Bernstein Csp Report API

openapi: 3.2.0
info:
  title: Bernstein Task Server Csp Report API
  description: 'Bernstein REST API - the open-source governance layer for AI agents, one git worktree per task.


    ## Authentication


    Authentication is ENABLED by default. Include a Bearer token in all requests:


    ```

    Authorization: Bearer

    ```


    To run without auth (development only), set `BERNSTEIN_AUTH_DISABLED=1` - this logs a loud warning and passes every request through.


    Public endpoints (no auth required): `/health`, `/health/ready`, `/health/live`, `/ready`, `/alive`, `/.well-known/agent.json`, `/docs`, `/openapi.json`, and the auth-flow endpoints (`/auth/login`, `/auth/oidc/callback`, etc.).


    Webhook and hook endpoints (`/webhook`, `/webhooks/*`, `/hooks/{session_id}`) authenticate via HMAC-SHA256 signatures - they do NOT accept Bearer tokens.


    ## Base URL


    Default: `http://127.0.0.1:8052`. Override with env vars `BERNSTEIN_HOST` and `BERNSTEIN_PORT`.


    ## Error Format


    All errors return JSON with a `detail` field:


    ```json

    {"detail": "Task not found: task-xyz"}

    ```


    | Status | Meaning |

    |--------|---------|

    | 400 | Bad request (validation error) |

    | 401 | Unauthorized (missing/invalid token) |

    | 403 | Forbidden (IP not in allowlist) |

    | 404 | Resource not found |

    | 409 | Conflict (task already in terminal state) |

    | 429 | Rate limited - respect the `Retry-After` header |

    | 500 | Internal server error |'
  version: 3.22.0
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  contact:
    name: Alex Chernysh
    url: https://github.com/sipyourdrink-ltd/bernstein
servers:
- url: http://{host}:{port}
  description: Task server started by the Bernstein CLI on the operator's own machine. There is no hosted instance; substitute the host and port of your install.
  variables:
    host:
      default: 127.0.0.1
      description: Interface the task server binds to. Loopback by default.
    port:
      default: '8052'
      description: Task server port. Override with BERNSTEIN_PORT.
tags:
- name: Csp Report
paths:
  /api/csp-report:
    description: Content-Security-Policy violation sink for the landing site. This is the one path in this document that does not live on the operator's task server, so it carries its own `servers` entry below. Browsers post here on their own - the route is named by the `report-uri` and `report-to` directives of every response's Content-Security-Policy - and nothing else is expected to call it.
    servers:
    - url: https://bernstein.run
      description: The landing site. Not the task server.
    post:
      summary: Receive a Content-Security-Policy violation report
      description: 'Accepts both wire formats: a single kebab-case report under a `csp-report` key (`report-uri`, which is what Firefox and Safari send) and an array of Reporting API envelopes (`report-to`, which Chrome sends and batches). Envelopes whose `type` is not `csp-violation` are ignored. Unauthenticated by construction, since browsers send these without credentials; the body is treated as hostile, summarised into the server log, and never echoed back.'
      operationId: reportCspViolation
      requestBody:
        required: true
        content:
          application/csp-report:
            schema:
              type: object
              properties:
                csp-report:
                  type: object
                  description: One violation, kebab-case fields.
          application/reports+json:
            schema:
              type: array
              items:
                type: object
                properties:
                  type:
                    type: string
                    description: Report kind. Only `csp-violation` is read.
                  body:
                    type: object
                    description: One violation, camelCase fields.
      responses:
        '204':
          description: 'Always, whatever happened. A report that was rate-limited, oversized, wrongly typed or unparseable gets the same empty reply as one that was logged: a browser cannot act on the status, and a uniform answer tells a prober nothing.'
      tags:
      - Csp Report
    get:
      summary: Not supported - reports arrive by POST
      operationId: cspReportMethodNotAllowed
      responses:
        '405':
          description: Always. The response names POST in its Allow header.
      tags:
      - Csp Report