{
  "info": {
    "name": "Lorikeet Security — Public & Portal API",
    "description": "Public and portal HTTP endpoints for the Lorikeet Security PTaaS platform, plus the Lory Code Review API.\n\nBase URL: https://lorikeetsecurity.com — all paths are extensionless (never include `.php`).\n\nAuth: public endpoints need no auth. Portal endpoints assume a browser session cookie obtained via the magic-link flow (POST /talon/api/login → open the emailed link). For scripted access to portal endpoints, contact support@lorikeetsecurity.com for a long-lived token. The Lory Code Review API is usable anonymously (IP rate-limited) or with a workspace MCP token (`Authorization: Bearer lkmcp_...`) for a higher per-token ceiling.\n\nFull reference: https://lorikeetsecurity.com/developers",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    { "key": "baseUrl", "value": "https://lorikeetsecurity.com", "type": "string" },
    { "key": "lkmcp_token", "value": "lkmcp_xxxxxxxxxxxxxxxxxxxxxxxx", "type": "string", "description": "Optional workspace MCP token (issued on the MCP Server page) — raises the Code Review rate limit." },
    { "key": "finding_id", "value": "42", "type": "string" }
  ],
  "item": [
    {
      "name": "Public",
      "item": [
        {
          "name": "Contact / Sales Inquiry",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/x-www-form-urlencoded" }],
            "url": { "raw": "{{baseUrl}}/talon/api/contact", "host": ["{{baseUrl}}"], "path": ["talon", "api", "contact"] },
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                { "key": "email", "value": "you@company.com", "description": "Corporate email (free providers rejected)" },
                { "key": "fullname", "value": "Jane Doe" },
                { "key": "company", "value": "Acme Inc" },
                { "key": "message", "value": "We'd like a scoping call." }
              ]
            },
            "description": "Submit a contact/sales inquiry. Requires a corporate email address."
          }
        },
        {
          "name": "Newsletter Subscribe",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/x-www-form-urlencoded" }],
            "url": { "raw": "{{baseUrl}}/api/newsletter-subscribe", "host": ["{{baseUrl}}"], "path": ["api", "newsletter-subscribe"] },
            "body": { "mode": "urlencoded", "urlencoded": [
              { "key": "email", "value": "you@company.com" },
              { "key": "first_name", "value": "Jane", "description": "optional" }
            ] },
            "description": "Subscribe an email to the newsletter."
          }
        },
        {
          "name": "Request a Quote",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/x-www-form-urlencoded" }],
            "url": { "raw": "{{baseUrl}}/talon/api/get-quote", "host": ["{{baseUrl}}"], "path": ["talon", "api", "get-quote"] },
            "body": { "mode": "urlencoded", "urlencoded": [
              { "key": "email", "value": "you@company.com" },
              { "key": "company", "value": "Acme Inc" },
              { "key": "service", "value": "Security Code Review" }
            ] },
            "description": "Submit a scoped engagement request; the team responds with pricing."
          }
        }
      ]
    },
    {
      "name": "Auth",
      "item": [
        {
          "name": "Request Magic Link",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/x-www-form-urlencoded" }],
            "url": { "raw": "{{baseUrl}}/talon/api/login", "host": ["{{baseUrl}}"], "path": ["talon", "api", "login"] },
            "body": { "mode": "urlencoded", "urlencoded": [
              { "key": "email", "value": "you@company.com" }
            ] },
            "description": "Emails a one-time login link. Opening it (in a browser) hits /talon/api/validate and sets a session cookie that authenticates the portal endpoints below."
          }
        }
      ]
    },
    {
      "name": "Portal (session cookie required)",
      "item": [
        {
          "name": "Get Finding",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "{{baseUrl}}/talon/api/findinginfo?finding_id={{finding_id}}",
              "host": ["{{baseUrl}}"], "path": ["talon", "api", "findinginfo"],
              "query": [{ "key": "finding_id", "value": "{{finding_id}}" }]
            },
            "description": "Return a single finding by id (scoped to your workspace)."
          }
        },
        {
          "name": "Mark Finding Ready for Retest",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/x-www-form-urlencoded" }],
            "url": { "raw": "{{baseUrl}}/talon/api/markreadyforretesting", "host": ["{{baseUrl}}"], "path": ["talon", "api", "markreadyforretesting"] },
            "body": { "mode": "urlencoded", "urlencoded": [
              { "key": "finding_id", "value": "{{finding_id}}" }
            ] },
            "description": "Flag a remediated finding for retesting."
          }
        }
      ]
    },
    {
      "name": "Lory Code Review API",
      "item": [
        {
          "name": "Review a code fragment",
          "request": {
            "method": "POST",
            "header": [
              { "key": "Content-Type", "value": "application/json" },
              { "key": "Authorization", "value": "Bearer {{lkmcp_token}}", "description": "Optional. Raises the rate limit to 120/min per token (vs 30/min per IP anonymous)." }
            ],
            "url": { "raw": "{{baseUrl}}/talon/ajax/lory-code-review", "host": ["{{baseUrl}}"], "path": ["talon", "ajax", "lory-code-review"] },
            "body": {
              "mode": "raw",
              "raw": "{\n  \"code\": \"def get_user(uid):\\n    q = \\\"SELECT * FROM users WHERE id = \\\" + uid\\n    return db.execute(q)\",\n  \"language\": \"python\",\n  \"filename\": \"app/users.py\",\n  \"start_line\": 1,\n  \"stream\": false\n}"
            },
            "description": "Security-review a fragment of source code. Returns findings anchored to line numbers.\n\nRequest fields:\n- code (required, ≤ 64 KB / ~1600 lines) — the source to review\n- language (optional) — hint, e.g. python, javascript, php\n- filename (optional) — basename used for context; path is stripped\n- start_line (optional) — line number of code[0] in the original file, so finding lines map back\n- stream (optional) — true for Server-Sent Events (events: finding, done, error) instead of one JSON body\n\nResponse (non-streaming):\n{ \"success\": true, \"findings\": [ { \"line\": 2, \"end_line\": 3, \"severity\": \"high\", \"title\": \"SQL injection\", \"detail\": \"...\", \"cwe\": \"CWE-89\", \"confidence\": \"high\", \"fix\": \"Use a parameterized query\", \"fix_note\": \"...\" } ], \"summary\": \"...\", \"meta\": { ... } }\n\nRate limits: 30 requests/60s per IP (anonymous), 120 requests/60s per lkmcp_ token."
          }
        }
      ]
    }
  ]
}