# StartBrain developers and AI agents (startbrain.io)

Brain (Brain Security SAS, Paris) publishes cyber and AI security awareness products for employees. Every entry point below is public, read-only, without authentication or API key. There is a public read-only JSON API (/api/v1/, OpenAPI 3.1) and no write API: to act, agents link users to a product page, the free self-service signup or the booking page.

## Read the site without HTML

- https://startbrain.io/llms.txt (French site guide) and https://startbrain.io/llms-full.txt
- https://startbrain.io/index.md : agent view of the root, also served on https://startbrain.io/ with `Accept: text/markdown` or `?mode=agent`
- Markdown twin of every page: append `.md` to the slug, e.g. https://startbrain.io/en-us/catalog/cyber-cup.md
- https://startbrain.io/pricing.md : public prices excluding VAT
- https://startbrain.io/sitemap.xml with lastmod, 8 languages

## Public API v1 (read-only JSON)

Products in 8 languages, use cases, public prices and languages, generated at each build from the same sources as the pages. No authentication (https://startbrain.io/auth.md). Specification: https://startbrain.io/api/v1/openapi.json (OpenAPI 3.1, every response has a schema). Catalog: https://startbrain.io/.well-known/api-catalog (RFC 9727).

```
GET https://startbrain.io/api/v1/                      index, policies, endpoints
GET https://startbrain.io/api/v1/products?lang=en-us&limit=20&offset=0
GET https://startbrain.io/api/v1/products?lang=fr&theme=ia           filters: theme=cyber|ia, status=open|signup_closed|coming_soon
GET https://startbrain.io/api/v1/products?ids=cybercup,brainarcade    batch read by id or slug
GET https://startbrain.io/api/v1/products/cybercup?lang=fr             full sheet: description, features, specs, stats, FAQ, use cases, alternates
GET https://startbrain.io/api/v1/use-cases?lang=en-us
GET https://startbrain.io/api/v1/pricing
GET https://startbrain.io/api/v1/languages
```

- Language: `lang` query parameter, else `Accept-Language`, else `fr`.
- Pagination: `limit` (1 to 50, default 20) and an opaque `cursor` (from `pagination.next_cursor`); `offset` also accepted. Response carries `pagination.total`, `next`, `prev` and `next_cursor`.
- Errors: RFC 9457 `application/problem+json` (`type`, `title`, `status`, `detail`, `instance`, machine-readable `code`). Codes 400, 404, 405, 429, 503. Never 401 or 403: nothing is protected.
- Rate limit: 600 requests per 60 s per client IP, best effort per server instance (isolate), not global. Headers `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`, `RateLimit-Policy`; 429 adds `Retry-After`.
- Versioning: major version in the path and in the `API-Version` header; additive changes stay in v1; a breaking change means /api/v2/ and v1 stays served at least 12 months after a deprecation announced with `Deprecation` and `Sunset` headers.
- Idempotency and sandbox: GET only, idempotent by nature, no `Idempotency-Key`; no separate sandbox because nothing can be modified. Responses cacheable 5 minutes, CORS open.

## Search: NLWeb /ask

Keyword search over the whole site, NLWeb 0.55 protocol, JSON or Server-Sent Events.

```
GET  https://startbrain.io/ask?query=cybersecurity+awareness+month&lang=en-us
POST https://startbrain.io/ask   {"query":{"text":"borne d'arcade pour un salon"},"prefer":{"streaming":true,"accept-language":"fr"}}
```

Response: `{"_meta":{"response_type":"answer","version":"0.55"},"results":[{"url","name","site","score","description","schema_object"}]}`. Streaming events: `start`, `result`, `complete`.

## Structured data feeds (schema.org)

- https://startbrain.io/schemamap.xml (NLWeb Schema Feeds, declared in robots.txt)
- https://startbrain.io/feeds/products.jsonl : one SoftwareApplication per product and language
- https://startbrain.io/feeds/pages.jsonl : one WebPage per section and language

## Agent discovery

- https://startbrain.io/.well-known/ard.json and https://startbrain.io/.well-known/ai-catalog.json
- https://startbrain.io/.well-known/agent-skills/index.json : skills startbrain, startbrain-cybermois, startbrain-ai-spring, startbrain-arcade
- https://github.com/startbrain/startbrain-agent-skills : SKILL.md, plugin.json, AGENTS.md (`npx skills add startbrain/startbrain-agent-skills`)

## In-page tools (WebMCP)

On browsers exposing `document.modelContext`, the site registers `find_brain_product`, `list_brain_products`, `get_brain_pricing` and `book_brain_meeting`. They read the catalogue and navigate; nothing is purchased or created.

## Contact

Booking https://startbrain.io/en-us/book-a-demo/ · contact@startbrain.io