Documentation of a closed endpoint: compute calls return 403. The OpenAPI spec stays public.

Base URL, format, limits

Not a speed claim — a number every response actually carries

Every JSON response includes its own real computeTimeMs (and the same number again in a standard Server-Timing header, which Chrome/Firefox DevTools' Network panel already understands natively) — timed around the actual arithmetic only, not request parsing or JSON serialization, so it answers one question: how long did the exact-arithmetic engine itself take for this exact input. Nothing here is a marketing number; run the curl examples above yourself and read it straight off the response.

Who can use this, for what

Exact arithmetic calculator

Same engine as the calculator in the Observatory's free tools: fraction arithmetic all the way through, exact repeating decimals, exact continued fractions. + - * / and parentheses. Never a float, in the browser or here.

curl -X POST https://kodamaseclabs.com/api?action=exact \
  -H "Content-Type: application/json" \
  -d '{"expression":"0.1 + 0.2"}'

→ {"input":"0.1 + 0.2","numerator":"3","denominator":"10","fraction":"3/10", ..., "computeTimeMs":1}

Collatz trajectory

Any positive whole number, exact arbitrary-precision arithmetic (native BigInt, on the only path there is), up to 1000 digits. Trajectory capped at 5000 accelerated steps server-side same as the browser tool; the JSON response itself is capped to the first 1000 steps, and further limited so the reply stays a sensible size — each step carries two full decimal numbers, so the step budget scales down as those numbers grow (a 1000-digit start returns about 32 steps, not 1000). Either way stepsTruncated tells you (see stepsTruncated) to keep replies a sane size.

curl -X POST https://kodamaseclabs.com/api?action=collatz \
  -H "Content-Type: application/json" \
  -d '{"start":"27"}'

→ {"input":"27","stepCount":41,"reachedOne":true,"maxJumpV2":5, ..., "computeTimeMs":0}

Miller–Rabin primality trace

Same fixed 12-base Miller–Rabin as the browser tool, with an explicit confidence statement attached — proven zero false positives below 3.3×10²⁴ (Sorenson & Webster, 2015), a strong empirical claim above that, never a bare "yes" or "no". Up to 400 digits.

curl -X POST https://kodamaseclabs.com/api?action=primality \
  -H "Content-Type: application/json" \
  -d '{"number":"97"}'

→ {"input":"97","composite":false,"reason":"passed all 12 witnesses tested -- proven prime, not probabilistic: n is below the bound (Sorenson & Webster, 2015) where these exact 12 bases are known to have zero false positives", ..., "computeTimeMs":5}

Status codes

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"error": "Missing "expression"."}

What's new here, and how it was verified

The exact-arithmetic endpoints are a server-side port of the same algorithm already running in your browser in the free tools -- same fraction engine, same recursive-descent parser (never eval), same Miller–Rabin square-and-multiply. This paragraph said “PHP + BCMath” until 7 August 2026, which stopped being true when the site moved to a Cloudflare Worker and native BigInt; the same wrong claim was in the OpenAPI file and is corrected there too. It was actually run and checked, not just reasoned about: real execution against the same reference cases used throughout this site (0.1+0.2=3/10, 355/113's continued fraction, Collatz(27), Miller–Rabin cross-checked against independent trial division for every n from 2 to 2999), plus a numeric-value comparison against the browser engine on the same inputs, plus real HTTP requests against these exact endpoints. If a result here ever disagrees with what the free tools give you for the same input, that's a real bug worth reporting -- please do.

There is no longer a form here

Closed on 7 August 2026. There was an application form on this page until that date: one dropdown, one checkbox, an optional client code, and a proof-of-work your browser solved before a key was issued. It is gone, and so is the endpoint behind it — ?action=apply returns 403 before it looks at anything you send. We are not leaving a form that would take your input and refuse it.

Why it went. That form was the only thing on this site that stored anything resembling a contact detail. It never took a name or an email, but it stored a keyed hash of a handle, and a stable identifier derived from something of yours is still a stable identifier. With the compute endpoints closed there was nothing left for it to be for, so it was removed rather than kept collecting for a service nobody can call. What that means for the data protection notice is written out at /privacy, section B0.

Who can call it now. Auditors and experts engaged and paid by KodamaSEC Labs Ltd, using a client code issued to them directly. There is no self-service path to that and no queue to join, and we would rather say so than run an application form whose answer is always no.

What did not close. Everything on this site that computes does it in your own browser and is untouched: the exact-arithmetic tools, The Notebook, Labs and Factory. None of them has ever called this API. The documentation on this page and /openapi.json also stay open, because reading what an endpoint does should not require permission even when calling it does.

If you hold a key issued before 7 August 2026: it no longer computes anything, and you can still see what is recorded against it and ask for it to be erased. List what you hold.

Limits, and the request that produced them

Every limit below exists because a specific request made it necessary, and the numbers are the measured ones rather than round figures chosen to sound careful.

The request: on 5 August 2026, during an audit of this endpoint, we sent POST /api?action=collatz with a start value of 1000 nines — the largest input the documented limit allows.

The cause, stated plainly because it is the useful part: the response cap counted steps, not bytes. Each step carries from and to as full decimal strings, so a thousand steps is a few kilobytes for a ten-digit start and two megabytes for a thousand-digit one. The limit was right for what someone types into the demo and wrong for what someone sends deliberately.

What changed: the step budget now scales with the size of the numbers involved — about 64,000 digits of trajectory in total. Ordinary inputs still return the full 1000 steps; a 1000-digit start returns about 32. stepsTruncated tells you either way. That exact request no longer produces that response, and it is documented here rather than quietly patched, because an endpoint that reports its own limits is easier to trust than one that just has them.

A monthly ceiling as well. This API is free but not open: it needs a key, and the key carries a shared daily allowance, so its cost is bounded twice over — once per applicant and once for the whole site. It is capped at an estimated €40 of compute per calendar month; past that it returns 503 with the spend so far and resets on the 1st. That estimate comes from a stated model — Cloudflare’s published unit prices for requests, CPU-milliseconds and KV operations — and it is our own arithmetic, not a bill from anyone. The browser tools at /tools and the exhibits at /kodama-house are unaffected by it: they compute on your machine and cost us nothing at all.