Struct VerifySpec 

pub struct VerifySpec {
    pub service: String,
    pub method: Option<HttpMethod>,
    pub url: Option<String>,
    pub auth: Option<AuthSpec>,
    pub headers: Vec<HeaderSpec>,
    pub body: Option<String>,
    pub success: Option<SuccessSpec>,
    pub metadata: Vec<MetadataSpec>,
    pub timeout_ms: Option<u64>,
    pub steps: Vec<StepSpec>,
    pub allowed_domains: Vec<String>,
    pub oob: Option<OobSpec>,
}

Live verification configuration for a detector.

Fields

service: String

Target service identifier (defaults to detector’s service if omitted).

method: Option<HttpMethod>

HTTP method (default: GET).

url: Option<String>

Endpoint URL with optional `{{match}}` or `{{companion.}}` placeholders.

auth: Option<AuthSpec>

Authentication scheme.

headers: Vec<HeaderSpec>

Custom HTTP headers.

body: Option<String>

Optional request body template.

success: Option<SuccessSpec>

Criteria for a successful verification.

metadata: Vec<MetadataSpec>

Metadata to extract from the response.

timeout_ms: Option<u64>

Optional request timeout override.

steps: Vec<StepSpec>

Multi-step verification flow.

allowed_domains: Vec<String>

Domain allowlist for the verify URL after interpolation. If non-empty, the resolved host of the (interpolated) URL — and of every step’s URL — MUST equal one of these entries (or be a subdomain of one). When empty, the verifier falls back to a hardcoded service allowlist if the service field maps to a known provider; otherwise the verifier REFUSES to send the request. This blocks malicious detector TOMLs that set url = "{{match}}" (or interpolate an attacker-controlled companion) from exfiltrating credentials. See kimi-wave1 audit finding 4.1 + wave3 §1.

oob: Option<OobSpec>

Optional out-of-band verification probe. When set, the verifier mints a per-finding correlation URL via the configured interactsh server, substitutes {{interactsh}} (and {{interactsh.host}} / {{interactsh.url}}) into the request template, and waits for the service to call back. OOB verification proves a leaked credential is exfil-capable, not just live: a webhook URL that returns 200 OK to every probe still has to actually fetch our collector to confirm it will deliver attacker-controlled traffic.

Gated behind the runtime --verify-oob flag — never default. When the flag is off, oob is ignored and verification falls back to the HTTP success criteria alone.

Trait Implementations

impl Clone for VerifySpec

fn clone(&self) -> VerifySpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerifySpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for VerifySpec

fn default() -> VerifySpec

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for VerifySpec

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for VerifySpec

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.