LeakIX - Host api-staging.purposemed.com

Domain api-staging.purposemed.com

United States

AMAZON-02

Software information

Heroku

tcp/443

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 76.223.57.73
Domain: api-staging.purposemed.com
Port: 443
URL: https://api-staging.purposemed.com

First seen 2025-10-28 01:19
Last seen 2026-01-01 21:19
Open for 65 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa30824c1aa4c28d29a34b730b6181a905fe693cdc7

GraphQL introspection enabled at /graphql
Types: 411 (by kind: ENUM: 32, INPUT_OBJECT: 125, INTERFACE: 7, OBJECT: 237, SCALAR: 8, UNION: 2)
Operations:
- Query: Query | fields: activeAnnouncement, acuityAccounts, acuityAppointmentTypes, acuityCalendars, appointment
- Mutation: Mutation | fields: abortTreatmentCycle, activateUserAccount, bookAppointment, cancelAppointment, completeAssessment
Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)

Found on 2026-01-01 21:19

528.3 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa36023633ef55ef8eef00a4a1ad5dc8f63fe2ee38b

GraphQL introspection enabled at /graphql
Types: 402 (by kind: ENUM: 32, INPUT_OBJECT: 125, INTERFACE: 7, OBJECT: 228, SCALAR: 8, UNION: 2)
Operations:
- Query: Query | fields: activeAnnouncement, acuityAccounts, acuityAppointmentTypes, acuityCalendars, appointment
- Mutation: Mutation | fields: abortTreatmentCycle, activateUserAccount, bookAppointment, cancelAppointment, completeAssessment
Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)

Found on 2025-12-10 16:57

513.8 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3563f3dfc2e5ed840009dd0347437cd4d75cf52e9

GraphQL introspection enabled at /graphql
Types: 400 (by kind: ENUM: 32, INPUT_OBJECT: 124, INTERFACE: 7, OBJECT: 227, SCALAR: 8, UNION: 2)
Operations:
- Query: Query | fields: activeAnnouncement, acuityAccounts, acuityAppointmentTypes, acuityCalendars, appointment
- Mutation: Mutation | fields: abortTreatmentCycle, activateUserAccount, bookAppointment, cancelAppointment, completeAssessment
Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)

Found on 2025-12-08 03:27

512.2 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3a3c9366269a05a326e03cebe7a06c4d7ae14076f

GraphQL introspection enabled at /graphql
Types: 393 (by kind: ENUM: 32, INPUT_OBJECT: 121, INTERFACE: 6, OBJECT: 224, SCALAR: 8, UNION: 2)
Operations:
- Query: Query | fields: activeAnnouncement, acuityAccounts, acuityAppointmentTypes, acuityCalendars, appointment
- Mutation: Mutation | fields: abortTreatmentCycle, activateUserAccount, bookAppointment, cancelAppointment, completeAssessment
Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)

Found on 2025-11-22 22:48

500.9 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3a674c9f2fe9a6f02b1c81aaece2551a77d3bc07f

GraphQL introspection enabled at /graphql
Types: 392 (by kind: ENUM: 32, INPUT_OBJECT: 121, INTERFACE: 6, OBJECT: 223, SCALAR: 8, UNION: 2)
Operations:
- Query: Query | fields: activeAnnouncement, acuityAccounts, acuityAppointmentTypes, acuityCalendars, appointment
- Mutation: Mutation | fields: abortTreatmentCycle, activateUserAccount, bookAppointment, cancelAppointment, completeAssessment
Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)

Found on 2025-11-12 17:01

499.1 kBytes

Create report

Open service 76.223.57.73:443 · api-staging.purposemed.com

2026-01-08 22:34

HTTP/1.1 302 Found
Cache-Control: no-cache
Content-Length: 0
Content-Type: text/html; charset=utf-8
Location: https://api-staging.purposemed.com/admin
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=LUuVfDvSan7lunYJoK3NEmaLLXE0mpcVeRiyZQQ6qis%3D\u0026sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6\u0026ts=1767911679"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=LUuVfDvSan7lunYJoK3NEmaLLXE0mpcVeRiyZQQ6qis%3D&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&ts=1767911679"
Server: Heroku
Set-Cookie: _freddie_session=aiobhsTeHiHJJNP%2BINk2B3onJMoQ2A5pyH7Pm4yspCkRtux8Uq%2BDjRS5H04OdvQOhW6bj6i399LFJ3z%2FC64uNYK5dEgwuJVL1V%2FA9oGC2NCoM7UYj9fFKiy3LLI%2BavBPk8Ef0ZPFm1nuq6YzKo3AzAUSffda40r5OF7dAmZl6DI%2Fs2pSIfk0qw%3D%3D--ZTZyxMH4BrrX8Rsm--D7hxITeoxDyWptMzySisbw%3D%3D; path=/; secure; httponly; samesite=lax
Set-Cookie: _freddie_session=r8tunQ7hF6GFgkP61WUN1YKjjOwirqOFi%2B0UNTfrpQXVSqHDR4%2BKYbc8Kjbb9%2FgTuitvLXDREJI4y7FKpKUvoAcJToHT1iCZ%2FjuZvaufrvetLCVKdYlDXy0kcYMG%2B64ulRQynxI9iylLq83l1phpnDS9ij6P%2BthqgJ6taTVjIl6PAgjKnAZvSA%3D%3D--yaWxtT%2FHHskuyhpB--VJbSXM6eZUNIzIq5teFQ9w%3D%3D; path=/; secure; httponly; samesite=lax
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding, Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: d943be38-0334-2748-2022-fca981b32e8d
X-Runtime: 0.041048
X-Xss-Protection: 0
Date: Thu, 08 Jan 2026 22:34:39 GMT
Connection: close

Found 2026-01-08 by HttpPlugin

Create report

Open service 76.223.57.73:443 · api-staging.purposemed.com

2026-01-01 21:19

HTTP/1.1 302 Found
Cache-Control: no-cache
Content-Length: 0
Content-Type: text/html; charset=utf-8
Location: https://api-staging.purposemed.com/admin
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=BgNfwa5GELNkKpLGF%2FSxwBllQx9%2FX9zMRi0bOWJaj9U%3D\u0026sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6\u0026ts=1767302372"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=BgNfwa5GELNkKpLGF%2FSxwBllQx9%2FX9zMRi0bOWJaj9U%3D&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&ts=1767302372"
Server: Heroku
Set-Cookie: _freddie_session=iVwu82%2FgGPRA3ddokuqwt8LUojggyidOoCIQ86uBt%2FNJz8YCbnvFaBZszlHBuTyV4XfOVWsKoJdoN8OnBo6HbskjjLNrzpJasek%2Fazt5Hy6cfLlxfExO%2BuzQ4W6jeYApDzmR%2BR7yTnpERN0IhbsZzj11EJQRMkuVvMSZnRJUJTqe6lMNwj7v6w%3D%3D--XvOnPhFGmESU5hN4--WmoNu9iaeaxdqhG4VPRoqg%3D%3D; path=/; secure; httponly; samesite=lax
Set-Cookie: _freddie_session=DHXK2FktCyc2lQao%2BMXZiXDuCHILRR4l3590tBUQvl7uATfxAmPVHkxCZZjPMQlX0%2BCvxPAQ3YHqPfAdHjcg5kpz040fItqe9vKfJES%2F3NeZ9wvxOxyORTE12JHh0BFJQ50ynkllU6vI0oJnXdFL4ikAZhpB6cv36FmYZpv635wWm72ODJLq5A%3D%3D--VLxrpT0mkUYTYEVR--R1CN5mhfR%2FIRKRWm%2FB4%2FRg%3D%3D; path=/; secure; httponly; samesite=lax
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding, Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 9834ef37-6076-d6df-c2e5-cf913b0ad0f1
X-Runtime: 0.005491
X-Xss-Protection: 0
Date: Thu, 01 Jan 2026 21:19:32 GMT
Connection: close

Found 2026-01-01 by HttpPlugin

Create report

Open service 76.223.57.73:443 · api-staging.purposemed.com

2025-12-23 02:37

HTTP/1.1 302 Found
Cache-Control: no-cache
Content-Length: 0
Content-Type: text/html; charset=utf-8
Location: https://api-staging.purposemed.com/admin
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=UWA1lNBxLpX3H3aa4oxNKlEyCAxSkxLif6q%2FbXZXdX4%3D\u0026sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6\u0026ts=1766457464"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=UWA1lNBxLpX3H3aa4oxNKlEyCAxSkxLif6q%2FbXZXdX4%3D&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&ts=1766457464"
Server: Heroku
Set-Cookie: _freddie_session=2yi9A5rlZ03fgpiLCTXDiptYb3BTAuBt5rK7llCk2mwQGX3taIx3G5HRDLdaOip2jti2nQMvSsZjWGe0X5OwnBPSgRH%2BdSBFE8W6NgErZ9eOIcAYmbgciAUmmOomUgqfE6LOtVfF4HfZ422IhGQSiXzXVb7WNW40Hp7Y9aZHcm2SIJcYWOb1vg%3D%3D--OkKMEWn0RvmTGd0v--dEkXL0Vr2%2FSsztQuIYrdEQ%3D%3D; path=/; secure; httponly; samesite=lax
Set-Cookie: _freddie_session=dpKtcc3vXIePWgQMMYXD3FJpUvYPL3G%2F0h4ybuT9vs7YSdIoAmqPjYgkcNsLjaYja8cwUrLiF%2BtOZB9yXmfeHkWnXMPmfpuJHmp%2BfTaco7UpKMoc88FqashTPvUs0sMmRcskqorausx39%2BbPVsePglSxtJDrTZye7adsSkhPgac4zLmH%2BD99eg%3D%3D--5oPocqEOF8J5yRVh--%2Bq2bM52W%2FEqC8GCIqeRypw%3D%3D; path=/; secure; httponly; samesite=lax
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding, Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: d96cc1a2-3e3c-3df5-e069-c002eb6ab6d5
X-Runtime: 0.004148
X-Xss-Protection: 0
Date: Tue, 23 Dec 2025 02:37:44 GMT
Connection: close

Found 2025-12-23 by HttpPlugin

Create report

Open service 76.223.57.73:443 · api-staging.purposemed.com

2025-12-20 20:20

HTTP/1.1 302 Found
Cache-Control: no-cache
Content-Length: 0
Content-Type: text/html; charset=utf-8
Location: https://api-staging.purposemed.com/admin
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=lXZis0F6hggCbr1aYQv%2F2aJW6sMUQwUjNvJQvUhTTyU%3D\u0026sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6\u0026ts=1766262057"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=lXZis0F6hggCbr1aYQv%2F2aJW6sMUQwUjNvJQvUhTTyU%3D&sid=929419e7-33ea-4e2f-85f0-7d8b7cd5cbd6&ts=1766262057"
Server: Heroku
Set-Cookie: _freddie_session=vho8nCP48gxH6gVaO327NB87IXipI3DcXIqO9yycADS5u4hsAYk%2F0PDvVEyZSKf2ltzKcy66iX6o0%2B50OrzU1FZqtfqeqCN2rMmQ8NIeRncRDN3LLw1yunNhHk%2FQK96MPhUkjmXU%2FqeSfpgzPe2xrZk8v8OMtG3zzPvwU3%2FUF82fTa1Moica9g%3D%3D--uGOP8qVCbJyy4BLU--TjToNXZmNlltElfETYb%2FRQ%3D%3D; path=/; secure; httponly; samesite=lax
Set-Cookie: _freddie_session=7VPhioAp2ESaXGXdrK7%2FMCWSD58lsEf%2FUOJ0BNZnIII%2BiXD1Mfqag385pcqBKvO2wF%2FjeF8Qm7CapTRu%2BD6NvowjJOoB7t0x1vG7CufSp8esrnVIEH2h5uJksb4UhsrXmVXjcQj8DkYQ5g%2BYS0u0BBAOHauD4AzFvas%2BnmdyDlNYqpHQd54Kyg%3D%3D--%2FA2B6zEMjT7TYOdB--QfBiKTQDvongoAIcFj3dXQ%3D%3D; path=/; secure; httponly; samesite=lax
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding, Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: cad65ece-65ac-3ff3-78e5-0c56bfebceda
X-Runtime: 0.004149
X-Xss-Protection: 0
Date: Sat, 20 Dec 2025 20:20:57 GMT
Connection: close

Found 2025-12-20 by HttpPlugin

Create report

api-staging.purposemed.com

Fingerprint:

9c814d313e642ad2e05a63b9cae976cfb4b2ca61024f01d1c0eabce564c648d2

CN:

api-staging.purposemed.com

Key:

RSA-2048

Issuer:

R13

Not before:

2025-12-27 23:20

Not after:

2026-03-27 23:20

api-staging.purposemed.com

Fingerprint:

39c7bd1c6052af8d273edfbe1711b2c97c07e5252e3c2ed37d72f31a1c0398f8

CN:

api-staging.purposemed.com

Key:

RSA-2048

Issuer:

R13

Not before:

2025-10-28 00:20

Not after:

2026-01-26 00:20

Domain summary

api-staging.purposemed.com 8

1 recorded

IP summary

76.223.57.73 2

1 recorded