{
  "endpoint": "/api/probe",
  "method": "POST",
  "content_type": "application/json",
  "description": "Ingest a single probe result from a local pentest tool (nmap, tshark, aircrack-ng, bettercap, ...). Stored as a network_handshakes row; flagged as bridged via metadata.bridge=true.",
  "schema": {
    "tool": "string (required) — e.g. 'nmap', 'tshark'",
    "flow_id": "string (default 'termux-bridge')",
    "flow_name": "string",
    "source_node": "string (required) — e.g. 'phone-wlan0'",
    "target_node": "string (required) — e.g. '192.168.1.1:443'",
    "protocol": "string (required) — e.g. 'tcp', 'tls', '802.11', 'lte'",
    "status": "'syn'|'ack'|'fin'|'rst'|'psh' (default 'syn')",
    "latency_ms": "number|null",
    "packet_size_bytes": "integer (default 0)",
    "vector_direction": "'inbound'|'outbound'|'bidirectional'",
    "node_path": "string[]",
    "device_fingerprint": "string (optional, recommended)",
    "raw_excerpt": "string ≤ 8000 chars (optional truncated tool output)",
    "metadata": "object (optional, free-form)"
  },
  "example_curl": "curl -X POST https://YOUR-APP/api/probe -H 'Content-Type: application/json' -d '{\"tool\":\"nmap\",\"source_node\":\"phone-wlan0\",\"target_node\":\"192.168.1.1\",\"protocol\":\"tcp\",\"status\":\"syn\",\"packet_size_bytes\":74}'"
}