StartBrain developers and AI agents

Brain (Brain Security SAS, Paris) publishes cyber and AI security awareness products for employees. This page lists every machine-readable entry point of the site. Everything here is public, read-only, without authentication or API key. There is a public read-only JSON API (/api/v1/, OpenAPI 3.1) and no write API: to act, agents link users to a product page, the free self-service signup or the booking page.

Read the site without HTML

• /llms.txt (French site guide, llmstxt.org format) and /llms-full.txt (detailed guide with every product sheet)
• /index.md: agent view of the site root, also served on https://startbrain.io/ with Accept: text/markdown or ?mode=agent
• Markdown twin of every page: append .md to the slug, e.g. /en-us/catalog/cyber-cup.md; each HTML page advertises it with <link rel="alternate" type="text/markdown">
• /pricing.md: public prices, excluding VAT
• /sitemap.xml with lastmod, 8 languages

Public API v1 (read-only JSON)

Products in 8 languages, use cases, public prices and languages, generated at each build from the same sources as the pages. No authentication (/auth.md). Specification: /api/v1/openapi.json (OpenAPI 3.1, every response has a schema); catalog: /.well-known/api-catalog (RFC 9727).

GET https://startbrain.io/api/v1/                      index, policies, endpoints
GET https://startbrain.io/api/v1/products?lang=en-us&limit=20&offset=0
GET https://startbrain.io/api/v1/products?lang=fr&theme=ia           filters: theme=cyber|ia, status=open|signup_closed|coming_soon
GET https://startbrain.io/api/v1/products?ids=cybercup,brainarcade    batch read by id or slug
GET https://startbrain.io/api/v1/products/cybercup?lang=fr             full sheet: description, features, specs, stats, FAQ, use cases, alternates
GET https://startbrain.io/api/v1/use-cases?lang=en-us
GET https://startbrain.io/api/v1/pricing
GET https://startbrain.io/api/v1/languages

• Language: lang query parameter, else Accept-Language, else fr.
• Pagination: limit (1 to 50, default 20) and an opaque cursor (from pagination.next_cursor); offset is also accepted. The response carries pagination.total, next, prev and next_cursor.
• Errors: RFC 9457 application/problem+json with type, title, status, detail, instance and a machine-readable code. Codes: 400 invalid parameter, 404 unknown product or endpoint, 405 method other than GET/HEAD/OPTIONS, 429 rate limit, 503 data missing. Never 401 or 403: nothing is protected.
• Rate limit: 600 requests per 60 s per client IP, best effort per server instance (isolate), not global. Headers RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, RateLimit-Policy; a 429 adds Retry-After.
• Versioning: major version in the path and in the API-Version header. Additive changes stay in v1 (ignore unknown fields); a breaking change means /api/v2/, and v1 stays served at least 12 months after a deprecation announced with Deprecation and Sunset headers.
• Idempotency, sandbox: every operation is a GET, idempotent by nature, no Idempotency-Key; there is no separate sandbox because nothing can be modified, so calling production while developing is safe. Responses are cacheable 5 minutes and CORS is open.
• Function calling: the OpenAPI operations (listProducts, getProduct, listUseCases, getPricing, listLanguages) have typed parameters and enums and can be loaded as tools by any agent framework that reads OpenAPI.

Search: NLWeb /ask

A keyword search over the whole site following the NLWeb 0.55 protocol, with JSON or Server-Sent Events responses.

GET  https://startbrain.io/ask?query=cybersecurity+awareness+month&lang=en-us
POST https://startbrain.io/ask
     {"query":{"text":"borne d'arcade pour un salon"},"prefer":{"streaming":true,"accept-language":"fr"}}

Response: {"_meta":{"response_type":"answer","version":"0.55",…},"results":[{"url","name","site","score","description","schema_object"}]}. Streaming events: start, result, complete.

Structured data feeds (schema.org)

• /schemamap.xml (NLWeb Schema Feeds, declared in robots.txt)
• /feeds/products.jsonl: one SoftwareApplication per product and language
• /feeds/pages.jsonl: one WebPage per section and language

Agent discovery

• /.well-known/ard.json (Agentic Resource Discovery) and /.well-known/ai-catalog.json
• /.well-known/agent-skills/index.json: four skills (startbrain, startbrain-cybermois, startbrain-ai-spring, startbrain-arcade)
• Skills, plugin manifest and AGENTS.md on GitHub: github.com/startbrain/startbrain-agent-skills · install with npx skills add startbrain/startbrain-agent-skills

In-page tools (WebMCP)

On browsers that expose document.modelContext (WebMCP proposal, Chrome origin trial), the site registers four tools: find_brain_product, list_brain_products, get_brain_pricing, book_brain_meeting. They read the catalogue and navigate; nothing is purchased or created.

Contact

Booking: /en-us/book-a-demo/ · [email protected] · Legal: terms of service, privacy.