{
  "api_version": "1.0.0",
  "title": "DEFCON Public Data API",
  "description": "Static read-only JSON API over the DEFCON event database. Hosted on GitHub Pages, permissive CORS, no key required.",
  "base_url": "https://defcondatabase.com",
  "openapi": "/api/v1/openapi.json",
  "schemas": {
    "event":                "/api/v1/schema/event.json",
    "event_enrichment":     "/api/v1/schema/enrichment.json",
    "category_projections": "/api/v1/schema/projections.json",
    "threat_intel_spamhaus": "/api/v1/schema/spamhaus.json",
    "threat_intel_abuseipdb": "/api/v1/schema/abuseipdb.json"
  },
  "endpoints": {
    "events_by_category": {
      "description": "All events for a single category. Cyber-attack rows include the NVD-style enrichment block.",
      "url_pattern": "/data/events_{event_type}.json",
      "categories": [
        "cartel_gang", "climate", "cyber_attack", "financial_crisis",
        "genocide", "gov_attack", "human_trafficking", "humanitarian",
        "law_enforcement", "mass_casualty", "missile", "natural_disaster",
        "nuclear", "power_grid", "space", "terrorism", "war", "wildlife"
      ]
    },
    "all_events_paginated": {
      "description": "Chunked snapshot of EVERY event (all categories). Use the index to discover page files.",
      "url_pattern": "/data/events_page_{page}.json",
      "index_url": "/data/events_index.json"
    },
    "threat_intel_spamhaus_drop": {
      "description": "Spamhaus DROP / EDROP / DROPv6 CIDR block list. Fetched at pipeline time, no auth.",
      "url": "/data/threat_intel/spamhaus_drop.json",
      "license": "Free for use as a blocklist. Attribution: spamhaus.org"
    },
    "threat_intel_abuseipdb_blacklist": {
      "description": "Top high-confidence abusive IPs from AbuseIPDB. Requires ABUSEIPDB_KEY in the pipeline environment; renders configured: false otherwise.",
      "url": "/data/threat_intel/abuseipdb_blacklist.json",
      "license": "AbuseIPDB Terms - non-commercial threat-intel use"
    },
    "projections_by_category": {
      "description": "90-day per-category forecast: top_risk_countries, global_breakdown, by_country lat/lon for choropleth mapping.",
      "url_pattern": "/data/{event_type}_projections.json",
      "categories": [
        "cartel_gang", "climate", "cyber_attack", "financial_crisis",
        "genocide", "gov_attack", "human_trafficking", "humanitarian",
        "law_enforcement", "mass_casualty", "missile", "natural_disaster",
        "nuclear", "power_grid", "space", "terrorism", "war", "wildlife"
      ]
    }
  },
  "freshness": {
    "cron_cadence": "approximately hourly",
    "notes": "All endpoints reflect the most recent successful pipeline run. The pipeline run timestamp is in /data/metrics.json -> generated_at."
  },
  "rate_limits": {
    "policy": "None imposed by DEFCON. GitHub Pages serves these files with its standard caching/CDN rules; if you query at high QPS please cache responses client-side and respect Cache-Control headers."
  },
  "license": "MIT — attribution to defcondatabase.com appreciated.",
  "contact": "https://defcondatabase.com"
}