Registry · Capabilities · browserless.io
Capability registry
What browserless.io declares an agent can do
Measured 2026-10-06 05:17 UTC from the declarations the site publishes (record rnm9nmc8j0). Each capability is shown as declared, under the policy class that decides whether anything may call it, beside what a call observed.
106declared
41public read-only
0called and verified
2declared ≠ observed
agent_skill, mcp, openapiprotocols
Declared versus observed
| Capability | Policy class | Declared | Observed |
|---|---|---|---|
| POST /chrome/content openapi · POST · https://www.browserless.io/chrome/content | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chrome/download openapi · POST · https://www.browserless.io/chrome/download | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chrome/function openapi · POST · https://www.browserless.io/chrome/function | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| PUT /json/new openapi · PUT · https://www.browserless.io/json/new | Unknown never called automatically | PUT with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /json/protocol openapi · GET · https://www.browserless.io/json/protocol | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | declared not observed HTTP 404 · text/html declared_endpoint_missing |
| GET /json/version openapi · GET · https://www.browserless.io/json/version | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | declared not observed HTTP 404 · text/html declared_endpoint_missing |
| POST /chrome/pdf openapi · POST · https://www.browserless.io/chrome/pdf | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chrome/performance openapi · POST · https://www.browserless.io/chrome/performance | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chrome/scrape openapi · POST · https://www.browserless.io/chrome/scrape | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chrome/screenshot openapi · POST · https://www.browserless.io/chrome/screenshot | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chromium/content openapi · POST · https://www.browserless.io/chromium/content | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chromium/download openapi · POST · https://www.browserless.io/chromium/download | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chromium/function openapi · POST · https://www.browserless.io/chromium/function | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chromium/performance openapi · POST · https://www.browserless.io/chromium/performance | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chromium/scrape openapi · POST · https://www.browserless.io/chromium/scrape | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /edge/content openapi · POST · https://www.browserless.io/edge/content | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /edge/download openapi · POST · https://www.browserless.io/edge/download | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /edge/function openapi · POST · https://www.browserless.io/edge/function | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /edge/pdf openapi · POST · https://www.browserless.io/edge/pdf | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /edge/performance openapi · POST · https://www.browserless.io/edge/performance | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /edge/scrape openapi · POST · https://www.browserless.io/edge/scrape | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /edge/screenshot openapi · POST · https://www.browserless.io/edge/screenshot | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /active openapi · GET · https://www.browserless.io/active | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /kill/+([0-9a-zA-Z-_]) openapi · GET · https://www.browserless.io/kill/+([0-9a-zA-Z-_]) | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /meta openapi · GET · https://www.browserless.io/meta | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET / openapi · GET · https://www.browserless.io/ | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /devtools/browser/* openapi · GET · https://www.browserless.io/devtools/browser/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /chrome openapi · GET · https://www.browserless.io/chrome | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /function/connect/* openapi · GET · https://www.browserless.io/function/connect/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /devtools/page/* openapi · GET · https://www.browserless.io/devtools/page/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /chrome/playwright openapi · GET · https://www.browserless.io/chrome/playwright | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /chromium openapi · GET · https://www.browserless.io/chromium | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /chromium/playwright openapi · GET · https://www.browserless.io/chromium/playwright | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /edge openapi · GET · https://www.browserless.io/edge | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /edge/playwright openapi · GET · https://www.browserless.io/edge/playwright | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /firefox/playwright openapi · GET · https://www.browserless.io/firefox/playwright | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /webkit/playwright openapi · GET · https://www.browserless.io/webkit/playwright | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /browser/*/live/* openapi · GET · https://www.browserless.io/browser/*/live/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| DELETE /browser/*/live/* openapi · DELETE · https://www.browserless.io/browser/*/live/* | Irreversible write never called automatically | HTTP DELETE auth: none · required inputs: 0 | not attempted classed irreversible_write: only read-only public actions are ever called |
| POST /browser/*/live openapi · POST · https://www.browserless.io/browser/*/live | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| DELETE /browser/* openapi · DELETE · https://www.browserless.io/browser/* | Irreversible write never called automatically | HTTP DELETE auth: none · required inputs: 0 | not attempted classed irreversible_write: only read-only public actions are ever called |
| POST /chrome/export openapi · POST · https://www.browserless.io/chrome/export | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chrome/unblock openapi · POST · https://www.browserless.io/chrome/unblock | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /chromium/export openapi · POST · https://www.browserless.io/chromium/export | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /scrape openapi · POST · https://www.browserless.io/scrape | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /unblock openapi · POST · https://www.browserless.io/unblock | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /proxy/cities openapi · GET · https://www.browserless.io/proxy/cities | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| POST /map openapi · POST · https://www.browserless.io/map | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /pdf openapi · POST · https://www.browserless.io/pdf | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /screenshot openapi · POST · https://www.browserless.io/screenshot | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /search openapi · POST · https://www.browserless.io/search | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /session openapi · POST · https://www.browserless.io/session | Identity and accounts never called automatically | its name contains “session” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| DELETE /session/* openapi · DELETE · https://www.browserless.io/session/* | Identity and accounts never called automatically | its name contains “session” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| POST /smart-scrape openapi · POST · https://www.browserless.io/smart-scrape | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /stealth/bql?(/*) openapi · GET · https://www.browserless.io/stealth/bql?(/*) | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| POST /stealth/bql?(/*) openapi · POST · https://www.browserless.io/stealth/bql?(/*) | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /chrome/bql?(/*) openapi · GET · https://www.browserless.io/chrome/bql?(/*) | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| POST /chrome/bql?(/*) openapi · POST · https://www.browserless.io/chrome/bql?(/*) | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /chromium/bql?(/*) openapi · GET · https://www.browserless.io/chromium/bql?(/*) | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| POST /chromium/bql?(/*) openapi · POST · https://www.browserless.io/chromium/bql?(/*) | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| POST /session/bql/* openapi · POST · https://www.browserless.io/session/bql/* | Identity and accounts never called automatically | its name contains “session” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| GET /chromium/agent/capabilities openapi · GET · https://www.browserless.io/chromium/agent/capabilities | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| POST /agent/run/*/continue openapi · POST · https://www.browserless.io/agent/run/*/continue | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /agent/run/* openapi · GET · https://www.browserless.io/agent/run/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| DELETE /agent/run/* openapi · DELETE · https://www.browserless.io/agent/run/* | Irreversible write never called automatically | HTTP DELETE auth: none · required inputs: 0 | not attempted classed irreversible_write: only read-only public actions are ever called |
| GET /agent/run openapi · GET · https://www.browserless.io/agent/run | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| POST /agent/run openapi · POST · https://www.browserless.io/agent/run | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /crawl/* openapi · GET · https://www.browserless.io/crawl/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| DELETE /crawl/* openapi · DELETE · https://www.browserless.io/crawl/* | Irreversible write never called automatically | HTTP DELETE auth: none · required inputs: 0 | not attempted classed irreversible_write: only read-only public actions are ever called |
| GET /crawl openapi · GET · https://www.browserless.io/crawl | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| POST /crawl openapi · POST · https://www.browserless.io/crawl | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /skills openapi · GET · https://www.browserless.io/skills | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| POST /profile openapi · POST · https://www.browserless.io/profile | Identity and accounts never called automatically | its name contains “profile” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| DELETE /profile openapi · DELETE · https://www.browserless.io/profile | Identity and accounts never called automatically | its name contains “profile” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| GET /profile/* openapi · GET · https://www.browserless.io/profile/* | Identity and accounts never called automatically | its name contains “profile” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| PUT /profile/* openapi · PUT · https://www.browserless.io/profile/* | Identity and accounts never called automatically | its name contains “profile” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| DELETE /profile/* openapi · DELETE · https://www.browserless.io/profile/* | Identity and accounts never called automatically | its name contains “profile” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| GET /profile/*/download openapi · GET · https://www.browserless.io/profile/*/download | Identity and accounts never called automatically | its name contains “profile” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| GET /profiles openapi · GET · https://www.browserless.io/profiles | Identity and accounts never called automatically | its name contains “profiles” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| POST /profile/refresh openapi · POST · https://www.browserless.io/profile/refresh | Identity and accounts never called automatically | its name contains “profile” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| POST /profile/upload openapi · POST · https://www.browserless.io/profile/upload | Identity and accounts never called automatically | its name contains “profile” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| GET /integrations/onepassword/*/audit openapi · GET · https://www.browserless.io/integrations/onepassword/*/audit | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /integrations/onepassword openapi · GET · https://www.browserless.io/integrations/onepassword | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| POST /integrations/onepassword openapi · POST · https://www.browserless.io/integrations/onepassword | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /integrations/onepassword/* openapi · GET · https://www.browserless.io/integrations/onepassword/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| DELETE /integrations/onepassword/* openapi · DELETE · https://www.browserless.io/integrations/onepassword/* | Irreversible write never called automatically | HTTP DELETE auth: none · required inputs: 0 | not attempted classed irreversible_write: only read-only public actions are ever called |
| GET /integrations/onepassword/autologin/form openapi · GET · https://www.browserless.io/integrations/onepassword/autologin/form | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| POST /integrations/onepassword/profile openapi · POST · https://www.browserless.io/integrations/onepassword/profile | Identity and accounts never called automatically | its name contains “profile” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| GET /integrations/onepassword/profile/* openapi · GET · https://www.browserless.io/integrations/onepassword/profile/* | Identity and accounts never called automatically | its name contains “profile” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| POST /integrations/script-generator openapi · POST · https://www.browserless.io/integrations/script-generator | Unknown never called automatically | POST with no declared reversibility auth: none · required inputs: 0 | not attempted classed unknown: only read-only public actions are ever called |
| GET /stealth openapi · GET · https://www.browserless.io/stealth | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /chrome/live/* openapi · GET · https://www.browserless.io/chrome/live/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /chrome/stealth openapi · GET · https://www.browserless.io/chrome/stealth | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /chromium/cli openapi · GET · https://www.browserless.io/chromium/cli | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /live/* openapi · GET · https://www.browserless.io/live/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /chromium/stealth openapi · GET · https://www.browserless.io/chromium/stealth | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /reconnect/* openapi · GET · https://www.browserless.io/reconnect/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /session/connect/* openapi · GET · https://www.browserless.io/session/connect/* | Identity and accounts never called automatically | its name contains “session” auth: none · required inputs: 0 | not attempted classed identity_or_account: only read-only public actions are ever called |
| GET /chromium/stealth/reconnect/* openapi · GET · https://www.browserless.io/chromium/stealth/reconnect/* | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| GET /chromium/agent openapi · GET · https://www.browserless.io/chromium/agent | Public read-only | HTTP GET with no declared security auth: none · required inputs: 0 | not attempted outside the per-scan call budget (2 GETs, 1 MCP tool) |
| server mcp | Metadata never called automatically | a server declaration; its tools are listed only by the server itself (tools/list), which is not called auth: oauth2 | not attempted requires oauth2: never called without the operator's own credentials |
| browserless-bap agent_skill · https://www.browserless.io/.well-known/agent-skills/browserless-bap.md | Metadata never called automatically | an instruction file an agent reads; not an operation auth: none | not attempted metadata: describes a surface, is not itself an action |
| browserless-mcp agent_skill · https://www.browserless.io/.well-known/agent-skills/browserless-mcp.md | Metadata never called automatically | an instruction file an agent reads; not an operation auth: none | not attempted metadata: describes a surface, is not itself an action |
| browserless-rest-api agent_skill · https://www.browserless.io/.well-known/agent-skills/browserless-rest-api.md | Metadata never called automatically | an instruction file an agent reads; not an operation auth: none | not attempted metadata: describes a surface, is not itself an action |
| browserless-skill-catalog agent_skill · https://www.browserless.io/.well-known/agent-skills/browserless-skill-catalog.md | Metadata never called automatically | an instruction file an agent reads; not an operation auth: none | not attempted metadata: describes a surface, is not itself an action |
| browserql agent_skill · https://www.browserless.io/.well-known/agent-skills/browserql.md | Metadata never called automatically | an instruction file an agent reads; not an operation auth: none | not attempted metadata: describes a surface, is not itself an action |
Where the declaration and the call disagree
| Mismatch | Declared | Observed |
|---|---|---|
| declared_endpoint_missing GET /json/protocol | a GET operation at this path | HTTP 404 |
| declared_endpoint_missing GET /json/version | a GET operation at this path | HTTP 404 |
Signed certificate
This page’s rows, signed by the observer’s Ed25519 key: every capability’s id, endpoint, safety class, policy class and observed state, the declaration hashes and the record’s sealed manifest. The certificate is derived from the record alone, so the same record always yields the same id.
certificate_id ccap1:50cf19661d6b7ba44f2d4243cbdc42f6c92af33dd92fcd570ef6b91a1326274d
alg Ed25519 · kid hcIAczGf-8EFBnkunmZlvFWnD2nHHeHeC9cM4BTiBVo
sig wOOLZCcrbeac5RrYgwXekERY_L0vfxPrsapQStDNotXvY2WTeGg4vfD7dQoo-NkWf-TTdDK1jch-JucklKt3Cg
alg Ed25519 · kid hcIAczGf-8EFBnkunmZlvFWnD2nHHeHeC9cM4BTiBVo
sig wOOLZCcrbeac5RrYgwXekERY_L0vfxPrsapQStDNotXvY2WTeGg4vfD7dQoo-NkWf-TTdDK1jch-JucklKt3Cg
The certificate as JSON · verify it now · the key directory · machine-readability certificate
To verify it yourself: SHA-256 the certificate object as canonical JSON (keys sorted, no whitespace); the hex digest must equal certificate_sha256 and the id; then check the Ed25519 signature over "crawlcheck-capability-certificate-v1\n" followed by that hex digest, with the key in the directory whose RFC 7638 thumbprint is the kid.
Policy classes
| Policy class | Called automatically? | Rule |
|---|---|---|
| Public read-only public_read_only | yes, to verify | May be called without credentials. CrawlCheck calls it only to check the declaration: GET with no input, on the scanned origin. |
| Authenticated read-only authenticated_read_only | never | Never called by CrawlCheck. An agent needs the user's own credentials and consent. |
| Reversible write reversible_write | never | Never invoked automatically. Needs the owner's written authorisation and a test account. |
| Irreversible write irreversible_write | never | Never invoked automatically. Deletes or changes something that cannot be undone. |
| Financial financial | never | Never invoked automatically. Moves money or creates a charge. |
| External communication external_communication | never | Never invoked automatically. Sends a message, email or notification to someone. |
| Identity and accounts identity | never | Never invoked automatically. Creates, signs in to or changes an account or credential. |
| Unknown unknown | never | Never invoked. Its effect cannot be read from the declaration, so it is treated as the riskiest case. |
| Metadata metadata | never | Nothing to invoke: a listing, a server card or a skill file, not an operation. |