{ "openapi": "3.1.0", "info": { "title": "Sectigo Quantum Ready API", "version": "0.24.0", "description": "Development API for cryptographic discovery. This contract documents implemented endpoints; it does not claim completion of enterprise identity, managed integrations or production admission." }, "servers": [ { "url": "https://qscan.dev" }, { "url": "http://127.0.0.1:8791", "description": "Local development" } ], "security": [ { "organizationCredential": [] }, { "browserSession": [] } ], "paths": { "/api/health": { "get": { "operationId": "health", "summary": "Deployment health", "description": "", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "service": { "type": "string" }, "version": { "type": "string" }, "stage": { "type": "string" } }, "required": [ "service", "version", "stage" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "security": [] } }, "/api/bootstrap": { "post": { "operationId": "provisionOrganization", "summary": "Provision an organization", "description": "Operator-only bearer bootstrap secret. Disabled when the deployment secret is absent. This credential is distinct from organization API credentials.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "organization": { "$ref": "#/components/schemas/Organization" }, "token": { "type": "string" }, "expiresAt": { "type": "string", "format": "date-time" } }, "required": [ "organization", "token", "expiresAt" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "minLength": 2, "maxLength": 120 } }, "required": [ "name" ] } } } }, "security": [ { "bootstrapSecret": [] } ] } }, "/api/v1/me": { "get": { "operationId": "identity", "summary": "Current credential identity", "description": "", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Me" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/api/v1/risk/recalculation": { "get": { "operationId": "riskRecalculation", "summary": "Read current risk policy and recalculation progress", "description": "Allowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "currentPolicyVersion": { "type": "string" }, "remaining": { "type": "integer" }, "run": { "anyOf": [ { "$ref": "#/components/schemas/RiskRun" }, { "type": "null" } ] } }, "required": [ "currentPolicyVersion", "remaining", "run" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "operationId": "recalculateRisk", "summary": "Recalculate outdated inventory with the current risk policy", "description": "Durable bounded background work. Active requests coalesce. Original evidence is unchanged; per-asset revisions bind old/new risk to the evidence ID. Suspended tenants pause until an administrator starts a new request.\n\nAllowed roles: admin.", "responses": { "202": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RiskRun" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "required": [] } } } } } }, "/api/v1/assets/{id}/risk-history": { "get": { "operationId": "riskHistory", "summary": "List asset risk recalculation revisions", "description": "Allowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/RiskRevision" } }, "nextBefore": { "type": [ "string", "null" ] } }, "required": [ "items", "nextBefore" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "before", "in": "query", "schema": { "type": "string", "maxLength": 100 } } ] } }, "/api/v1/overview": { "get": { "operationId": "overview", "summary": "Organization discovery metrics", "description": "Allowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Overview" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/api/v1/assets": { "get": { "operationId": "listAssets", "summary": "Paginated cryptographic inventory", "description": "Stable asset-ID cursor order. Filters apply before pagination; total is the number of matching assets in the authenticated tenant. Live data may change between pages. Search matches name, algorithm and owner, with ASCII case folding and literal substring semantics.\n\nAllowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AssetPage" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "after", "in": "query", "schema": { "type": "string", "maxLength": 100 } }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 100 } }, { "name": "q", "in": "query", "schema": { "type": "string", "maxLength": 200 } }, { "name": "severity", "in": "query", "schema": { "enum": [ "critical", "high", "medium", "low", "unknown" ] } }, { "name": "kind", "in": "query", "schema": { "enum": [ "tls", "ssh", "code", "library", "key", "cloud", "runtime", "certificate" ] } } ] } }, "/api/v1/assets/{id}/impact": { "get": { "operationId": "assetImpact", "summary": "Traverse declared asset dependents", "description": "Reverse breadth-first traversal of explicit current observation dependencies, referencing tenant asset IDs. Cycles are deduplicated. Unknown references are counted, not inferred. At most 5,000 tenant assets and 100,000 resolved relationships; larger graphs return 409. Truncation is explicit. Relationships are declared evidence, not verified runtime coupling or a complete dependency graph.\n\nAllowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "root": { "type": "object" }, "direction": { "const": "dependents" }, "relationshipBasis": { "const": "declared-observation-dependencies" }, "directDependencies": { "type": "array", "items": { "type": "object" } }, "directDependentCount": { "type": "integer" }, "dependents": { "type": "array", "items": { "type": "object" } }, "returnedDependents": { "type": "integer" }, "truncated": { "type": "boolean" }, "truncationReasons": { "type": "array", "items": { "enum": [ "depth", "nodes" ] } }, "limits": { "type": "object", "properties": { "maxDepth": { "type": "integer" }, "maxNodes": { "type": "integer" } }, "required": [] }, "graph": { "type": "object", "properties": { "assets": { "type": "integer" }, "resolvedRelationships": { "type": "integer" }, "unresolvedReferences": { "type": "integer" } }, "required": [] }, "rootUnresolvedReferences": { "type": "integer" } }, "required": [ "root", "direction", "relationshipBasis", "directDependencies", "directDependentCount", "dependents", "returnedDependents", "truncated", "truncationReasons", "limits", "graph", "rootUnresolvedReferences" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "maxDepth", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 20, "default": 10 } }, { "name": "maxNodes", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 200 } } ] } }, "/api/v1/assets/{id}": { "get": { "operationId": "getAsset", "summary": "Get a cryptographic asset", "description": "Allowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Asset" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/observations": { "post": { "operationId": "ingestObservations", "summary": "Ingest idempotent observations", "description": "Maximum 512 KiB and 200 observations. Agent credentials must supply the assigned live jobId and leaseToken. Ingestors submit standalone CI observations. Retry the same payload with the same idempotencyKey; changing its content returns 409.\n\nAllowed roles: admin, analyst, agent, ingestor.", "responses": { "202": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Receipt" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ObservationBatch" } } } } } }, "/api/v1/evidence": { "get": { "operationId": "listEvidence", "summary": "Read observation provenance", "description": "At most 100 records for one asset, otherwise at most 200 records.\n\nAllowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Evidence" } } }, "required": [ "items" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "assetId", "in": "query", "schema": { "type": "string" } } ] } }, "/api/v1/archive": { "get": { "operationId": "archiveStatus", "summary": "Evidence archive status", "description": "Allowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArchiveStatus" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/api/v1/archive/backfill": { "post": { "operationId": "backfillArchive", "summary": "Queue existing evidence for archival", "description": "Allowed roles: admin.", "responses": { "202": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "queued": { "type": "integer" }, "nextCursor": { "type": [ "string", "null" ] } }, "required": [ "queued", "nextCursor" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "after": { "type": "string" }, "limit": { "type": "integer", "minimum": 1, "maximum": 200, "default": 100 } }, "required": [] } } } } } }, "/api/v1/evidence/{id}/artifact": { "get": { "operationId": "downloadArtifact", "summary": "Download verified canonical evidence", "description": "Returns canonical UTF-8 JSON bytes. X-Content-SHA256 contains the verified SHA-256 of those exact bytes. Do not reserialize when preserving the artifact. Returns 409 until archived and 503 if verification fails.\n\nAllowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Artifact" } } }, "headers": { "X-Content-SHA256": { "schema": { "type": "string", "pattern": "^[a-f0-9]{64}$" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/credentials": { "get": { "operationId": "listCredentials", "summary": "List credential metadata", "description": "Never returns stored hashes or plaintext tokens. At most 200 records.\n\nAllowed roles: admin.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Credential" } } }, "required": [ "items" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "operationId": "createCredential", "summary": "Issue a scoped credential", "description": "Token is returned once. Expires after 90 days.\n\nAllowed roles: admin.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IssuedCredential" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 100 }, "role": { "enum": [ "admin", "analyst", "viewer", "ingestor" ] } }, "required": [ "name", "role" ] } } } } } }, "/api/v1/credentials/{id}": { "delete": { "operationId": "revokeCredential", "summary": "Revoke a credential", "description": "The active administrator credential cannot revoke itself. Revoking an agent credential also cancels its jobs and pauses its schedules.\n\nAllowed roles: admin.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "revoked": { "const": true } }, "required": [ "revoked" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/agents": { "get": { "operationId": "listAgents", "summary": "List enrolled agents", "description": "Allowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Agent" } } }, "required": [ "items" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "operationId": "enrollAgent", "summary": "Enroll an agent", "description": "Allowed roles: admin.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "token": { "type": "string" }, "expiresAt": { "type": "string", "format": "date-time" } }, "required": [ "id", "token", "expiresAt" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 100 }, "capabilities": { "type": "array", "minItems": 1, "items": { "enum": [ "tls", "code", "ssh", "capture" ] } } }, "required": [ "name", "capabilities" ] } } } } } }, "/api/v1/agents/{id}/configuration-history": { "get": { "operationId": "agentConfigurationHistory", "summary": "List historical configuration summaries", "description": "Newest first, scoped to the tenant and agent. Cursor is an exclusive revision number. Summaries omit configured paths and targets. Use the revision endpoint for settings. Available after agent revocation for audit; restoration is not allowed for revoked agents.\n\nAllowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "type": "object", "properties": { "revision": { "type": "integer" }, "updatedAt": { "type": "string", "format": "date-time" }, "updatedBy": { "type": "string" }, "enabled": { "type": "boolean" }, "pollSeconds": { "type": "integer" }, "tlsTargets": { "type": "integer" }, "sshTargets": { "type": "integer" }, "repositoryRoots": { "type": "integer" }, "captureRoots": { "type": "integer" } }, "required": [ "revision", "updatedAt", "updatedBy", "enabled", "pollSeconds", "tlsTargets", "sshTargets", "repositoryRoots" ] } }, "nextBefore": { "type": [ "integer", "null" ] } }, "required": [ "items", "nextBefore" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "before", "in": "query", "schema": { "type": "integer", "minimum": 1 } }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 50, "default": 20 } } ] } }, "/api/v1/agents/{id}/configuration-history/{revision}": { "get": { "operationId": "agentConfigurationRevision", "summary": "Read one published configuration revision", "description": "Historical desired settings, not proof of application. Administrators can review and publish these settings as a new revision through publishAgentConfiguration with the current expectedRevision. This read never mutates current configuration.\n\nAllowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "revision": { "type": "integer" }, "updatedAt": { "type": "string", "format": "date-time" }, "updatedBy": { "type": "string" }, "settings": { "$ref": "#/components/schemas/ManagedSettings" } }, "required": [ "revision", "updatedAt", "updatedBy", "settings" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "revision", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "revision", "in": "path", "required": true, "schema": { "type": "integer", "minimum": 1 } } ] } }, "/api/v1/agents/{id}/configuration": { "post": { "operationId": "publishAgentConfiguration", "summary": "Publish agent configuration within local permission limits", "description": "Optimistic concurrency uses expectedRevision (0 initially). Publication blocks new job claims until the agent acknowledges this revision. Existing running jobs may complete. Local opt-in and scope checks are enforced by scanner 0.11.0 or newer; capture capability and captureRoots require scanner 0.13.0 or newer. Omit captureRoots for older non-capture agents. Configuration is delivered only to the authenticated agent through heartbeat.\n\nAllowed roles: admin.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "revision": { "type": "integer" }, "settings": { "$ref": "#/components/schemas/ManagedSettings" }, "updatedAt": { "type": "string", "format": "date-time" }, "updatedBy": { "type": "string" } }, "required": [ "revision", "settings", "updatedAt", "updatedBy" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigurationInput" } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ] } }, "/api/v1/agents/configuration-status": { "post": { "operationId": "acknowledgeAgentConfiguration", "summary": "Report current configuration application status", "description": "Bound to the authenticated agent. Stale revisions return 409. This is an agent report, not independent attestation.\n\nAllowed roles: agent.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "ok": { "const": true } }, "required": [ "ok" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigurationStatus" } } } } } }, "/api/v1/agents/heartbeat": { "post": { "operationId": "heartbeat", "summary": "Report agent liveness", "description": "Allowed roles: agent.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "ok": { "const": true }, "serverTime": { "type": "string", "format": "date-time" }, "configuration": { "type": [ "object", "null" ] } }, "required": [ "ok", "serverTime" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "scannerVersion": { "type": "string", "maxLength": 40, "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" }, "pythonVersion": { "type": "string", "maxLength": 40, "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" } }, "required": [] } } } } } }, "/api/v1/agents/{id}/revoke": { "post": { "operationId": "revokeAgent", "summary": "Revoke agent and pending work", "description": "Allowed roles: admin.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "revoked": { "const": true } }, "required": [ "revoked" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "required": [] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/jobs": { "get": { "operationId": "listJobs", "summary": "List jobs without lease secrets", "description": "At most 200 jobs. Also recovers expired leases and registers legacy jobs for background monitoring.\n\nAllowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Job" } } }, "required": [ "items" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "operationId": "createJob", "summary": "Create a discovery job", "description": "Allowed roles: admin, analyst.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Job" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/JobInput" } } } } } }, "/api/v1/jobs/claim": { "post": { "operationId": "claimJob", "summary": "Claim the next assigned job", "description": "Use a stable claimId when retrying after a lost response. One active job per agent. Successful claims replay for up to 24 hours without resurrecting terminal leases.\n\nAllowed roles: agent.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "job": { "anyOf": [ { "$ref": "#/components/schemas/LeasedJob" }, { "type": "null" } ] } }, "required": [ "job" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "claimId": { "type": "string", "format": "uuid" } }, "required": [] } } } } } }, "/api/v1/jobs/{id}/renew": { "post": { "operationId": "renewJob", "summary": "Renew a live lease", "description": "Allowed roles: agent.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "leaseExpiresAt": { "type": "string", "format": "date-time" } }, "required": [ "leaseExpiresAt" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "leaseToken": { "type": "string" } }, "required": [ "leaseToken" ] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/jobs/{id}/cancel": { "post": { "operationId": "cancelJob", "summary": "Cancel queued or running work", "description": "Allowed roles: admin, analyst.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "cancelled": { "const": true } }, "required": [ "cancelled" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "reason": { "type": "string", "minLength": 1, "maxLength": 500 } }, "required": [ "reason" ] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/jobs/{id}/complete": { "post": { "operationId": "completeJob", "summary": "Complete a leased job", "description": "Successful observation count must equal accepted evidence for the current attempt. Exact completion replay is idempotent.\n\nAllowed roles: agent.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "ok": { "const": true } }, "required": [ "ok" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "leaseToken": { "type": "string" }, "status": { "enum": [ "completed", "failed" ] }, "observations": { "type": "integer", "minimum": 0, "default": 0 }, "error": { "type": "string", "maxLength": 1000 } }, "required": [ "leaseToken", "status" ] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/schedules": { "get": { "operationId": "listSchedules", "summary": "List recurring discovery schedules", "description": "Allowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Schedule" } } }, "required": [ "items" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "operationId": "createSchedule", "summary": "Create a recurring schedule", "description": "5-minute to 30-day interval, at most 100 schedules per organization. First run must be in the future and within one year. Missed and overlapping occurrences are skipped. Browser-created schedules use a standing user grant rechecked for every occurrence, independent of session expiry. API-credential schedules retain credential expiry and revocation semantics.\n\nAllowed roles: admin, analyst.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Schedule" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScheduleInput" } } } } } }, "/api/v1/schedules/{id}/state": { "post": { "operationId": "setScheduleState", "summary": "Pause or resume a schedule", "description": "Pausing affects future occurrences, not already-created jobs. Resuming starts one full interval from now and updates authorization.\n\nAllowed roles: admin, analyst.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Schedule" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/cbom": { "get": { "operationId": "exportCbom", "summary": "Export CycloneDX 1.7 CBOM", "description": "Synchronous export supports at most 10,000 assets. Full CBOM structure is governed by the official CycloneDX 1.7 schema.\n\nAllowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Cbom" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/api/v1/audit": { "get": { "operationId": "listAudit", "summary": "Read paginated tenant audit events", "description": "Newest event ID first. IDs contain issuance timestamps and UUIDs. Pass nextCursor as before; tenant scope always comes from authorization. This is a live history, not a frozen snapshot.\n\nAllowed roles: admin, analyst.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/AuditEvent" } }, "nextCursor": { "type": [ "string", "null" ] } }, "required": [ "items", "nextCursor" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "before", "in": "query", "schema": { "type": "string", "maxLength": 100 } }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 100 } } ] } }, "/api/v1/plans": { "get": { "operationId": "listPlans", "summary": "List migration tasks", "description": "Allowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Plan" } } }, "required": [ "items" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "operationId": "createPlan", "summary": "Create a planned migration task", "description": "Allowed roles: admin, analyst.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Plan" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanInput" } } } } } }, "/api/v1/plans/{id}/history": { "get": { "operationId": "planHistory", "summary": "Read immutable task revisions", "description": "Newest first, up to 100 revisions. Use nextBefore to retrieve older revisions.\n\nAllowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Plan" } }, "nextBefore": { "type": [ "integer", "null" ] } }, "required": [ "items", "nextBefore" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "before", "in": "query", "schema": { "type": "integer" } } ] } }, "/api/v1/plans/{id}": { "get": { "operationId": "getPlan", "summary": "Read a migration task", "description": "Allowed roles: admin, analyst, viewer.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Plan" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] }, "patch": { "operationId": "updatePlan", "summary": "Update task ownership, dates and acceptance criteria", "description": "Optimistic concurrency requires expectedVersion. Criteria can change only in planned state. Reopen verified tasks before editing.\n\nAllowed roles: admin, analyst.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Plan" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanUpdate" } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/plans/{id}/state": { "post": { "operationId": "transitionPlan", "summary": "Start, reopen or verify a migration task", "description": "Verification requires current evidence for the task asset, collected after work started, matching the fixed algorithm criteria and minimum confidence. This closes a scoped task, not an assertion of overall quantum safety. Exact algorithm names are case-sensitive. Verification is a historical decision; later evidence may differ.\n\nAllowed roles: admin, analyst.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Plan" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanState" } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/webhooks": { "get": { "operationId": "listWebhooks", "summary": "List tenant webhook endpoints", "description": "Allowed roles: admin.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Webhook" } }, "eventTypes": { "type": "array", "items": { "enum": [ "job.completed", "job.failed", "job.cancelled", "plan.verified", "evidence.archived" ] } } }, "required": [ "items", "eventTypes" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "operationId": "createWebhook", "summary": "Create a disabled signed webhook endpoint", "description": "Maximum 10 non-revoked endpoints. Public HTTPS port 443 only; credentials, query strings, fragments and literal IP addresses are rejected. The endpoint signing secret is returned only once. Test successfully before enabling.\n\nAllowed roles: admin.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/Webhook" }, { "type": "object", "properties": { "secret": { "type": "string" } }, "required": [ "secret" ] } ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "minLength": 2, "maxLength": 100 }, "url": { "type": "string", "format": "uri", "maxLength": 2048 }, "events": { "type": "array", "items": { "enum": [ "job.completed", "job.failed", "job.cancelled", "plan.verified", "evidence.archived" ] }, "minItems": 1, "maxItems": 5 } }, "required": [ "name", "url", "events" ] } } } } } }, "/api/v1/webhooks/{id}/test": { "post": { "operationId": "testWebhook", "summary": "Queue a signed test event", "description": "Allowed roles: admin.", "responses": { "202": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookDelivery" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "required": [] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/webhooks/{id}/state": { "post": { "operationId": "setWebhookState", "summary": "Enable or disable future webhook delivery", "description": "Enabling requires a successful test with the current key. Disabling cancels queued deliveries; in-flight requests may already have reached the receiver. Re-enabling starts with future events.\n\nAllowed roles: admin.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Webhook" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "enabled": { "type": "boolean" } }, "required": [ "enabled" ] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/webhooks/{id}/rotate": { "post": { "operationId": "rotateWebhookSecret", "summary": "Rotate an endpoint signing secret", "description": "Immediate rotation without overlap. Update the receiver and send another test. Existing pending deliveries use the new key on their next attempt.\n\nAllowed roles: admin.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "secret": { "type": "string" } }, "required": [ "secret" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "required": [] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/webhooks/{id}": { "delete": { "operationId": "revokeWebhook", "summary": "Permanently revoke a webhook endpoint", "description": "Allowed roles: admin.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Webhook" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/webhooks/{id}/deliveries": { "get": { "operationId": "webhookDeliveries", "summary": "Page through 30-day delivery history", "description": "Newest first, 100 per page. nextBefore is an opaque composite cursor that preserves timestamp ties.\n\nAllowed roles: admin.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookDelivery" } }, "nextBefore": { "type": [ "string", "null" ] } }, "required": [ "items", "nextBefore" ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "before", "in": "query", "schema": { "type": "string" } } ] } }, "/api/v1/webhooks/{id}/deliveries/{deliveryId}": { "get": { "operationId": "webhookDelivery", "summary": "Read delivery attempt history", "description": "Allowed roles: admin.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/WebhookDelivery" }, { "type": "object", "properties": { "history": { "type": "array", "items": { "type": "object" } } }, "required": [ "history" ] } ] } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "deliveryId", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/v1/webhooks/{id}/deliveries/{deliveryId}/retry": { "post": { "operationId": "retryWebhookDelivery", "summary": "Retry a terminal delivery with its original event ID", "description": "Failed or cancelled deliveries only. At most 64 total attempts. Each retry cycle allows eight attempts. Receivers must deduplicate stable webhook IDs and verify timestamps and HMAC signatures.\n\nAllowed roles: admin.", "responses": { "202": { "description": "Success", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookDelivery" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "required": [] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "deliveryId", "in": "path", "required": true, "schema": { "type": "string" } } ] } }, "/api/auth/bootstrap": { "post": { "operationId": "bootstrapOperator", "summary": "bootstrap Operator", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "username": { "type": "string" }, "name": { "type": "string" }, "email": { "type": "string", "format": "email" } }, "required": [ "username", "name" ] } } } }, "security": [ { "identityBootstrapSecret": [] } ] } }, "/api/auth/password/reset/request": { "post": { "operationId": "requestPasswordReset", "summary": "request Password Reset", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "email": { "type": "string", "format": "email", "maxLength": 254 } }, "required": [ "email" ] } } } }, "security": [] } }, "/api/auth/password/reset/confirm": { "post": { "operationId": "confirmPasswordReset", "summary": "confirm Password Reset", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "token": { "type": "string" }, "password": { "type": "string" } }, "required": [ "token", "password" ] } } } }, "security": [] } }, "/api/auth/email/verify": { "post": { "operationId": "verifyRecoveryEmail", "summary": "verify Recovery Email", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "token": { "type": "string" } }, "required": [ "token" ] } } } }, "security": [] } }, "/api/auth/email/request": { "post": { "operationId": "requestRecoveryEmail", "summary": "request Recovery Email", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "email": { "type": "string", "format": "email", "maxLength": 254 }, "currentPassword": { "type": "string" }, "code": { "type": "string" } }, "required": [ "email", "currentPassword", "code" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/activate": { "post": { "operationId": "activateAccount", "summary": "activate Account", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "token": { "type": "string" }, "password": { "type": "string" } }, "required": [ "token", "password" ] } } } }, "security": [] } }, "/api/auth/login": { "post": { "operationId": "passwordLogin", "summary": "password Login", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "tenant": { "type": "string" }, "username": { "type": "string", "description": "Username or unique verified email address. Email is normalized to lowercase and does not require a workspace; a supplied workspace must match the account." }, "password": { "type": "string" } }, "required": [ "username", "password" ] } } } }, "security": [] } }, "/api/auth/mfa/login": { "post": { "operationId": "verifyMfaLogin", "summary": "verify Mfa Login", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ticket": { "type": "string" }, "code": { "type": "string" } }, "required": [ "ticket", "code" ] } } } }, "security": [] } }, "/api/auth/passkey/login/options": { "post": { "operationId": "passkeyLoginOptions", "summary": "passkey Login Options", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "required": [] } } } }, "security": [] } }, "/api/auth/passkey/login/verify": { "post": { "operationId": "verifyPasskeyLogin", "summary": "verify Passkey Login", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "ticket": { "type": "string" }, "response": { "type": "object" } }, "required": [ "ticket", "response" ] } } } }, "security": [] } }, "/api/auth/logout": { "post": { "operationId": "logout", "summary": "logout", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "required": [] } } } }, "security": [] } }, "/api/auth/me": { "get": { "operationId": "currentAccount", "summary": "current Account", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/mfa/setup": { "post": { "operationId": "setupMfa", "summary": "setup Mfa", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "required": [] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/mfa/confirm": { "post": { "operationId": "confirmMfa", "summary": "confirm Mfa", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "code": { "type": "string" } }, "required": [ "code" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/passkey/register/options": { "post": { "operationId": "passkeyRegistrationOptions", "summary": "passkey Registration Options", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "required": [] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/passkey/register/verify": { "post": { "operationId": "verifyPasskeyRegistration", "summary": "verify Passkey Registration", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string" }, "response": { "type": "object" } }, "required": [ "name", "response" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/passkey/remove": { "post": { "operationId": "removePasskey", "summary": "remove Passkey", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "currentPassword": { "type": "string" }, "code": { "type": "string" } }, "required": [ "id", "currentPassword", "code" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/recovery/regenerate": { "post": { "operationId": "regenerateRecoveryCodes", "summary": "regenerate Recovery Codes", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "currentPassword": { "type": "string" }, "code": { "type": "string" } }, "required": [ "currentPassword", "code" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/password": { "post": { "operationId": "changePassword", "summary": "change Password", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "currentPassword": { "type": "string" }, "newPassword": { "type": "string" } }, "required": [ "currentPassword", "newPassword" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/sessions/revoke": { "post": { "operationId": "revokeAccountSessions", "summary": "revoke Account Sessions", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": {}, "required": [] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/sessions": { "get": { "operationId": "listAccountSessions", "summary": "list Account Sessions", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "required": [ "items", "nextCursor" ], "properties": { "items": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "createdAt": { "type": "integer" }, "lastActivityAt": { "type": "integer" }, "expiresAt": { "type": "integer", "description": "Effective expiry without further authenticated requests, bounded by the absolute session lifetime." }, "current": { "type": "boolean" } }, "required": [ "id", "createdAt", "lastActivityAt", "expiresAt", "current" ] } }, "nextCursor": { "type": [ "string", "null" ] } } } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "security": [ { "browserSession": [] } ], "parameters": [ { "name": "after", "in": "query", "schema": { "type": "string", "pattern": "^[0-9a-f]{32}$" } }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 100 } } ] } }, "/api/auth/sessions/end": { "post": { "operationId": "endAccountSession", "summary": "end Account Session", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^[0-9a-f]{32}$" } }, "required": [ "id" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/tenants": { "get": { "operationId": "listTenants", "summary": "list Tenants", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "required": [ "items", "nextCursor" ], "properties": { "items": { "type": "array", "items": { "type": "object" } }, "nextCursor": { "type": [ "string", "null" ], "format": "uuid" } } } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "security": [ { "browserSession": [] } ], "parameters": [ { "name": "after", "in": "query", "schema": { "type": "string", "format": "uuid" }, "description": "Exclusive ID cursor from the previous nextCursor; tenant scope is always taken from the authenticated account." }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 100 } } ] }, "post": { "operationId": "provisionTenant", "summary": "provision Tenant", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "slug": { "type": "string" }, "name": { "type": "string" }, "adminUsername": { "type": "string" }, "adminName": { "type": "string" }, "adminEmail": { "type": "string", "format": "email" } }, "required": [ "slug", "name", "adminUsername", "adminName" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/workspace-invitations": { "get": { "operationId": "listWorkspaceInvitations", "summary": "list Workspace Invitations", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred. Workspace-owner invitations are operator-only except preview and accept, which require the single-use email token in the JSON body. Creating an invitation uses a client-generated UUID id for idempotency. Repeating the same ID and details returns its saved state without sending another email. Resending invalidates the previous token. Acceptance reserves the chosen workspace details, initializes the tenant idempotently, consumes the invitation, and issues only a restricted MFA-setup session. Tokens expire after 24 hours. Accepted accounts must complete MFA before tenant access. Never place tokens in query strings.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "security": [ { "browserSession": [] } ], "parameters": [ { "name": "after", "in": "query", "schema": { "type": "string", "format": "uuid" } }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 50 } } ] }, "post": { "operationId": "inviteWorkspaceOwner", "summary": "invite Workspace Owner", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred. Workspace-owner invitations are operator-only except preview and accept, which require the single-use email token in the JSON body. Creating an invitation uses a client-generated UUID id for idempotency. Repeating the same ID and details returns its saved state without sending another email. Resending invalidates the previous token. Acceptance reserves the chosen workspace details, initializes the tenant idempotently, consumes the invitation, and issues only a restricted MFA-setup session. Tokens expire after 24 hours. Accepted accounts must complete MFA before tenant access. Never place tokens in query strings.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "email": { "type": "string", "format": "email" }, "name": { "type": "string" } }, "required": [ "id", "email", "name" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/workspace-invitations/resend": { "post": { "operationId": "resendWorkspaceInvitation", "summary": "resend Workspace Invitation", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred. Workspace-owner invitations are operator-only except preview and accept, which require the single-use email token in the JSON body. Creating an invitation uses a client-generated UUID id for idempotency. Repeating the same ID and details returns its saved state without sending another email. Resending invalidates the previous token. Acceptance reserves the chosen workspace details, initializes the tenant idempotently, consumes the invitation, and issues only a restricted MFA-setup session. Tokens expire after 24 hours. Accepted accounts must complete MFA before tenant access. Never place tokens in query strings.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" } }, "required": [ "id" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/workspace-invitations/revoke": { "post": { "operationId": "revokeWorkspaceInvitation", "summary": "revoke Workspace Invitation", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred. Workspace-owner invitations are operator-only except preview and accept, which require the single-use email token in the JSON body. Creating an invitation uses a client-generated UUID id for idempotency. Repeating the same ID and details returns its saved state without sending another email. Resending invalidates the previous token. Acceptance reserves the chosen workspace details, initializes the tenant idempotently, consumes the invitation, and issues only a restricted MFA-setup session. Tokens expire after 24 hours. Accepted accounts must complete MFA before tenant access. Never place tokens in query strings.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" } }, "required": [ "id" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/workspace-invitations/preview": { "post": { "operationId": "previewWorkspaceInvitation", "summary": "preview Workspace Invitation", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred. Workspace-owner invitations are operator-only except preview and accept, which require the single-use email token in the JSON body. Creating an invitation uses a client-generated UUID id for idempotency. Repeating the same ID and details returns its saved state without sending another email. Resending invalidates the previous token. Acceptance reserves the chosen workspace details, initializes the tenant idempotently, consumes the invitation, and issues only a restricted MFA-setup session. Tokens expire after 24 hours. Accepted accounts must complete MFA before tenant access. Never place tokens in query strings.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "token": { "type": "string" } }, "required": [ "token" ] } } } }, "security": [] } }, "/api/auth/workspace-invitations/accept": { "post": { "operationId": "acceptWorkspaceInvitation", "summary": "accept Workspace Invitation", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred. Workspace-owner invitations are operator-only except preview and accept, which require the single-use email token in the JSON body. Creating an invitation uses a client-generated UUID id for idempotency. Repeating the same ID and details returns its saved state without sending another email. Resending invalidates the previous token. Acceptance reserves the chosen workspace details, initializes the tenant idempotently, consumes the invitation, and issues only a restricted MFA-setup session. Tokens expire after 24 hours. Accepted accounts must complete MFA before tenant access. Never place tokens in query strings.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "token": { "type": "string" }, "name": { "type": "string" }, "slug": { "type": "string" }, "username": { "type": "string" }, "password": { "type": "string" } }, "required": [ "token", "name", "slug", "username", "password" ] } } } }, "security": [] } }, "/api/auth/tenants/status": { "post": { "operationId": "setTenantStatus", "summary": "set Tenant Status", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "status": { "enum": [ "active", "suspended" ] } }, "required": [ "id", "status" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/users": { "get": { "operationId": "listMembers", "summary": "list Members", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "required": [ "items", "nextCursor" ], "properties": { "items": { "type": "array", "items": { "type": "object" } }, "nextCursor": { "type": [ "string", "null" ], "format": "uuid" } } } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "security": [ { "browserSession": [] } ], "parameters": [ { "name": "after", "in": "query", "schema": { "type": "string", "format": "uuid" }, "description": "Exclusive ID cursor from the previous nextCursor; tenant scope is always taken from the authenticated account." }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 100 } } ] }, "post": { "operationId": "inviteMember", "summary": "invite Member", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "201": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "username": { "type": "string" }, "name": { "type": "string" }, "role": { "enum": [ "admin", "analyst", "viewer" ] }, "email": { "type": "string", "format": "email" } }, "required": [ "username", "name", "role" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/users/role": { "post": { "operationId": "setMemberRole", "summary": "set Member Role", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "role": { "enum": [ "admin", "analyst", "viewer" ] } }, "required": [ "id", "role" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/users/disable": { "post": { "operationId": "setMemberDisabled", "summary": "set Member Disabled", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "disabled": { "type": "boolean" } }, "required": [ "id", "disabled" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/users/reinvite": { "post": { "operationId": "reinvitePendingMember", "summary": "reinvite Pending Member", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" } }, "required": [ "id" ] } } } }, "security": [ { "browserSession": [] } ] } }, "/api/auth/audit": { "get": { "operationId": "identityAudit", "summary": "identity Audit", "description": "Canonical origin only. POST requires an exact Origin header and application/json. Browser sessions use an HttpOnly, Secure, SameSite=Strict cookie. Setup sessions cannot access tenant APIs. Tenant provisioning and global audit require a platform operator; member administration requires a tenant administrator. SSO is deferred.", "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "required": [ "items", "nextCursor" ], "properties": { "items": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "at": { "type": "string", "format": "date-time" }, "actor": { "type": "string" }, "action": { "type": "string" }, "resource": { "type": "string" } }, "required": [ "id", "at", "actor", "action", "resource" ] } }, "nextCursor": { "type": [ "string", "null" ] } } } } } }, "400": { "description": "Validation error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Missing/expired/revoked credential", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Insufficient role", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "State or idempotency conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Body too large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "415": { "description": "Unsupported media type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Request budget exhausted; respect Retry-After", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "headers": { "Retry-After": { "schema": { "type": "integer", "minimum": 1 }, "description": "Seconds until sufficient budget is expected; concurrent traffic may consume replenished capacity." } } }, "500": { "description": "Internal error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Not configured", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "security": [ { "browserSession": [] } ], "parameters": [ { "name": "before", "in": "query", "schema": { "type": "string", "maxLength": 61 }, "description": "Exclusive timestamp|UUID cursor from nextCursor. Events are ordered newest first by timestamp and ID." }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 100 } } ] } } }, "components": { "securitySchemes": { "browserSession": { "type": "apiKey", "in": "cookie", "name": "__Host-qr_session", "description": "Canonical qscan.dev browser session; POST requires same-origin Origin header." }, "identityBootstrapSecret": { "type": "http", "scheme": "bearer", "description": "One-time initial operator bootstrap; disabled after provisioning." }, "organizationCredential": { "type": "http", "scheme": "bearer", "bearerFormat": "qr..", "description": "Scoped organization API credential. Keep it out of source, URLs, and logs." }, "bootstrapSecret": { "type": "http", "scheme": "bearer", "description": "Deployment provisioning secret; this is not an organization credential. Provisioning is disabled when no bootstrap secret is configured." } }, "schemas": { "Error": { "type": "object", "properties": { "error": { "type": "string" }, "issues": { "type": "array", "items": { "type": "object" } } }, "required": [ "error" ] }, "AgentConfigurationInput": { "type": "object", "properties": { "expectedRevision": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "settings": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "pollSeconds": { "type": "integer", "minimum": 5, "maximum": 120 }, "allowedTargets": { "maxItems": 256, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 300, "pattern": "^[A-Za-z0-9.[\\]:-]+$" } }, "allowedSshTargets": { "maxItems": 256, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 300, "pattern": "^[A-Za-z0-9.[\\]:-]+$" } }, "repositoryRoots": { "maxItems": 256, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 4096 } }, "captureRoots": { "maxItems": 256, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 4096 } } }, "required": [ "enabled", "pollSeconds", "allowedTargets", "allowedSshTargets", "repositoryRoots" ], "additionalProperties": false } }, "required": [ "expectedRevision", "settings" ], "additionalProperties": false }, "AgentConfigurationStatus": { "type": "object", "properties": { "revision": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "status": { "type": "string", "enum": [ "applied", "rejected" ] }, "reason": { "type": "string", "enum": [ "none", "local-opt-in-required", "outside-local-scope", "invalid-configuration" ] } }, "required": [ "revision", "status", "reason" ], "additionalProperties": false }, "ManagedSettings": { "type": "object", "properties": { "enabled": { "type": "boolean" }, "pollSeconds": { "type": "integer", "minimum": 5, "maximum": 120 }, "allowedTargets": { "maxItems": 256, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 300, "pattern": "^[A-Za-z0-9.[\\]:-]+$" } }, "allowedSshTargets": { "maxItems": 256, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 300, "pattern": "^[A-Za-z0-9.[\\]:-]+$" } }, "repositoryRoots": { "maxItems": 256, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 4096 } }, "captureRoots": { "maxItems": 256, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 4096 } } }, "required": [ "enabled", "pollSeconds", "allowedTargets", "allowedSshTargets", "repositoryRoots" ], "additionalProperties": false }, "PlanInput": { "type": "object", "properties": { "title": { "type": "string", "minLength": 1, "maxLength": 200 }, "assetId": { "type": "string", "minLength": 1, "maxLength": 100 }, "owner": { "type": "string", "minLength": 1, "maxLength": 100 }, "dueDate": { "type": "string", "format": "date", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$" }, "status": { "default": "planned", "type": "string", "const": "planned" }, "criteria": { "type": "object", "properties": { "algorithm": { "type": "string", "minLength": 1, "maxLength": 100 }, "keyEstablishment": { "type": "string", "minLength": 1, "maxLength": 100 }, "authentication": { "type": "string", "minLength": 1, "maxLength": 100 }, "minimumConfidence": { "default": 0.9, "type": "number", "minimum": 0.8, "maximum": 1 } }, "additionalProperties": false } }, "required": [ "title", "assetId", "owner", "dueDate" ], "additionalProperties": false }, "PlanUpdate": { "type": "object", "properties": { "expectedVersion": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "title": { "type": "string", "minLength": 1, "maxLength": 200 }, "owner": { "type": "string", "minLength": 1, "maxLength": 100 }, "dueDate": { "type": "string", "format": "date", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$" }, "criteria": { "type": "object", "properties": { "algorithm": { "type": "string", "minLength": 1, "maxLength": 100 }, "keyEstablishment": { "type": "string", "minLength": 1, "maxLength": 100 }, "authentication": { "type": "string", "minLength": 1, "maxLength": 100 }, "minimumConfidence": { "default": 0.9, "type": "number", "minimum": 0.8, "maximum": 1 } }, "additionalProperties": false } }, "required": [ "expectedVersion" ], "additionalProperties": false }, "PlanState": { "type": "object", "properties": { "expectedVersion": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "status": { "type": "string", "enum": [ "planned", "in-progress", "verified" ] }, "reason": { "type": "string", "minLength": 1, "maxLength": 1000 }, "evidenceId": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" } }, "required": [ "expectedVersion", "status", "reason" ], "additionalProperties": false }, "Observation": { "type": "object", "properties": { "externalId": { "type": "string", "minLength": 1, "maxLength": 300 }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "kind": { "type": "string", "enum": [ "tls", "ssh", "code", "certificate", "library", "key", "cloud", "runtime" ] }, "algorithm": { "default": "unknown", "type": "string", "maxLength": 100 }, "keyEstablishment": { "default": "unknown", "type": "string", "maxLength": 100 }, "authentication": { "default": "unknown", "type": "string", "maxLength": 100 }, "source": { "type": "string", "minLength": 1, "maxLength": 300 }, "observedAt": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$" }, "confidence": { "type": "number", "minimum": 0, "maximum": 1 }, "exposure": { "default": "internal", "type": "string", "enum": [ "public", "partner", "internal", "isolated" ] }, "criticality": { "default": 3, "type": "integer", "minimum": 1, "maximum": 5 }, "retentionYears": { "default": 0, "type": "number", "minimum": 0, "maximum": 100 }, "migrationFriction": { "default": 3, "type": "integer", "minimum": 1, "maximum": 5 }, "dependencyCount": { "default": 0, "type": "integer", "minimum": 0, "maximum": 100000 }, "dependencies": { "default": [], "maxItems": 100, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 300 } }, "deadline": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$" }, "location": { "type": "string", "maxLength": 1000 }, "owner": { "default": "Unassigned", "type": "string", "maxLength": 200 }, "evidence": { "default": {}, "type": "object", "propertyNames": { "type": "string", "maxLength": 100 }, "additionalProperties": { "anyOf": [ { "type": "string", "maxLength": 2000 }, { "type": "number" }, { "type": "boolean" }, { "type": "null" } ] } } }, "required": [ "externalId", "name", "kind", "source", "observedAt", "confidence" ], "additionalProperties": false }, "ObservationBatch": { "type": "object", "properties": { "observations": { "minItems": 1, "maxItems": 200, "type": "array", "items": { "type": "object", "properties": { "externalId": { "type": "string", "minLength": 1, "maxLength": 300 }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "kind": { "type": "string", "enum": [ "tls", "ssh", "code", "certificate", "library", "key", "cloud", "runtime" ] }, "algorithm": { "default": "unknown", "type": "string", "maxLength": 100 }, "keyEstablishment": { "default": "unknown", "type": "string", "maxLength": 100 }, "authentication": { "default": "unknown", "type": "string", "maxLength": 100 }, "source": { "type": "string", "minLength": 1, "maxLength": 300 }, "observedAt": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$" }, "confidence": { "type": "number", "minimum": 0, "maximum": 1 }, "exposure": { "default": "internal", "type": "string", "enum": [ "public", "partner", "internal", "isolated" ] }, "criticality": { "default": 3, "type": "integer", "minimum": 1, "maximum": 5 }, "retentionYears": { "default": 0, "type": "number", "minimum": 0, "maximum": 100 }, "migrationFriction": { "default": 3, "type": "integer", "minimum": 1, "maximum": 5 }, "dependencyCount": { "default": 0, "type": "integer", "minimum": 0, "maximum": 100000 }, "dependencies": { "default": [], "maxItems": 100, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 300 } }, "deadline": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$" }, "location": { "type": "string", "maxLength": 1000 }, "owner": { "default": "Unassigned", "type": "string", "maxLength": 200 }, "evidence": { "default": {}, "type": "object", "propertyNames": { "type": "string", "maxLength": 100 }, "additionalProperties": { "anyOf": [ { "type": "string", "maxLength": 2000 }, { "type": "number" }, { "type": "boolean" }, { "type": "null" } ] } } }, "required": [ "externalId", "name", "kind", "source", "observedAt", "confidence" ], "additionalProperties": false } }, "idempotencyKey": { "type": "string", "minLength": 8, "maxLength": 100 }, "jobId": { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" }, "leaseToken": { "type": "string", "minLength": 1, "maxLength": 100 } }, "required": [ "observations", "idempotencyKey" ], "additionalProperties": false, "dependentRequired": { "jobId": [ "leaseToken" ], "leaseToken": [ "jobId" ] } }, "JobInput": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "kind": { "type": "string", "enum": [ "tls", "code", "ssh", "capture" ] }, "target": { "type": "string", "minLength": 1, "maxLength": 300 }, "agentId": { "type": "string", "minLength": 1, "maxLength": 300 } }, "required": [ "name", "kind", "target", "agentId" ], "additionalProperties": false }, "ScheduleInput": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "kind": { "type": "string", "enum": [ "tls", "code", "ssh", "capture" ] }, "target": { "type": "string", "minLength": 1, "maxLength": 300 }, "agentId": { "type": "string", "minLength": 1, "maxLength": 300 }, "intervalSeconds": { "type": "integer", "minimum": 300, "maximum": 2592000 }, "firstRunAt": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$" } }, "required": [ "name", "kind", "target", "agentId", "intervalSeconds" ], "additionalProperties": false }, "Organization": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "createdAt": { "type": "string", "format": "date-time" } }, "required": [ "id", "name", "createdAt" ] }, "Credential": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "role": { "enum": [ "admin", "analyst", "viewer", "agent", "ingestor" ] }, "agentId": { "type": "string", "format": "uuid" }, "createdAt": { "type": "string", "format": "date-time" }, "expiresAt": { "type": "string", "format": "date-time" }, "revoked": { "type": "boolean" } }, "required": [ "id", "name", "role", "createdAt", "expiresAt" ] }, "IssuedCredential": { "allOf": [ { "$ref": "#/components/schemas/Credential" }, { "type": "object", "properties": { "token": { "type": "string" } }, "required": [ "token" ] } ] }, "Agent": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "capabilities": { "type": "array", "items": { "enum": [ "tls", "code", "ssh", "capture" ] } }, "createdAt": { "type": "string", "format": "date-time" }, "lastSeen": { "type": [ "string", "null" ], "format": "date-time" }, "credentialId": { "type": "string", "format": "uuid" }, "revokedAt": { "type": "string", "format": "date-time" }, "configuration": { "type": [ "object", "null" ], "properties": { "revision": { "type": "integer" }, "settings": { "$ref": "#/components/schemas/ManagedSettings" }, "updatedAt": { "type": "string", "format": "date-time" }, "updatedBy": { "type": "string" } } }, "configurationStatus": { "type": [ "object", "null" ], "properties": { "revision": { "type": "integer" }, "status": { "enum": [ "applied", "rejected" ] }, "reason": { "type": "string" }, "reportedAt": { "type": "string", "format": "date-time" } } }, "runtime": { "type": "object", "properties": { "scannerVersion": { "type": "string" }, "pythonVersion": { "type": "string" }, "reportedAt": { "type": "string", "format": "date-time" } }, "required": [ "reportedAt" ] } }, "required": [ "id", "name", "capabilities", "createdAt", "credentialId" ] }, "Risk": { "type": "object", "properties": { "policyVersion": { "type": "string" }, "score": { "type": "integer", "minimum": 0, "maximum": 100 }, "severity": { "enum": [ "critical", "high", "medium", "low" ] }, "keyEstablishment": { "type": "string" }, "authentication": { "type": "string" }, "confidence": { "type": "number", "minimum": 0, "maximum": 1 }, "verificationPriority": { "type": "integer" }, "dimensions": { "type": "object", "additionalProperties": { "type": "number" } }, "action": { "type": "string" } }, "required": [ "policyVersion", "score", "severity", "keyEstablishment", "authentication", "confidence", "dimensions" ] }, "RiskRun": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "policyVersion": { "type": "string" }, "status": { "enum": [ "pending", "running", "completed", "paused", "superseded" ] }, "requestedBy": { "type": "string" }, "requestedAt": { "type": "string", "format": "date-time" }, "initialTotal": { "type": "integer" }, "processed": { "type": "integer" }, "updatedAt": { "type": "string", "format": "date-time" }, "finishedAt": { "type": "string", "format": "date-time" }, "pausedAt": { "type": "string", "format": "date-time" } }, "required": [ "id", "policyVersion", "status", "requestedBy", "requestedAt", "initialTotal", "processed" ] }, "RiskRevision": { "type": "object", "properties": { "id": { "type": "string" }, "runId": { "type": "string", "format": "uuid" }, "assetId": { "type": "string" }, "evidenceId": { "type": [ "string", "null" ] }, "previousRisk": { "anyOf": [ { "$ref": "#/components/schemas/Risk" }, { "type": "null" } ] }, "risk": { "$ref": "#/components/schemas/Risk" }, "assessedAt": { "type": "string", "format": "date-time" } }, "required": [ "id", "runId", "assetId", "evidenceId", "previousRisk", "risk", "assessedAt" ] }, "Asset": { "allOf": [ { "type": "object", "properties": { "externalId": { "type": "string", "minLength": 1, "maxLength": 300 }, "name": { "type": "string", "minLength": 1, "maxLength": 300 }, "kind": { "type": "string", "enum": [ "tls", "ssh", "code", "certificate", "library", "key", "cloud", "runtime" ] }, "algorithm": { "default": "unknown", "type": "string", "maxLength": 100 }, "keyEstablishment": { "default": "unknown", "type": "string", "maxLength": 100 }, "authentication": { "default": "unknown", "type": "string", "maxLength": 100 }, "source": { "type": "string", "minLength": 1, "maxLength": 300 }, "observedAt": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$" }, "confidence": { "type": "number", "minimum": 0, "maximum": 1 }, "exposure": { "default": "internal", "type": "string", "enum": [ "public", "partner", "internal", "isolated" ] }, "criticality": { "default": 3, "type": "integer", "minimum": 1, "maximum": 5 }, "retentionYears": { "default": 0, "type": "number", "minimum": 0, "maximum": 100 }, "migrationFriction": { "default": 3, "type": "integer", "minimum": 1, "maximum": 5 }, "dependencyCount": { "default": 0, "type": "integer", "minimum": 0, "maximum": 100000 }, "dependencies": { "default": [], "maxItems": 100, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 300 } }, "deadline": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$" }, "location": { "type": "string", "maxLength": 1000 }, "owner": { "default": "Unassigned", "type": "string", "maxLength": 200 }, "evidence": { "default": {}, "type": "object", "propertyNames": { "type": "string", "maxLength": 100 }, "additionalProperties": { "anyOf": [ { "type": "string", "maxLength": 2000 }, { "type": "number" }, { "type": "boolean" }, { "type": "null" } ] } } }, "required": [ "externalId", "name", "kind", "source", "observedAt", "confidence" ], "additionalProperties": true }, { "type": "object", "properties": { "id": { "type": "string" }, "firstSeen": { "type": "string", "format": "date-time" }, "lastSeen": { "type": "string", "format": "date-time" }, "evidenceId": { "type": "string", "format": "uuid" }, "risk": { "$ref": "#/components/schemas/Risk" } }, "required": [ "id", "firstSeen", "lastSeen", "evidenceId", "risk" ] } ] }, "ArchiveReceipt": { "type": "object", "properties": { "state": { "enum": [ "unarchived", "pending", "retrying", "archived" ] }, "sha256": { "type": "string" }, "byteLength": { "type": "integer" }, "archivedAt": { "type": "string", "format": "date-time" }, "queuedAt": { "type": "string", "format": "date-time" }, "attempts": { "type": "integer" }, "lastError": { "type": "string" }, "lastAttemptAt": { "type": "string", "format": "date-time" } }, "required": [ "state" ] }, "Artifact": { "type": "object", "properties": { "schema": { "const": "sectigo.evidence.v1" }, "canonicalization": { "const": "qr-json-1" }, "tenantId": { "type": "string", "format": "uuid" }, "evidence": { "$ref": "#/components/schemas/Evidence" } }, "required": [ "schema", "canonicalization", "tenantId", "evidence" ] }, "ArchiveStatus": { "type": "object", "properties": { "total": { "type": "integer" }, "archived": { "type": "integer" }, "pending": { "type": "integer" }, "retrying": { "type": "integer" }, "unarchived": { "type": "integer" } }, "required": [ "total", "archived", "pending", "retrying", "unarchived" ] }, "Evidence": { "type": "object", "properties": { "archive": { "$ref": "#/components/schemas/ArchiveReceipt" }, "id": { "type": "string", "format": "uuid" }, "assetId": { "type": "string" }, "submittedBy": { "type": "string", "format": "uuid" }, "agentId": { "type": "string", "format": "uuid" }, "jobId": { "type": "string", "format": "uuid" }, "attempt": { "type": "integer" }, "receivedAt": { "type": "string", "format": "date-time" }, "observation": { "$ref": "#/components/schemas/Observation" } }, "required": [ "id", "assetId", "submittedBy", "receivedAt", "observation" ] }, "Job": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "kind": { "enum": [ "tls", "code", "ssh", "capture" ] }, "target": { "type": "string" }, "agentId": { "type": "string", "format": "uuid" }, "status": { "enum": [ "queued", "running", "completed", "failed", "cancelled" ] }, "createdAt": { "type": "string", "format": "date-time" }, "createdBy": { "type": "string", "format": "uuid" }, "attempts": { "type": "integer" }, "observationsAccepted": { "type": "integer" }, "observations": { "type": "integer" }, "leaseExpiresAt": { "type": "string", "format": "date-time" }, "scheduleId": { "type": "string", "format": "uuid" }, "scheduledFor": { "type": "string", "format": "date-time" }, "orchestration": { "type": "object", "properties": { "state": { "enum": [ "pending", "monitoring", "finished" ] }, "workflowId": { "type": "string" }, "lastCheckedAt": { "type": "string", "format": "date-time" } }, "required": [] }, "error": { "type": "string" }, "cancellationReason": { "type": "string" } }, "required": [ "id", "name", "kind", "target", "agentId", "status", "createdAt", "attempts" ] }, "LeasedJob": { "allOf": [ { "$ref": "#/components/schemas/Job" }, { "type": "object", "properties": { "leaseToken": { "type": "string" }, "leaseExpiresAt": { "type": "string", "format": "date-time" }, "protocolVersion": { "const": 2 } }, "required": [ "leaseToken", "leaseExpiresAt", "protocolVersion" ] } ] }, "Schedule": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "kind": { "enum": [ "tls", "code", "ssh", "capture" ] }, "target": { "type": "string" }, "agentId": { "type": "string", "format": "uuid" }, "intervalSeconds": { "type": "integer", "minimum": 300, "maximum": 2592000 }, "firstRunAt": { "type": "string", "format": "date-time" }, "nextRunAt": { "type": "string", "format": "date-time" }, "enabled": { "type": "boolean" }, "authorizedBy": { "type": "string", "format": "uuid" }, "authorizedUserId": { "type": "string", "format": "uuid" }, "createdAt": { "type": "string", "format": "date-time" }, "updatedAt": { "type": "string", "format": "date-time" }, "lastJobId": { "type": "string", "format": "uuid" }, "lastRunAt": { "type": "string", "format": "date-time" }, "lastEvaluatedAt": { "type": "string", "format": "date-time" }, "pauseReason": { "type": "string" }, "skippedRuns": { "type": "integer" } }, "required": [ "id", "name", "kind", "target", "agentId", "intervalSeconds", "nextRunAt", "enabled", "authorizedBy", "createdAt", "skippedRuns" ] }, "AuditEvent": { "type": "object", "properties": { "id": { "type": "string" }, "actor": { "type": "string" }, "action": { "type": "string" }, "resource": { "type": "string" }, "at": { "type": "string", "format": "date-time" } }, "required": [ "id", "actor", "action", "resource", "at" ] }, "Plan": { "type": "object", "properties": { "version": { "type": "integer" }, "criteria": { "type": "object" }, "verification": { "type": "object" }, "startedAt": { "type": "string", "format": "date-time" }, "updatedAt": { "type": "string", "format": "date-time" }, "lastReason": { "type": "string" }, "id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "assetId": { "type": "string" }, "owner": { "type": "string" }, "dueDate": { "type": "string", "format": "date" }, "status": { "enum": [ "planned", "in-progress", "verified" ] }, "createdAt": { "type": "string", "format": "date-time" } }, "required": [ "id", "title", "assetId", "owner", "dueDate", "status" ] }, "AssetPage": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Asset" } }, "nextCursor": { "type": [ "string", "null" ] }, "total": { "type": "integer" } }, "required": [ "items", "nextCursor", "total" ] }, "Receipt": { "type": "object", "properties": { "accepted": { "type": "integer" }, "assetIds": { "type": "array", "items": { "type": "string" } }, "fingerprint": { "type": "string" }, "at": { "type": "string", "format": "date-time" }, "replayed": { "type": "boolean" } }, "required": [ "accepted", "assetIds", "fingerprint", "at" ] }, "Me": { "type": "object", "properties": { "organization": { "$ref": "#/components/schemas/Organization" }, "identity": { "type": "object", "properties": { "name": { "type": "string" }, "role": { "type": "string" }, "agentId": { "type": "string", "format": "uuid" } }, "required": [ "name", "role" ] }, "capabilities": { "type": "object", "additionalProperties": { "type": "boolean" } } }, "required": [ "organization", "identity", "capabilities" ] }, "Overview": { "type": "object", "properties": { "assets": { "type": "integer" }, "evidence": { "type": "integer" }, "agents": { "type": "integer" }, "jobs": { "type": "integer" }, "averageRisk": { "type": [ "integer", "null" ], "minimum": 0, "maximum": 100 }, "assessedAssets": { "type": "integer" }, "surfaces": { "type": "array", "items": { "type": "object", "properties": { "surface": { "type": "string" }, "n": { "type": "integer" } }, "required": [ "surface", "n" ] } }, "topAssets": { "type": "array", "maxItems": 5, "items": { "$ref": "#/components/schemas/Asset" } }, "risk": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string" }, "n": { "type": "integer" } }, "required": [ "severity", "n" ] } }, "policyVersion": { "type": "string" } }, "required": [ "assets", "evidence", "agents", "jobs", "risk", "policyVersion", "averageRisk", "assessedAssets", "surfaces", "topAssets" ] }, "Cbom": { "type": "object", "properties": { "bomFormat": { "const": "CycloneDX" }, "specVersion": { "const": "1.7" }, "serialNumber": { "type": "string" }, "version": { "type": "integer" }, "metadata": { "type": "object" }, "components": { "type": "array", "items": { "type": "object" } }, "dependencies": { "type": "array", "items": { "type": "object" } } }, "required": [ "bomFormat", "specVersion", "serialNumber", "version", "metadata", "components", "dependencies" ] }, "Webhook": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "url": { "type": "string", "format": "uri" }, "events": { "type": "array", "items": { "enum": [ "job.completed", "job.failed", "job.cancelled", "plan.verified", "evidence.archived" ] } }, "enabled": { "type": "boolean" }, "createdAt": { "type": "string", "format": "date-time" }, "testedAt": { "type": "string", "format": "date-time" }, "revokedAt": { "type": "string", "format": "date-time" }, "secretVersion": { "type": "integer" } }, "required": [ "id", "name", "url", "events", "enabled", "createdAt" ] }, "WebhookDelivery": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "webhookId": { "type": "string", "format": "uuid" }, "eventId": { "type": "string", "format": "uuid" }, "eventType": { "enum": [ "job.completed", "job.failed", "job.cancelled", "plan.verified", "evidence.archived", "webhook.test" ] }, "resourceId": { "type": "string" }, "state": { "enum": [ "pending", "sending", "retrying", "delivered", "failed", "cancelled" ] }, "attempts": { "type": "integer" }, "cycleAttempts": { "type": "integer" }, "createdAt": { "type": "string", "format": "date-time" }, "nextAttemptAt": { "type": "string", "format": "date-time" }, "finishedAt": { "type": "string", "format": "date-time" }, "lastError": { "type": "string" }, "statusCode": { "type": "integer" } }, "required": [ "id", "webhookId", "eventId", "eventType", "resourceId", "state", "attempts", "createdAt" ] } } } }