Skip to main content
Neuron packages expose several focused security services.

​
mTLS ping

The mTLS test package provides a page, API, client library, unit tests, and CLI that report connection information and any client certificate received by the Neuron. Use it to separate network/TLS termination problems from application authorization. Verify:
  • the client sent a certificate;
  • no reverse proxy stripped it;
  • subject/issuer and chain are expected;
  • key usage and validity interval permit client authentication;
  • the application maps the certificate to the intended account.
Do not return full certificate or connection diagnostics to unauthenticated Internet callers in production.

​
What’s My Endpoint

GET or POST /WMEP returns the request’s observed remote endpoint as text/plain. It helps diagnose NAT and proxy paths. Treat forwarded headers as trusted only when they came from a configured proxy.

​
DNS over HTTPS

/dns-query implements the RFC 8484 wire format:
  • GET /dns-query?dns={base64url-dns-message} with Accept: application/dns-message;
  • HTTPS POST /dns-query with Content-Type: application/dns-message.
The response preserves the query ID, returns application/dns-message, and can include Cache-Control for GET. Unencrypted POST is rejected. A Neuron DoH endpoint is a resolver service: apply abuse controls, query logging/privacy policy, recursion policy, and outbound DNS hardening before exposing it publicly.

​
Open intelligence

The Agent API can check login-auditor state and create/query/update/delete expiring intelligence records about endpoints. See Open intelligence reference.

​
QR APIs

QR resources generate single or multi-purpose codes for text and platform URI schemes such as onboarding, discovery, signatures, payments, or remote login. A QR code is only an encoding; validate the decoded URI scheme, origin, expiry, signature, and intended action before displaying a confirmation or executing it. See QR codes and Neuro URI schemes for endpoint parameters and secure dispatch behavior.

​
Vault and private storage

Use the Agent vault endpoints for protected application content and the PCI-oriented vault package where its compliance boundary applies. A vault reference is not public authorization: authenticate, check object ownership/access, and avoid leaking retrieval links into logs.