# Crossfoot

> Pay-per-call compliance crosswalks (SOC 2, PCI DSS 4, NIST CSF 2, ISO 27001:2022, HIPAA Security Rule, NIST 800-53 r5) and audit evidence checklists. Paid via x402 (USDC).

Free: GET /v1/frameworks (framework ids and aliases), GET /v1/themes (control theme ids), GET /openapi.json

Paid:
- GET /v1/crosswalk  $0.02  Map a control requirement from one compliance framework to the related requirements in another (SOC 2, PCI DSS 4, NIST CSF 2, ISO 27001:2022, HIPAA Security Rule, NIST 800-53 r5). Optional 'ref' narrows to one control, e.g. CC6.1 or 8.4.
- GET /v1/theme  $0.03  Full mapping of one control theme (e.g. authentication-mfa, vendor-risk) across all six frameworks, plus a typical auditor evidence checklist. Theme ids are listed free at /v1/themes.
- GET /v1/evidence  $0.05  Typical evidence an auditor requests for a specific control, e.g. SOC 2 CC6.2 or PCI DSS 10.4. Returns a deduplicated checklist and the matched control themes.
- GET /v1/search  $0.01  Keyword search across control themes and framework requirement titles/ids. Returns matching themes and the specific requirements that matched.
- POST /v1/gap  $0.25  Overlap analysis: given frameworks an organization already operates under and a target framework, returns which target requirements overlap existing control themes (reuse existing policy/evidence) and which are net-new, with evidence checklists.

Responses include dataset_version and a disclaimer. This is informational mapping, not audit advice.