forked from mirrors/kingfisher
52 lines
1.5 KiB
YAML
52 lines
1.5 KiB
YAML
rules:
|
|
- name: Highnote API Key
|
|
id: kingfisher.highnote.1
|
|
pattern: |
|
|
(?x)
|
|
\b
|
|
(?i:highnote)
|
|
(?:.|[\n\r]){0,24}?
|
|
\b
|
|
(
|
|
sk_live_a2V5Xz[A-Za-z0-9+/]{69}={0,2}
|
|
)
|
|
(?:[^A-Za-z0-9+/=]|$)
|
|
pattern_requirements:
|
|
min_digits: 2
|
|
min_entropy: 3.5
|
|
confidence: medium
|
|
categories: [api, key]
|
|
examples:
|
|
- 'HIGHNOTE_API_KEY="sk_live_a2V5XzAxS1BSWE1LTjBEWE1INlpBU0VEWjU2VFE3LFdjOWxFMTNDS29xRkdlYU9uMUpDbUpTZWE"'
|
|
validation:
|
|
type: Http
|
|
content:
|
|
request:
|
|
method: POST
|
|
url: >
|
|
{%- if TOKEN contains "_test_" -%}
|
|
https://api.us.test.highnote.com/graphql
|
|
{%- else -%}
|
|
https://api.us.highnote.com/graphql
|
|
{%- endif -%}
|
|
headers:
|
|
Authorization: "Basic {{ TOKEN | b64enc }}"
|
|
Content-Type: application/json
|
|
Accept: application/json
|
|
body: '{"query":"query { ping }"}'
|
|
response_matcher:
|
|
- report_response: true
|
|
- type: StatusMatch
|
|
status: [200]
|
|
- type: JsonValid
|
|
- type: WordMatch
|
|
match_all_words: true
|
|
words:
|
|
- '"data"'
|
|
- '"ping"'
|
|
- '"pong"'
|
|
# Revocation not added: the public Highnote docs I found describe API key
|
|
# usage and rotation guidance, but not an API endpoint to revoke the
|
|
# current key directly.
|
|
references:
|
|
- https://docs.highnote.com/docs/developers/api/using-the-api
|