The neural-grade API

01Overview

Everything in v2 follows the same handful of conventions. Learn them once and every endpoint behaves the way you expect.

02Quickstart

Three requests from zero to a validated implant stack. Pick your language — the choice is remembered.

curl -X POST https://cyber-punk.online/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=$CP_CLIENT_ID \
  -d client_secret=$CP_CLIENT_SECRET \
  -d scope="catalog:read orders:write"

# → {"access_token": "eyJhbGciOi…", "token_type": "Bearer", "expires_in": 3600}

const res = await fetch("https://cyber-punk.online/oauth/token", {
  method: "POST",
  body: new URLSearchParams({
    grant_type: "client_credentials",
    client_id: process.env.CP_CLIENT_ID,
    client_secret: process.env.CP_CLIENT_SECRET,
    scope: "catalog:read orders:write",
  }),
});
const { access_token: token } = await res.json();

import os, requests

r = requests.post("https://cyber-punk.online/oauth/token", data={
    "grant_type": "client_credentials",
    "client_id": os.environ["CP_CLIENT_ID"],
    "client_secret": os.environ["CP_CLIENT_SECRET"],
    "scope": "catalog:read orders:write",
})
token = r.json()["access_token"]

curl -G https://cyber-punk.online/api/v2/implants \
  -H "Authorization: Bearer $CP_TOKEN" \
  --data-urlencode "filter[category]=ocular" \
  -d limit=20

const url = new URL("https://cyber-punk.online/api/v2/implants");
url.searchParams.set("filter[category]", "ocular");
url.searchParams.set("limit", "20");

const { data, meta } = await fetch(url, {
  headers: { Authorization: `Bearer ${token}` },
}).then(r => r.json());

data.forEach(i => console.log(i.sku, i.name, i.specs.neuralLoad));

r = requests.get(
    "https://cyber-punk.online/api/v2/implants",
    params={"filter[category]": "ocular", "limit": 20},
    headers={"Authorization": f"Bearer {token}"},
)
for implant in r.json()["data"]:
    print(implant["sku"], implant["name"], implant["specs"]["neuralLoad"])

curl -X POST https://cyber-punk.online/api/v2/compatibility/check \
  -H "Authorization: Bearer $CP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "neuralProfile": { "interfaceBus": "NL-4", "neuralBudget": 100, "powerBudgetMw": 1200 },
    "installed":  ["KSL-OCU-KX7"],
    "candidates": ["OZU-NEU-SYN3"]
  }'

const check = await fetch("https://cyber-punk.online/api/v2/compatibility/check", {
  method: "POST",
  headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
  body: JSON.stringify({
    neuralProfile: { interfaceBus: "NL-4", neuralBudget: 100, powerBudgetMw: 1200 },
    installed: ["KSL-OCU-KX7"],
    candidates: ["OZU-NEU-SYN3"],
  }),
}).then(r => r.json());

console.log(check.compatible, check.warnings);

r = requests.post(
    "https://cyber-punk.online/api/v2/compatibility/check",
    headers={"Authorization": f"Bearer {token}"},
    json={
        "neuralProfile": {"interfaceBus": "NL-4", "neuralBudget": 100, "powerBudgetMw": 1200},
        "installed": ["KSL-OCU-KX7"],
        "candidates": ["OZU-NEU-SYN3"],
    },
)
print(r.json()["compatible"], r.json()["warnings"])

03Authentication

OAuth 2.1 client credentials. Tokens are short-lived and scoped: request only what your integration needs.

GET /api/v2/implants HTTP/1.1
Host: cyber-punk.online
Authorization: Bearer eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJhY2NfUThOMyJ9.…
Accept: application/json

04Live console

Pick an endpoint, hit Send, read the response. A fast way to get a feel for the shape of the data.

// Sandbox preview: responses are sample data rendered in your browser, no request leaves this page.

05Neural load simulator

Build a stack and watch the compatibility engine react in real time — exactly the rules POST /compatibility/check applies before every checkout.

06Endpoints

The full reference. Paths are relative to https://cyber-punk.online; filter by keyword, method or scope.

// No endpoint matches that signal.

07Data model

The implant object is the heart of v2. Every field below is returned by GET /api/v2/implants/{sku}.

neuralLoad · int 0–100

Neural Load Index (NLI): share of the nervous system's processing headroom the implant consumes. Stacks above 85% of the budget warn, above 100% are rejected.

interfaceBus · enum

NL-3 (legacy), NL-4 (current standard) or NL-5 (high-bandwidth, needed for full-sensory implants).

powerDrawMw · int

Continuous draw from the subdermal bio-cell, in milliwatts. Under 20% headroom triggers a warning.

bioRejectionRisk · enum

low · moderate · high, from material biocompatibility. Network-wide rejection rate: 0.3%.

surgeryClass · A–D

A: outpatient. B: minor invasive. C: spinal or cranial. D: full-limb replacement. Clinics only book classes they're certified for.

firmware · object

Current version, channel and otaSupported. Releases live under /firmware.

iceRating · int 1–5 | null

Security implants only: tier of intrusion countermeasures protecting the neural port.

compatibleWith · string[]

Buses the implant runs on. Empty for passive implants, which fit any profile.

{
  "data": {
    "sku": "KSL-OCU-KX7",
    "name": "KX-7 Ocular Overlay",
    "category": "ocular",
    "manufacturer": "Kessler Neuroworks",
    "price": { "amount": 249900, "currency": "EUR" },
    "stock": { "status": "preorder", "availableFrom": "2027-06-27" },
    "specs": {
      "interfaceBus": "NL-4",
      "neuralLoad": 18,
      "powerDrawMw": 340,
      "bioRejectionRisk": "low",
      "surgeryClass": "B",
      "iceRating": null,
      "firmware": { "version": "4.2.1", "channel": "stable", "otaSupported": true }
    },
    "compatibleWith": ["NL-4", "NL-5"],
    "legacy": false,
    "updatedAt": "2026-10-09T08:00:00Z"
  },
  "meta": { "apiVersion": "2.4.1", "requestId": "req_01JAX9F3K2" }
}

08Firmware vault

3,912 signed images across every implant in the catalog. Your chrome only ever runs code we can vouch for — as long as you check.

import crypto from "node:crypto";

// release = one item from GET /api/v2/implants/{sku}/firmware
const digest = crypto.createHash("sha256").update(image).digest("hex");
if (digest !== release.sha256) throw new Error("Checksum mismatch. Do not flash.");

const signature = Buffer.from(release.signature.replace("ed25519:", ""), "base64");
const valid = crypto.verify(null, image, CP_FIRMWARE_PUBLIC_KEY, signature);
if (!valid) throw new Error("Unsigned chrome. Do not flash.");

09Webhooks

Stop polling. We push events to your HTTPS endpoint, retry with exponential backoff for 24 hours, and sign every delivery.

POST /hooks/cp HTTP/1.1
Content-Type: application/json
CP-Event: implant.firmware.released
CP-Signature: t=1792195200,sha256=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

{
  "id": "evt_01JB2Q7XK4",
  "type": "implant.firmware.released",
  "createdAt": "2026-10-09T08:00:04Z",
  "mode": "live",
  "data": { "sku": "KSL-OCU-KX7", "releaseId": "fw_kx7_421", "channel": "stable", "version": "4.2.1" }
}

import crypto from "node:crypto";

export function verifyCpSignature(rawBody, header, secret, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(",").map(p => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false; // replay guard

  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.sha256 || "", "hex");
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

10Errors & limits

Errors use real HTTP statuses and an application/problem+json body (RFC 9457) with a stable code you can switch on.

{
  "type": "https://cyber-punk.online/docs/errors/neural-load-exceeded",
  "title": "Neural load exceeded",
  "status": 422,
  "code": "NEURAL_LOAD_EXCEEDED",
  "detail": "Stack totals 112 NLI against a budget of 100.",
  "requestId": "req_01JB2R0C8M"
}

HTTP/1.1 200 OK
RateLimit-Limit: 600        # requests per minute, per token
RateLimit-Remaining: 587
RateLimit-Reset: 42         # seconds until the window resets
Retry-After: 42             # only on 429

11Changelog

Additive changes only within v2. Nothing here breaks an existing integration.

1. v2.4.1 · 02 Oct 2026

   Local clinic times

   Clinic slots now carry the local UTC offset alongside the UTC timestamp.

2. v2.4.0 · 15 Sep 2026

   ICE ratings & NLI filter

   New iceRating field on security implants and filter[maxNeuralLoad] on the catalog.

3. v2.3.0 · 08 Jul 2026

   Saved neural profiles

   PUT /api/v2/me/neural-profile and useSavedProfile on compatibility checks.

4. v2.2.0 · 20 May 2026

   LTS firmware channel

   18-month support channel for clinics and fleets, plus implant.recalled webhooks.

5. v2.0.0 · 03 Mar 2026

   General availability

   OAuth 2.1, compatibility engine, signed firmware vault and webhooks go live.