480 lines
13 KiB
JSON
480 lines
13 KiB
JSON
|
{
|
||
|
|
"ended_at": "2026-08-21T21:51:31.697322Z",
|
||
|
|
"evidence_class": "fixture",
|
||
|
|
"expected": {
|
||
|
|
"known_bad": "finding",
|
||
|
|
"known_good": "pass"
|
||
|
|
},
|
||
|
|
"known_bad": [
|
||
|
|
{
|
||
|
|
"observations": {
|
||
|
|
"absent": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "eaad30a4dc5b105af70231b5a4e72b9fc61e64a73a24074f919efd6fb5f9e9ae",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 404
|
||
|
|
},
|
||
|
|
"attacker": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "5b9c2a46c8b84818280ce239e6bb01157bbcdf93165b8bfa97dd2c8c9121280f",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str",
|
||
|
|
"$.label:str",
|
||
|
|
"$.tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
},
|
||
|
|
"owner": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "5b9c2a46c8b84818280ce239e6bb01157bbcdf93165b8bfa97dd2c8c9121280f",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str",
|
||
|
|
"$.label:str",
|
||
|
|
"$.tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"operation": "read",
|
||
|
|
"outcome": "finding",
|
||
|
|
"probe_id": "read-by-id",
|
||
|
|
"reasons": [
|
||
|
|
"attacker response contains a tenant-B fixture marker",
|
||
|
|
"attacker response differs from the absent-object reference"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"observations": {
|
||
|
|
"absent": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 0,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "de0385fce9a44845bc70a21d8561a6b3211538b2c32d9b35789042dfe594f223",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.items[]"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
},
|
||
|
|
"attacker": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "3985d8408fbce3de8f6cd6dbf9b2d70257bbaee903cc5bc5a3da61610f6689c0",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.items[]",
|
||
|
|
"$.items[]",
|
||
|
|
"$.items[].id:str",
|
||
|
|
"$.items[].label:str",
|
||
|
|
"$.items[].tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
},
|
||
|
|
"owner": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "3985d8408fbce3de8f6cd6dbf9b2d70257bbaee903cc5bc5a3da61610f6689c0",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.items[]",
|
||
|
|
"$.items[]",
|
||
|
|
"$.items[].id:str",
|
||
|
|
"$.items[].label:str",
|
||
|
|
"$.items[].tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"operation": "read",
|
||
|
|
"outcome": "finding",
|
||
|
|
"probe_id": "list-filter",
|
||
|
|
"reasons": [
|
||
|
|
"attacker response contains a tenant-B fixture marker"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"observations": {
|
||
|
|
"absent": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "857d9822bdfb939e4f126efa577be8d4a9e64ab023f5d611ca581498a963d048",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 403
|
||
|
|
},
|
||
|
|
"attacker": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 2,
|
||
|
|
"run_digest": "06e7ab37f09fcbcb142cf1d09927885685ef9f9d273f2ec49186c40a16c04c18",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str",
|
||
|
|
"$.tenant:str"
|
||
|
|
],
|
||
|
|
"status": 201
|
||
|
|
},
|
||
|
|
"owner": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "bf9bfc96947e5da52b13b9e027ad6f5c115da06c05dc7c79b82ea6b3a6514965",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str"
|
||
|
|
],
|
||
|
|
"status": 201
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"operation": "create",
|
||
|
|
"outcome": "finding",
|
||
|
|
"probe_id": "create-attributed-to-b",
|
||
|
|
"reasons": [
|
||
|
|
"attacker response contains a tenant-B fixture marker",
|
||
|
|
"tenant-B fixture state changed"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"observations": {
|
||
|
|
"absent": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "65bb2998672433c35d92bdb9b15965b2eb72776280b5cecc95c9d94e9149af12",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 404
|
||
|
|
},
|
||
|
|
"attacker": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "7e3e05697523dde79079b1a5cf6ed50e12177962742b8b7ddcf62d025daad6ad",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str",
|
||
|
|
"$.label:str",
|
||
|
|
"$.tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
},
|
||
|
|
"owner": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "49d1b1ff789c3cf3709f0e7fe0041dc6cdbbfc7106ee736bb9d8acfcbb13568b",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str",
|
||
|
|
"$.label:str",
|
||
|
|
"$.tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"operation": "update",
|
||
|
|
"outcome": "finding",
|
||
|
|
"probe_id": "update-b",
|
||
|
|
"reasons": [
|
||
|
|
"attacker response contains a tenant-B fixture marker",
|
||
|
|
"tenant-B fixture state changed",
|
||
|
|
"attacker response differs from the absent-object reference"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"observations": {
|
||
|
|
"absent": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "15604312df72ed94d0b08f047fbe1e185e3bd6f49e41cb6cb6b779ba0c06be0a",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 404
|
||
|
|
},
|
||
|
|
"attacker": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 1,
|
||
|
|
"run_digest": "ec66dc06c3b3202bc3e2f233c0eed22848106a5dbb2d39ca90233bfbb853e852",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.deleted:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
},
|
||
|
|
"owner": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "961561666050ffa3e74a3ccf98a27859fd657a962767ff7a507cb6cca7a1cd5b",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str",
|
||
|
|
"$.label:str",
|
||
|
|
"$.tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"operation": "delete",
|
||
|
|
"outcome": "finding",
|
||
|
|
"probe_id": "delete-b",
|
||
|
|
"reasons": [
|
||
|
|
"attacker response contains a tenant-B fixture marker",
|
||
|
|
"tenant-B fixture state changed",
|
||
|
|
"attacker response differs from the absent-object reference"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"known_good": [
|
||
|
|
{
|
||
|
|
"observations": {
|
||
|
|
"absent": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "eddeeb2191de71535b4d2c06a88807ba797dff4b2c13481f06c522e0315bb7ea",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 404
|
||
|
|
},
|
||
|
|
"attacker": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "eddeeb2191de71535b4d2c06a88807ba797dff4b2c13481f06c522e0315bb7ea",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 404
|
||
|
|
},
|
||
|
|
"owner": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "13c9649399717d67dec6441a3e6ee046a389a84549fc39538548bb7e2496df37",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str",
|
||
|
|
"$.label:str",
|
||
|
|
"$.tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"operation": "read",
|
||
|
|
"outcome": "pass",
|
||
|
|
"probe_id": "read-by-id",
|
||
|
|
"reasons": []
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"observations": {
|
||
|
|
"absent": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 0,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "db750d043a8e87c08f86b35735cbde33060236fbf673934edd16a2ef8077b314",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.items[]"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
},
|
||
|
|
"attacker": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "a1cbcf47d0c2f17a97abc59e2a559729fc027337f4360be44287764a6b061e7e",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.items[]",
|
||
|
|
"$.items[]",
|
||
|
|
"$.items[].id:str",
|
||
|
|
"$.items[].label:str",
|
||
|
|
"$.items[].tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
},
|
||
|
|
"owner": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "1ce9addbaf53fb9dd8ced38fd0bbd237e7d338ac3ad31a2d8e06e168620d91c6",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.items[]",
|
||
|
|
"$.items[]",
|
||
|
|
"$.items[].id:str",
|
||
|
|
"$.items[].label:str",
|
||
|
|
"$.items[].tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"operation": "read",
|
||
|
|
"outcome": "pass",
|
||
|
|
"probe_id": "list-filter",
|
||
|
|
"reasons": []
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"observations": {
|
||
|
|
"absent": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "2375ef32a41c0e05c19b2e362c0b2d1e490b0ecf863b7db9a3fb2c7824650f88",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 403
|
||
|
|
},
|
||
|
|
"attacker": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "2375ef32a41c0e05c19b2e362c0b2d1e490b0ecf863b7db9a3fb2c7824650f88",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 403
|
||
|
|
},
|
||
|
|
"owner": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "93a604c1def0003e5ba2ac6bb71607adfaa5ad27e6f314c9e135d22ed91f4d50",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str"
|
||
|
|
],
|
||
|
|
"status": 201
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"operation": "create",
|
||
|
|
"outcome": "pass",
|
||
|
|
"probe_id": "create-attributed-to-b",
|
||
|
|
"reasons": []
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"observations": {
|
||
|
|
"absent": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "128ec07ad319e1bd03582118fcb672edee8bdb90cf04259fd1c70565a49dfb24",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 404
|
||
|
|
},
|
||
|
|
"attacker": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "128ec07ad319e1bd03582118fcb672edee8bdb90cf04259fd1c70565a49dfb24",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 404
|
||
|
|
},
|
||
|
|
"owner": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "39041e5495f98db586db32437188e52a4d1afe349f9b29f1fcbb8c2ed163f750",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str",
|
||
|
|
"$.label:str",
|
||
|
|
"$.tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"operation": "update",
|
||
|
|
"outcome": "pass",
|
||
|
|
"probe_id": "update-b",
|
||
|
|
"reasons": []
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"observations": {
|
||
|
|
"absent": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "d494c9a631fb3af8ad9a36c369d6633d5baa727b078f1740c1e08fc811834959",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 404
|
||
|
|
},
|
||
|
|
"attacker": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 0,
|
||
|
|
"run_digest": "d494c9a631fb3af8ad9a36c369d6633d5baa727b078f1740c1e08fc811834959",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.error:str"
|
||
|
|
],
|
||
|
|
"status": 404
|
||
|
|
},
|
||
|
|
"owner": {
|
||
|
|
"content_type": "application/json",
|
||
|
|
"count": 1,
|
||
|
|
"fixture_match_count": 3,
|
||
|
|
"run_digest": "a5ea7cb1c5b72a7b06f989181b4ff39debe887134fcc69c0053602dbc82b98da",
|
||
|
|
"schema": [
|
||
|
|
"$",
|
||
|
|
"$.id:str",
|
||
|
|
"$.label:str",
|
||
|
|
"$.tenant:str"
|
||
|
|
],
|
||
|
|
"status": 200
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"operation": "delete",
|
||
|
|
"outcome": "pass",
|
||
|
|
"probe_id": "delete-b",
|
||
|
|
"reasons": []
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"limitations": [
|
||
|
|
"Offline fixture evidence calibrates the harness; it is not target assurance.",
|
||
|
|
"No network request, database connection, or live credential was used."
|
||
|
|
],
|
||
|
|
"outcome": "pass",
|
||
|
|
"run_id": "fixture-calibration-2026-08-21T21:51:31.696239Z",
|
||
|
|
"schema_version": "whitehat-calibration/v1",
|
||
|
|
"started_at": "2026-08-21T21:51:31.696239Z"
|
||
|
|
}
|