> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuro-tech.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security utility APIs

> Use mTLS diagnostics, endpoint reputation, QR resources, and protected storage

Neuron packages expose several focused security services.

## mTLS ping

The mTLS test package provides a page, API, client library, unit tests, and CLI that report connection information and any client certificate received by the Neuron. Use it to separate network/TLS termination problems from application authorization.

Verify:

* the client sent a certificate;
* no reverse proxy stripped it;
* subject/issuer and chain are expected;
* key usage and validity interval permit client authentication;
* the application maps the certificate to the intended account.

Do not return full certificate or connection diagnostics to unauthenticated Internet callers in production.

## What's My Endpoint

`GET` or `POST /WMEP` returns the request's observed remote endpoint as `text/plain`. It helps diagnose NAT and proxy paths. Treat forwarded headers as trusted only when they came from a configured proxy.

## DNS over HTTPS

`/dns-query` implements the RFC 8484 wire format:

* `GET /dns-query?dns={base64url-dns-message}` with `Accept: application/dns-message`;
* HTTPS `POST /dns-query` with `Content-Type: application/dns-message`.

The response preserves the query ID, returns `application/dns-message`, and can include `Cache-Control` for GET. Unencrypted POST is rejected. A Neuron DoH endpoint is a resolver service: apply abuse controls, query logging/privacy policy, recursion policy, and outbound DNS hardening before exposing it publicly.

## Open intelligence

The Agent API can check login-auditor state and create/query/update/delete expiring intelligence records about endpoints. See [Open intelligence reference](/neuron-api/api-reference/open-intelligence/overview).

## QR APIs

QR resources generate single or multi-purpose codes for text and platform URI schemes such as onboarding, discovery, signatures, payments, or remote login. A QR code is only an encoding; validate the decoded URI scheme, origin, expiry, signature, and intended action before displaying a confirmation or executing it.

See [QR codes and Neuro URI schemes](/protocols/qr-and-uri-schemes) for endpoint parameters and secure dispatch behavior.

## Vault and private storage

Use the Agent vault endpoints for protected application content and the PCI-oriented vault package where its compliance boundary applies. A vault reference is not public authorization: authenticate, check object ownership/access, and avoid leaking retrieval links into logs.