Sml-fractal-trading-os-v2 API

{
  "service_type": "crypto_app",
  "base_url": "https://sml-fractal-trading-os-v2.onrender.com",
  "auth_method": "none",
  "auth_config": {},
  "endpoints": [
    {"path": "/", "method": "GET", "purpose": "root endpoint (likely status/info)"}
  ],
  "pricing_model": {"type": "free", "details": {"note": "No pricing information available; assumed free"}},
  "rate_limits": {"rpm": 60},
  "capabilities": ["portfolio", "spot_trading"],
  "crypto_specifics": {
    "supported_chains": ["ethereum", "bitcoin", "solana"],
    "token_count": 0,
    "has_websocket": false,
    "has_orderbook": false,
    "fee_structure": "unknown",
    "security_features": []
  }
}

```json
{
  "tests": [
    {
      "name": "root_status",
      "endpoint": "/",
      "method": "GET",
      "headers": {},
      "payload": null,
      "expected_status": 200,
      "intent": "happy_path",
      "expected_behavior": "Root endpoint returns 200 with status or service info body",
      "metrics": ["latency", "status_code"],
      "validation": {"field": "status_code", "type": "integer", "equals": 200}
    },
    {
      "name": "root_content_type",
      "endpoint": "/",
      "method": "GET",
      "headers": {},
      "payload": null,
      "expected_status": 200,
      "intent": "happy_path",
      "expected_behavior": "Root endpoint returns a parseable body (JSON or HTML) with non-empty content",
      "metrics": ["latency", "accuracy"],
      "validation": {"field": "body", "type": "string", "min_length": 1}
    },
    {
      "name": "unknown_endpoint_404",
      "endpoint": "/this-path-should-not-exist-12345",
      "method": "GET",
      "headers": {},
      "payload": null,
      "expected_status": 404,
      "intent": "validation",
      "expected_behavior": "Unknown path is rejected with 404, not a 200 or 500",
      "metrics": ["status_code"],
      "validation": {"field": "status_code", "type": "integer", "equals": 404}
    },
    {
      "name": "invalid_method_on_root",
      "endpoint": "/",
      "method": "POST",
      "headers": {"Content-Type": "application/json"},
      "payload": {"unexpected": "body"},
      "expected_status": 405,
      "intent": "validation",
      "expected_behavior": "Server rejects POST on root (likely 405 or 404) rather than crashing with 5xx",
      "metrics": ["status_code"],
      "validation": {"field": "status_code", "type": "integer", "in": [404, 405]}
    },
    {
      "name": "security_headers_check",
      "endpoint": "/",
      "method": "GET",
      "headers": {},
      "payload": null,
      "expected_status": 200,
      "intent": "happy_path",
      "expected_behavior": "Response headers checked for HSTS, X-Content-Type-Options, X-Frame-Options; recorded for scoring",
      "metrics": ["latency", "accuracy"],
      "validation": {"field": "headers", "type": "object"}
    },
    {
      "name": "rate_limit_headers_check",
      "endpoint": "/",
      "method": "GET",
      "headers": {},
      "payload": null,
      "expected_status": 200,
      "intent": "happy_path",
      "expected_behavior": "Check for RateLimit-* or X-RateLimit-* headers; recorded (not strictly required)",
      "metrics": ["latency"],
      "validation": {"field": "headers", "type": "object"}
    },
    {
      "name": "root_latency_baseline",
      "endpoint": "/",
      "method": "GET",
      "headers": {},
      "payload": null,
      "expected_status": 200,
      "intent": "happy_path",
      "expected_behavior": "Repeated GET to measure warm-up latency; Render free tier cold start noted separately",
      "metrics": ["latency", "status_code"],
      "validation": {"field": "status_code", "type": "integer", "equals": 200}
    },
    {
      "name": "stress_low_rps",
      "endpoint": "/",
      "method": "GET",
      "headers": {},
      "payload": null,
      "expected_status": 200,
      "intent": "stress",
      "expected_behavior": "Low-concurrency GET load (well under 60 rpm) stays healthy without errors",
      "metrics": ["latency", "status_code", "accuracy"],
      "validation": {"field": "status_code", "type": "integer", "equals": 200}
    }
  ],
  "pricing_probes": [
    {
      "name": "free_tier_no_billing",
      "description": "Service described as free with no pricing; verify no usage/payment headers or 402 responses are returned",
      "endpoint": "/",
      "method": "GET",
      "payload": null,
      "check": "response.status_code != 402 and no billing/credits headers present"
    },
    {
      "name": "no_auth_required",
      "description": "Auth method is 'none'; confirm root succeeds without credentials (no 401/403)",
      "endpoint": "/",
      "method": "GET",
      "payload": null,
      "check": "response.status_code is 200 without Authorization header"
    }
  ],
  "stress_profile": {
    "concurrent_requests": 3,
    "duration_seconds": 10,
    "ramp_up": true
  }
}
```

7/8 tests passed

{
  "overall": 14,
  "dimensions": {
    "token_efficiency": 0.5,
    "first_try_success": 0.5,
    "response_parseability": 0.5,
    "error_clarity": 1.0,
    "doc_quality": 0.5,
    "auth_simplicity": 5.0,
    "latency": 8.5,
    "consistency": 1.0
  },
  "pricing_normalized": {
    "maker_fee_bps": null,
    "taker_fee_bps": null,
    "withdrawal_fee_usd": null,
    "free_tier_requests": null
  },
  "issues": [
    "Root endpoint (/) returns an HTML SPA page (ScriptMasterLabs 'SML Fractal'), not JSON — no documented API base path.",
    "All probe tests returned text/html — no discoverable JSON API surface at the given base URL.",
    "Unknown path returns 200 with HTML SPA instead of a JSON 404 — breaks error-driven discovery.",
    "No security headers present (no HSTS, CSP, X-Content-Type-Options on the HTML response).",
    "No rate-limiting headers exposed (X-RateLimit-*, Retry-After).",
    "No OpenAPI/JSON error schema — 404 returns {'error': 'Not found'} but only on invalid method, inconsistent with path-based 404s returning 200 HTML.",
    "No market-data, pricing, or trading endpoints discoverable — cannot fetch quotes, orderbook, fees, or portfolio data.",
    "No fee schedule, no portfolio endpoint, no spot-trading endpoint reachable at documented base URL."
  ],
  "recommendations": [
    "Expose a distinct JSON API base (e.g., /api/v1) separate from the SPA host; document it clearly.",
    "Return JSON 404 for unknown paths instead of serving index.html — enables agent self-discovery and limits wasted calls.",
    "Add a GET /api/v1/markets or /api/v1/ticker returning [{\"symbol\", \"price\", \"volume_24h\", \"change_24h\", \"ts\"}] with numeric fields.",
    "Add GET /api/v1/fees returning {maker_bps, taker_bps, withdrawal_fee_usd}.",
    "Add GET /api/v1/portfolio and POST /api/v1/orders with clear auth scheme (API key + HMAC).",
    "Document all endpoints in an OpenAPI spec or machine-readable JSON at /api/v1/openapi.json.",
    "Add X-RateLimit-Limit / X-RateLimit-Remaining / Retry-After headers, and return 429 with a JSON body explaining the limit when exceeded.",
    "Return typed JSON errors (code, message, hint) for invalid symbols, insufficient funds, and unknown routes.",
    "Add standard security headers (Strict-Transport-Security, X-Content-Type-Options: nosniff, Content-Security-Policy).",
    "Expose server time / clock endpoint to aid agents in detecting stale market data."
  ]
}