P83 Gate 1. The caller is the subject: every fact here comes from the
TLS handshake and headers the caller has already sent, so there is no
render, no browser, and nothing to authorize.
Three surfaces:
- `client` — user-agent, HTTP protocol, TLS version/cipher, ClientHello
length, the pre-hashed JA3/JA4 input components, header order.
- `state` — how many cookies were sent (never their values), Referer,
DNT, Global Privacy Control.
- `network` — address, ASN and operator, coarse geography, edge colo,
and the four-lens verdict on the caller's own IP.
Every field carries a coverage state from the same three-value
vocabulary as `/v1/verify`: `observed_clean`, `never_observed`,
`degraded`. There is no fourth state. Fields that run inside a page —
localStorage, canvas fingerprinting, cookie values — are reported
`never_observed` with reason `not_observable_server_side`, because they
are outside a server's vantage rather than missing.
`claim_vs_conduct` compares the claimed user-agent against the shape of
the request itself and returns `consistent`, `mismatch`, or
`unverifiable`, with the evidence listed. It is deliberately narrow:
JA4 requires Cloudflare Enterprise + Bot Management, so there is no
portable fingerprint to look up in a public corpus, and this check only
reports contradictions it can demonstrate from the request in hand.
`unverifiable` is the honest default and is never dressed up as a pass.
Use this tool when:
- You want to know what a server learns about your client without
asking you anything.
- You are checking whether a client's user-agent claim matches its
conduct.
Do NOT use this tool when:
- You need facts about some OTHER host — that is `POST /v1/verify/{node}`.
Must be called directly at `data.tunnelmind.ai`. Behind a proxy, the
connection properties describe the proxy, not the caller.
`?receipt=true` attaches a signed Receipt v1.0 committed to the
transparency log.
Rate limits: anonymous: 10 per minute per IP; no daily cap on /v1/self, /v1/pricing, /v1/ledger and /v1/weather/station/{icao}/health; other anonymous probes 100 per day; free tier 50 per day.
`?receipt=true` calls also count against a separate anonymous bucket
(10/min, 100/day).