply(204);
  } catch { reply(400); }
}).listen(8787, '127.0.0.1');

# Local synthetic protocol fixture; not an AI-Primed delivery or audit.
# Save the two JavaScript examples above in this folder first.
set -euo pipefail
export AI_PRIMED_WEBHOOK_SECRET=$(node --input-type=module -e \
  "import {randomBytes} from 'node:crypto'; console.log(randomBytes(32).toString('hex'))")
node receiver.mjs &
RECEIVER_PID=$!
trap 'kill "$RECEIVER_PID" 2>/dev/null || true; unset AI_PRIMED_WEBHOOK_SECRET' EXIT
node --input-type=module <<'NODE'
import { createHmac } from 'node:crypto';
import { writeFileSync } from 'node:fs';
const payload = {"id":"20000000-0000-4000-8000-000000000002","type":"audit.completed","created_at":"2026-10-20T22:00:00Z","data":{"audit_id":"10000000-0000-4000-8000-000000000001","domain":"ai-primed.com","score":null,"grade":null,"previous_score":null,"observed_at":"2026-10-20T22:00:00Z"}};
const body = JSON.stringify(payload);
const timestamp = String(Math.floor(Date.now() / 1000));
const signature = 'sha256=' + createHmac('sha256', process.env.AI_PRIMED_WEBHOOK_SECRET)
  .update(timestamp + '.').update(body).digest('hex');
writeFileSync('event.json', body);
writeFileSync('event-headers.txt', [
  'Content-Type: application/json', 'X-AI-Primed-Id: ' + payload.id,
  'X-AI-Primed-Timestamp: ' + timestamp, 'X-AI-Primed-Signature: ' + signature
].join('\n') + '\n', { mode: 0o600 });
NODE
# Retry startup connection errors only; expected response is HTTP 204.
curl --silent --show-error --retry 5 --retry-connrefused --retry-delay 1 \
  --max-time 5 -o /dev/null -w 'HTTP %{http_code}\n' \
  -H @event-headers.txt --data-binary @event.json http://127.0.0.1:8787/webhook
# Tampering must return HTTP 401. No retries for this rejection.
printf ' ' >> event.json
curl --silent --show-error --max-time 5 -o /dev/null -w 'HTTP %{http_code}\n' \
  -H @event-headers.txt --data-binary @event.json http://127.0.0.1:8787/webhook