Adversarial-pattern signature scan: unsafe serialization, payloads among weights, license laundering, homoglyph namespaces, metadata spoofing.

Heuristic scan returning verdict clean|suspicious|dangerous with per-threat evidence and confidence. A finding is a verify-before-trust signal, not proof of malice; combine with /safety and /typosquat.

Inputs. Path, query and header fields are listed below. No request body is required.

Outputs. See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

Errors. API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

Rate limits. Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.

Example setup. Use an identifier returned by the matching list, search or create operation. Sample identifiers are not a promise that a record exists.