{"openapi":"3.1.1","jsonSchemaDialect":"https://json-schema.org/draft/2020-12/schema","info":{"title":"Mutual Trust API","version":"1.0.0-early-access","description":"Partner workload access with private client certificates. Errors are RFC 9457 problem details whose `code` comes from the error catalogue. Every response carries X-Request-Id and a W3C traceparent."},"servers":[{"url":"https://api.mutualtrust.io"}],"tags":[{"name":"Identity","description":"Signed-in principal and overview."},{"name":"Organizations","description":"Members, roles, workload issuers, support and export grants, API credentials."},{"name":"Spaces","description":"Trust spaces with private trust anchors."},{"name":"Services","description":"APIs protected by Mutual Trust, receipts and invitations."},{"name":"Invitations","description":"Partner invitations (one-time secrets)."},{"name":"Grants","description":"Scoped, revisioned access grants and change operations."},{"name":"Enrollment","description":"Workload attestation, CSR + proof of possession, issuance."},{"name":"Certificates","description":"Renewal by key continuity, reload confirmation, revocation, chains."},{"name":"Gateways","description":"Pairing, signed manifests, acknowledgments and receipts."},{"name":"Integrations","description":"Integration adapters: catalog, registration, desired state, plans, approvals, runs and evidence."},{"name":"Migrations","description":"Connection workspaces: discovery evidence, assessments, immutable plans, bound approvals, durable executions, delegated tasks and handover reports."},{"name":"Billing","description":"Capacity bands through Stripe."},{"name":"Platform","description":"Health, OpenAPI, CRLs, webhooks and adoption instrumentation."}],"paths":{"/v1/me":{"get":{"tags":["Identity"],"summary":"Current principal, memberships and CSRF token","operationId":"getVMe","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Current principal, memberships and CSRF token","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Me"},"example":{"user_id":"usr_01jq3v8m2k9x4h7c5n6p0r1s2t","display_name":"Guest","auth_method":"sandbox_guest","csrf_token":"k3J9...","memberships":[{"tenant_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","role":"owner"}],"environment_notice":"Sandbox guest: production actions are unavailable."}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/me/passkeys":{"get":{"tags":["Identity"],"summary":"Passkeys on the signed-in account","operationId":"getVMePasskeys","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]}],"responses":{"200":{"description":"Passkeys on the signed-in account","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasskeyList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"},"post":{"tags":["Identity"],"summary":"Register a passkey (attestation response)","operationId":"postVMePasskeys","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddPasskey"}}}},"responses":{"201":{"description":"Register a passkey (attestation response)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Passkey"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/me/passkeys/options":{"post":{"tags":["Identity"],"summary":"WebAuthn creation options for adding a passkey","operationId":"postVMePasskeysOptions","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"200":{"description":"WebAuthn creation options for adding a passkey","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasskeyCreationOptions"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/me/passkeys/{id}":{"delete":{"tags":["Identity"],"summary":"Remove a passkey (never the last one of a passkey-only account)","operationId":"deleteVMePasskeysId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"200":{"description":"Remove a passkey (never the last one of a passkey-only account)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PasskeyRemoved"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/me/recovery-codes":{"get":{"tags":["Identity"],"summary":"Recovery code status for the signed-in passkey account","operationId":"getVMeRecoveryCodes","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]}],"responses":{"200":{"description":"Recovery code status for the signed-in passkey account","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecoveryCodeStatus"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"},"post":{"tags":["Identity"],"summary":"Generate ten new recovery codes (shown once; earlier unused codes stop working)","operationId":"postVMeRecoveryCodes","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"201":{"description":"Generate ten new recovery codes (shown once; earlier unused codes stop working)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecoveryCodesCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/me/step-up/options":{"post":{"tags":["Identity"],"summary":"WebAuthn request options to re-authenticate the signed-in passkey account (step-up)","operationId":"postVMeStepUpOptions","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"200":{"description":"WebAuthn request options to re-authenticate the signed-in passkey account (step-up)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StepUpOptions"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/me/step-up":{"post":{"tags":["Identity"],"summary":"Re-authenticate with a passkey assertion; sensitive approvals accept it for 15 minutes","operationId":"postVMeStepUp","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StepUp"}}}},"responses":{"200":{"description":"Re-authenticate with a passkey assertion; sensitive approvals accept it for 15 minutes","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StepUpCompleted"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/overview":{"get":{"tags":["Identity"],"summary":"Organizations, spaces, services, relationships and alerts for the caller","operationId":"getVOverview","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Organizations, spaces, services, relationships and alerts for the caller","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Overview"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/sandbox/try-orders-api":{"post":{"tags":["Identity"],"summary":"Create the sample Northstar/Harbor sandbox with the Orders API","operationId":"postVSandboxTryOrdersApi","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"201":{"description":"Create the sample Northstar/Harbor sandbox with the Orders API","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SandboxBootstrap"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations":{"post":{"tags":["Organizations"],"summary":"Create an organization (caller becomes first owner)","operationId":"postVOrganizations","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateOrganization"}}}},"responses":{"201":{"description":"Create an organization (caller becomes first owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationCreated"},"example":{"id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","name":"Northstar","kind":"customer"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/members":{"get":{"tags":["Organizations"],"summary":"List members and roles","operationId":"getVOrganizationsIdMembers","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"List members and roles","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/roles":{"post":{"tags":["Organizations"],"summary":"Assign a role to a member (owner)","operationId":"postVOrganizationsIdRoles","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssignRole"}}}},"responses":{"200":{"description":"Assign a role to a member (owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RoleAssigned"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/members/{uid}":{"delete":{"tags":["Organizations"],"summary":"Remove a member and revoke the API credentials they created (owner; never the last owner)","operationId":"deleteVOrganizationsIdMembersUid","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"uid","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Remove a member and revoke the API credentials they created (owner; never the last owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MemberRemoved"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/members/{uid}/roles/{role}":{"delete":{"tags":["Organizations"],"summary":"Remove one role from a member (owner; never the last owner role)","operationId":"deleteVOrganizationsIdMembersUidRolesRole","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"uid","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"role","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Remove one role from a member (owner; never the last owner role)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RoleRemoved"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/partner-handle":{"get":{"tags":["Organizations"],"summary":"The partner handle API owners use to invite this organization","operationId":"getVOrganizationsIdPartnerHandle","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"The partner handle API owners use to invite this organization","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PartnerHandle"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/partner-handle/rotate":{"post":{"tags":["Organizations"],"summary":"Replace the partner handle (owner); the old handle stops resolving","operationId":"postVOrganizationsIdPartnerHandleRotate","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Replace the partner handle (owner); the old handle stops resolving","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PartnerHandle"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/partner-handles/{handle}":{"get":{"tags":["Organizations"],"summary":"Resolve a partner handle to the organization display name (rate limited)","operationId":"getVPartnerHandlesHandle","parameters":[{"name":"handle","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Resolve a partner handle to the organization display name (rate limited)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PartnerHandleLookup"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/workload-issuers":{"get":{"tags":["Organizations"],"summary":"List approved workload OIDC issuers","operationId":"getVOrganizationsIdWorkloadIssuers","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"List approved workload OIDC issuers","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkloadIssuerList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Organizations"],"summary":"Approve a workload OIDC issuer","operationId":"postVOrganizationsIdWorkloadIssuers","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApproveWorkloadIssuer"}}}},"responses":{"201":{"description":"Approve a workload OIDC issuer","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkloadIssuer"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/audit":{"get":{"tags":["Organizations"],"summary":"Audit log, newest first (paged with ?before=)","operationId":"getVOrganizationsIdAudit","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"before","in":"query","required":false,"description":"next_cursor from the previous page.","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Audit log, newest first (paged with ?before=)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditEventPage"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/support-grants":{"get":{"tags":["Organizations"],"summary":"List staff support access grants (owner)","operationId":"getVOrganizationsIdSupportGrants","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"List staff support access grants (owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SupportGrantList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Organizations"],"summary":"Approve reason-coded, expiring staff support access (owner)","operationId":"postVOrganizationsIdSupportGrants","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSupportGrant"}}}},"responses":{"201":{"description":"Approve reason-coded, expiring staff support access (owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SupportGrantCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/support-grants/{gid}/revoke":{"post":{"tags":["Organizations"],"summary":"Revoke staff support access (owner)","operationId":"postVOrganizationsIdSupportGrantsGidRevoke","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"gid","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Revoke staff support access (owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SupportGrantRevoked"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/export-grants":{"get":{"tags":["Organizations"],"summary":"List audit export rights (owner)","operationId":"getVOrganizationsIdExportGrants","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"List audit export rights (owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportGrantList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Organizations"],"summary":"Assign audit export rights (owner)","operationId":"postVOrganizationsIdExportGrants","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateExportGrant"}}}},"responses":{"201":{"description":"Assign audit export rights (owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportGrantCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/export-grants/{gid}/revoke":{"post":{"tags":["Organizations"],"summary":"Revoke audit export rights (owner)","operationId":"postVOrganizationsIdExportGrantsGidRevoke","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"gid","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Revoke audit export rights (owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportGrantRevoked"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/audit-export":{"get":{"tags":["Organizations"],"summary":"Download the audit log (requires export rights)","operationId":"getVOrganizationsIdAuditExport","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"from","in":"query","required":false,"description":"Inclusive RFC 3339 lower bound.","schema":{"type":"string"}},{"name":"to","in":"query","required":false,"description":"Exclusive RFC 3339 upper bound.","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Download the audit log (requires export rights)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}},"x-content-sha256":{"description":"SHA-256 (hex) of the exact body.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditExport"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/api-credentials":{"get":{"tags":["Organizations"],"summary":"List API credentials (owners see all, others their own)","operationId":"getVOrganizationsIdApiCredentials","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"List API credentials (owners see all, others their own)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiCredentialList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Organizations"],"summary":"Create a scoped API credential (session only; secret shown once)","operationId":"postVOrganizationsIdApiCredentials","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateApiCredential"}}}},"responses":{"201":{"description":"Create a scoped API credential (session only; secret shown once)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiCredentialCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/organizations/{id}/api-credentials/{cid}/revoke":{"post":{"tags":["Organizations"],"summary":"Revoke an API credential","operationId":"postVOrganizationsIdApiCredentialsCidRevoke","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"cid","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Revoke an API credential","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiCredentialRevoked"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/mcp/authorizations":{"post":{"tags":["Organizations"],"summary":"Approve an MCP client connection (portal consent)","operationId":"postVMcpAuthorizations","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthorizeMcp"}}}},"responses":{"201":{"description":"Approve an MCP client connection (portal consent)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/McpAuthorization"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/organizations/{id}/production-requests":{"get":{"tags":["Organizations"],"summary":"Production access requests for the organization","operationId":"getVOrganizationsIdProductionRequests","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Production access requests for the organization","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProductionAccessRequestList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Organizations"],"summary":"Request production access (idempotent while a request is open)","operationId":"postVOrganizationsIdProductionRequests","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RequestProductionAccess"}}}},"responses":{"201":{"description":"Request production access (idempotent while a request is open)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProductionAccessRequest"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/production-readiness":{"get":{"tags":["Organizations"],"summary":"What the organization needs before production: verified domain, approved access, entitlement (and legal entity when requested)","operationId":"getVOrganizationsIdProductionReadiness","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"What the organization needs before production: verified domain, approved access, entitlement (and legal entity when requested)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProductionReadiness"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/domains":{"get":{"tags":["Organizations"],"summary":"Domains and their domain control verification","operationId":"getVOrganizationsIdDomains","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Domains and their domain control verification","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Organizations"],"summary":"Add a domain to verify (publish the returned TXT record at _mutualtrust-challenge.<domain>)","operationId":"postVOrganizationsIdDomains","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddDomain"},"example":{"domain":"example.com"}}}},"responses":{"201":{"description":"Add a domain to verify (publish the returned TXT record at _mutualtrust-challenge.<domain>)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Domain"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/domains/{did}/check":{"post":{"tags":["Organizations"],"summary":"Check the domain TXT record now (two DNS-over-HTTPS resolvers must agree)","operationId":"postVOrganizationsIdDomainsDidCheck","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"did","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Check the domain TXT record now (two DNS-over-HTTPS resolvers must agree)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Domain"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/domains/{did}":{"delete":{"tags":["Organizations"],"summary":"Remove a domain","operationId":"deleteVOrganizationsIdDomainsDid","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"did","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Remove a domain","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainRemoved"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/legal-entity":{"get":{"tags":["Organizations"],"summary":"Legal-entity verification status (separate from domain control)","operationId":"getVOrganizationsIdLegalEntity","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Legal-entity verification status (separate from domain control)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LegalEntityStatus"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Organizations"],"summary":"Submit the legal entity for staff review (two staff members decide)","operationId":"postVOrganizationsIdLegalEntity","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmitLegalEntity"}}}},"responses":{"201":{"description":"Submit the legal entity for staff review (two staff members decide)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/LegalEntityVerification"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/data-governance":{"get":{"tags":["Organizations"],"summary":"Data region, retention settings (with bounds) and whether deletion is suspended","operationId":"getVOrganizationsIdDataGovernance","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Data region, retention settings (with bounds) and whether deletion is suspended","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DataGovernance"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/retention":{"put":{"tags":["Organizations"],"summary":"Set receipt and audit retention within the platform bounds (owners; step-up when production enabled)","operationId":"putVOrganizationsIdRetention","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateRetention"},"example":{"receipt_days":90}}}},"responses":{"200":{"description":"Set receipt and audit retention within the platform bounds (owners; step-up when production enabled)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DataGovernance"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/offboarding":{"get":{"tags":["Organizations"],"summary":"Offboarding request, termination date and the trust replacement checklist","operationId":"getVOrganizationsIdOffboarding","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Offboarding request, termination date and the trust replacement checklist","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OffboardingStatus"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Organizations"],"summary":"Request offboarding of the organization (owners)","operationId":"postVOrganizationsIdOffboarding","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RequestOffboarding"},"example":{"reason":"Contract ends 2027-03-31; moving to another provider."}}}},"responses":{"201":{"description":"Request offboarding of the organization (owners)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OffboardingStatus"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/offboarding/export":{"post":{"tags":["Organizations"],"summary":"Export public chains, current policy, grants and audit as a signed bundle (kept in protected storage)","operationId":"postVOrganizationsIdOffboardingExport","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Export public chains, current policy, grants and audit as a signed bundle (kept in protected storage)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OffboardingStatus"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/offboarding/schedule":{"post":{"tags":["Organizations"],"summary":"Schedule termination once exported, every grant is withdrawn and every gateway disabled (30 to 365 days notice)","operationId":"postVOrganizationsIdOffboardingSchedule","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScheduleOffboarding"}}}},"responses":{"200":{"description":"Schedule termination once exported, every grant is withdrawn and every gateway disabled (30 to 365 days notice)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OffboardingStatus"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/offboarding/cancel":{"post":{"tags":["Organizations"],"summary":"Cancel an open offboarding request before termination","operationId":"postVOrganizationsIdOffboardingCancel","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Cancel an open offboarding request before termination","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OffboardingStatus"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/me/data-export":{"post":{"tags":["Identity"],"summary":"Download all personal data held about you as a signed bundle (passkey or SSO sign-in within 15 minutes)","operationId":"postVMeDataExport","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"200":{"description":"Download all personal data held about you as a signed bundle (passkey or SSO sign-in within 15 minutes)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PersonalDataExport"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/me/erasure":{"post":{"tags":["Identity"],"summary":"Erase your account: personal attributes removed, sign-in material deleted, audit entries pseudonymized","operationId":"postVMeErasure","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EraseAccount"}}}},"responses":{"200":{"description":"Erase your account: personal attributes removed, sign-in material deleted, audit entries pseudonymized","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccountErased"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/privacy/signing-keys":{"get":{"tags":["Platform"],"summary":"Public keys that verify signed export bundles (personal data and offboarding exports)","operationId":"getVPrivacySigningKeys","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[],"responses":{"200":{"description":"Public keys that verify signed export bundles (personal data and offboarding exports)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrivacySigningKeys"}}}},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"none"}},"/v1/organizations/{id}/sso":{"get":{"tags":["Organizations"],"summary":"Organization identity provider (OIDC), routed domains, SSO-only enforcement and break-glass owners","operationId":"getVOrganizationsIdSso","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Organization identity provider (OIDC), routed domains, SSO-only enforcement and break-glass owners","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SsoConfiguration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"put":{"tags":["Organizations"],"summary":"Configure the organization OIDC identity provider (owners; fresh sign-in; discovery fetched without redirects; secret stored sealed)","operationId":"putVOrganizationsIdSso","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureSso"},"example":{"issuer":"https://example.okta.com","client_id":"0oa1example","client_secret":"redacted","domains":["example.com"]}}}},"responses":{"200":{"description":"Configure the organization OIDC identity provider (owners; fresh sign-in; discovery fetched without redirects; secret stored sealed)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SsoConfiguration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"},"delete":{"tags":["Organizations"],"summary":"Remove the organization identity provider (also ends SSO-only enforcement)","operationId":"deleteVOrganizationsIdSso","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"200":{"description":"Remove the organization identity provider (also ends SSO-only enforcement)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SsoConfiguration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/organizations/{id}/sso/enforcement":{"post":{"tags":["Organizations"],"summary":"Turn SSO-only sign-in on or off (needs a tested IdP and a break-glass owner)","operationId":"postVOrganizationsIdSsoEnforcement","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetSsoEnforcement"}}}},"responses":{"200":{"description":"Turn SSO-only sign-in on or off (needs a tested IdP and a break-glass owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SsoConfiguration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/organizations/{id}/sso/break-glass":{"post":{"tags":["Organizations"],"summary":"Designate a break-glass owner (keeps passkey sign-in while SSO-only is enforced)","operationId":"postVOrganizationsIdSsoBreakGlass","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddBreakGlassOwner"}}}},"responses":{"201":{"description":"Designate a break-glass owner (keeps passkey sign-in while SSO-only is enforced)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SsoConfiguration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/organizations/{id}/sso/break-glass/{uid}":{"delete":{"tags":["Organizations"],"summary":"Remove a break-glass owner (one must remain while SSO-only is enforced)","operationId":"deleteVOrganizationsIdSsoBreakGlassUid","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"uid","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"200":{"description":"Remove a break-glass owner (one must remain while SSO-only is enforced)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SsoConfiguration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/organizations/{id}/scim":{"get":{"tags":["Organizations"],"summary":"SCIM 2.0 provisioning: base URL, tokens (never the secrets), group to role mappings and counts","operationId":"getVOrganizationsIdScim","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"SCIM 2.0 provisioning: base URL, tokens (never the secrets), group to role mappings and counts","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimConfiguration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/scim/tokens":{"post":{"tags":["Organizations"],"summary":"Create a SCIM bearer token (shown once, stored as a hash; fresh sign-in)","operationId":"postVOrganizationsIdScimTokens","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateScimToken"}}}},"responses":{"201":{"description":"Create a SCIM bearer token (shown once, stored as a hash; fresh sign-in)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimTokenCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/organizations/{id}/scim/tokens/{tid}/rotate":{"post":{"tags":["Organizations"],"summary":"Rotate a SCIM token: a new token is shown once and the old one stops working","operationId":"postVOrganizationsIdScimTokensTidRotate","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"tid","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"201":{"description":"Rotate a SCIM token: a new token is shown once and the old one stops working","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimTokenCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/organizations/{id}/scim/tokens/{tid}/revoke":{"post":{"tags":["Organizations"],"summary":"Revoke a SCIM token","operationId":"postVOrganizationsIdScimTokensTidRevoke","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"tid","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Revoke a SCIM token","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimTokenRevoked"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/scim/role-mappings":{"put":{"tags":["Organizations"],"summary":"Replace the SCIM group to role mapping (never the owner role); provisioned roles are re-derived","operationId":"putVOrganizationsIdScimRoleMappings","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutScimRoleMappings"}}}},"responses":{"200":{"description":"Replace the SCIM group to role mapping (never the owner role); provisioned roles are re-derived","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimConfiguration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/owner-recovery-requests":{"get":{"tags":["Organizations"],"summary":"Owner recovery requests for this organization (owners; cancel one to object)","operationId":"getVOrganizationsIdOwnerRecoveryRequests","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Owner recovery requests for this organization (owners; cancel one to object)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerRecoveryList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/owner-recovery-requests":{"get":{"tags":["Identity"],"summary":"Owner recovery requests the signed-in person started","operationId":"getVOwnerRecoveryRequests","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]}],"responses":{"200":{"description":"Owner recovery requests the signed-in person started","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerRecoveryList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"},"post":{"tags":["Identity"],"summary":"Ask to recover ownership of an organization whose owners are all locked out (verified domain and contact attestation)","operationId":"postVOwnerRecoveryRequests","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateOwnerRecovery"}}}},"responses":{"201":{"description":"Ask to recover ownership of an organization whose owners are all locked out (verified domain and contact attestation)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerRecovery"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/owner-recovery-requests/{id}":{"get":{"tags":["Identity"],"summary":"One owner recovery request (the requester or a current owner)","operationId":"getVOwnerRecoveryRequestsId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]}],"responses":{"200":{"description":"One owner recovery request (the requester or a current owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerRecovery"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/owner-recovery-requests/{id}/check":{"post":{"tags":["Identity"],"summary":"Check the fresh DNS TXT challenge now (two DNS-over-HTTPS resolvers must agree)","operationId":"postVOwnerRecoveryRequestsIdCheck","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"200":{"description":"Check the fresh DNS TXT challenge now (two DNS-over-HTTPS resolvers must agree)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerRecovery"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/owner-recovery-requests/{id}/cancel":{"post":{"tags":["Identity"],"summary":"Withdraw a recovery (requester) or object to it (a current owner)","operationId":"postVOwnerRecoveryRequestsIdCancel","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelOwnerRecovery"}}}},"responses":{"200":{"description":"Withdraw a recovery (requester) or object to it (a current owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerRecovery"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/owner-recovery-requests/{id}/claim":{"post":{"tags":["Identity"],"summary":"Claim the approved owner bootstrap (the named identity, fresh sign-in, before it expires)","operationId":"postVOwnerRecoveryRequestsIdClaim","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"200":{"description":"Claim the approved owner bootstrap (the named identity, fresh sign-in, before it expires)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerRecovery"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/organizations/{id}/delegations":{"get":{"tags":["Organizations"],"summary":"Partner delegations of this organization (who may administer it, with which roles and dates)","operationId":"getVOrganizationsIdDelegations","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Partner delegations of this organization (who may administer it, with which roles and dates)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DelegationList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/delegated-tenants":{"get":{"tags":["Organizations"],"summary":"Reseller console: customer tenants currently delegated to this reseller organization","operationId":"getVOrganizationsIdDelegatedTenants","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Reseller console: customer tenants currently delegated to this reseller organization","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DelegatedTenantList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/delegations/{id}/accept":{"post":{"tags":["Organizations"],"summary":"Accept a proposed delegation (customer owner, fresh sign-in)","operationId":"postVDelegationsIdAccept","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"200":{"description":"Accept a proposed delegation (customer owner, fresh sign-in)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Delegation"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/delegations/{id}/decline":{"post":{"tags":["Organizations"],"summary":"Decline a proposed delegation (customer owner)","operationId":"postVDelegationsIdDecline","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EndDelegation"}}}},"responses":{"200":{"description":"Decline a proposed delegation (customer owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Delegation"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/delegations/{id}/revoke":{"post":{"tags":["Organizations"],"summary":"End delegated access (an owner of either side; commercial records are unaffected)","operationId":"postVDelegationsIdRevoke","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EndDelegation"}}}},"responses":{"200":{"description":"End delegated access (an owner of either side; commercial records are unaffected)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Delegation"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/billing":{"get":{"tags":["Billing"],"summary":"Plan, capacity used/remaining, invoices","operationId":"getVOrganizationsIdBilling","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Plan, capacity used/remaining, invoices","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BillingSummary"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/spaces":{"post":{"tags":["Spaces"],"summary":"Create a trust space with its own private trust anchor","operationId":"postVSpaces","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSpace"}}}},"responses":{"201":{"description":"Create a trust space with its own private trust anchor","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SpaceCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/spaces/{id}":{"get":{"tags":["Spaces"],"summary":"Get a space with its issuer chain","operationId":"getVSpacesId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Get a space with its issuer chain","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Space"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/spaces/{id}/trust-bundle.pem":{"get":{"tags":["Spaces"],"summary":"Export public trust material","operationId":"getVSpacesIdTrustBundlePem","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Export public trust material","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/x-pem-file":{"schema":{"type":"string"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/spaces/{id}/rollovers":{"get":{"tags":["Spaces"],"summary":"Issuer rollovers of this space, newest first","operationId":"getVSpacesIdRollovers","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Issuer rollovers of this space, newest first","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolloverList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Spaces"],"summary":"Start a routine issuing-CA rollover (successor staged in the signed trust bundle)","description":"Trust administrators only. The successor issuing CA is created under the same root and published in every service bundle; issuance switches to it once every in-scope gateway acknowledged a revision containing it, retirement waits for a canary and the live-leaf plus overlap window. Production needs a recent step-up and a PKI Operations ceremony for the successor. Root and manifest-key rollovers are staff operations (dual control).","operationId":"postVSpacesIdRollovers","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StartRollover"}}}},"responses":{"201":{"description":"Start a routine issuing-CA rollover (successor staged in the signed trust bundle)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Rollover"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/rollovers/{id}":{"get":{"tags":["Spaces"],"summary":"Rollover with its timeline, per-gateway acknowledgments, canaries and workloads still on the previous issuer","operationId":"getVRolloversId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Rollover with its timeline, per-gateway acknowledgments, canaries and workloads still on the previous issuer","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Rollover"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/rollovers/{id}/advance":{"post":{"tags":["Spaces"],"summary":"Re-check the guards now and move the rollover forward as far as they allow","operationId":"postVRolloversIdAdvance","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Re-check the guards now and move the rollover forward as far as they allow","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Rollover"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/rollovers/{id}/abort":{"post":{"tags":["Spaces"],"summary":"Abort a rollover before it drains (the successor leaves service; issued successor leaves keep working until they expire)","operationId":"postVRolloversIdAbort","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolloverDecision"}}}},"responses":{"200":{"description":"Abort a rollover before it drains (the successor leaves service; issued successor leaves keep working until they expire)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Rollover"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/rollovers/{id}/ack-override":{"post":{"tags":["Spaces"],"summary":"Explicitly continue without acknowledgments from the listed offline gateways (audited; production needs a step-up)","operationId":"postVRolloversIdAckOverride","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RolloverDecision"}}}},"responses":{"200":{"description":"Explicitly continue without acknowledgments from the listed offline gateways (audited; production needs a step-up)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Rollover"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/services":{"post":{"tags":["Services"],"summary":"Create a service (API) with allowed route templates","operationId":"postVServices","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateService"}}}},"responses":{"201":{"description":"Create a service (API) with allowed route templates","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ServiceCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/services/{id}":{"get":{"tags":["Services"],"summary":"Service, gateways, readiness and current policy revision","operationId":"getVServicesId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Service, gateways, readiness and current policy revision","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Service"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"patch":{"tags":["Services"],"summary":"Change service settings (grant approval mode, contact, owner)","operationId":"patchVServicesId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateService"}}}},"responses":{"200":{"description":"Change service settings (grant approval mode, contact, owner)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ServiceUpdated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/services/{id}/server-tls-attestations":{"post":{"tags":["Services"],"summary":"Attest the server TLS configuration (readiness, when the gateway does not report it)","operationId":"postVServicesIdServerTlsAttestations","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttestServerTls"}}}},"responses":{"201":{"description":"Attest the server TLS configuration (readiness, when the gateway does not report it)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ServerTlsAttestation"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/services/{id}/origin-checks":{"post":{"tags":["Services"],"summary":"Start an origin exposure check (run mt gateway check-origin outside the private network)","operationId":"postVServicesIdOriginChecks","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateOriginCheck"}}}},"responses":{"201":{"description":"Start an origin exposure check (run mt gateway check-origin outside the private network)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OriginCheckCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/origin-checks/{id}/result":{"post":{"tags":["Services"],"summary":"Record a signed origin check result (one-time check token in x-origin-check-token)","operationId":"postVOriginChecksIdResult","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OriginCheckResult"}}}},"responses":{"200":{"description":"Record a signed origin check result (one-time check token in x-origin-check-token)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OriginCheckRecorded"}}}},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"origin_check_token"}},"/v1/services/{id}/receipts":{"get":{"tags":["Services"],"summary":"Verification receipts (TLS and authorization separately)","operationId":"getVServicesIdReceipts","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Verification receipts (TLS and authorization separately)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReceiptList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/services/{id}/invitations":{"get":{"tags":["Services"],"summary":"List invitations for a service","operationId":"getVServicesIdInvitations","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"List invitations for a service","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Services"],"summary":"Invite a partner organization with a scoped grant","operationId":"postVServicesIdInvitations","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":true,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateInvitation"}}}},"responses":{"201":{"description":"Invite a partner organization with a scoped grant","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/services/{id}/gateways":{"post":{"tags":["Gateways"],"summary":"Approve a gateway pairing code","operationId":"postVServicesIdGateways","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovePairing"}}}},"responses":{"201":{"description":"Approve a gateway pairing code","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayApproved"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/invitations/{id}/preview":{"post":{"tags":["Invitations"],"summary":"Recipient view of an invitation (secret in body)","operationId":"postVInvitationsIdPreview","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RespondInvitation"}}}},"responses":{"200":{"description":"Recipient view of an invitation (secret in body)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationPreview"}}}},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"invitation_secret"}},"/v1/invitations/{id}/accept":{"post":{"tags":["Invitations"],"summary":"Redeem a one-time invitation secret and bind a workload","operationId":"postVInvitationsIdAccept","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":true,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptInvitation"}}}},"responses":{"201":{"description":"Redeem a one-time invitation secret and bind a workload","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationAccepted"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/invitations/{id}/decline":{"post":{"tags":["Invitations"],"summary":"Decline an invitation","operationId":"postVInvitationsIdDecline","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RespondInvitation"}}}},"responses":{"200":{"description":"Decline an invitation","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationResponded"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/invitations/{id}/cancel":{"post":{"tags":["Invitations"],"summary":"Cancel a pending invitation (sponsor)","operationId":"postVInvitationsIdCancel","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Cancel a pending invitation (sponsor)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationResponded"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/grants":{"get":{"tags":["Grants"],"summary":"List grants by ?service_id= (sponsor) or ?org_id= (partner view)","operationId":"getVGrants","parameters":[{"name":"service_id","in":"query","required":false,"description":"Sponsor view of one service.","schema":{"type":"string"}},{"name":"org_id","in":"query","required":false,"description":"Partner view of one consumer organization.","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"List grants by ?service_id= (sponsor) or ?org_id= (partner view)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/grants/{id}":{"get":{"tags":["Grants"],"summary":"Grant detail (each side sees only its view)","operationId":"getVGrantsId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Grant detail (each side sees only its view)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}},"ETag":{"description":"Grant revision, e.g. \"3\" (send as If-Match).","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Grant"},"example":{"id":"gr_01jq3v8m2k9x4h7c5n6p0r1s2t","state":"active","revision":3,"environment":"sandbox","scope":{"v":1,"routes":[{"methods":["GET"],"path":"/orders/*"}]}}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/grants/{id}/approve":{"post":{"tags":["Grants"],"summary":"Approve a pending grant (sponsor review; production checks capacity)","operationId":"postVGrantsIdApprove","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApproveGrant"}}}},"responses":{"200":{"description":"Approve a pending grant (sponsor review; production checks capacity)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantTransition"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/grants/{id}/reject":{"post":{"tags":["Grants"],"summary":"Reject a pending grant with a reason","operationId":"postVGrantsIdReject","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantReason"}}}},"responses":{"200":{"description":"Reject a pending grant with a reason","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantTransition"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/grants/{id}/revoke":{"post":{"tags":["Grants"],"summary":"Withdraw a grant (If-Match revision)","operationId":"postVGrantsIdRevoke","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantReason"}}}},"responses":{"200":{"description":"Withdraw a grant (If-Match revision)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantTransition"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/grants/{id}/suspend":{"post":{"tags":["Grants"],"summary":"Suspend a grant (slot stays reserved)","operationId":"postVGrantsIdSuspend","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantReason"}}}},"responses":{"200":{"description":"Suspend a grant (slot stays reserved)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantTransition"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/grants/{id}/resume":{"post":{"tags":["Grants"],"summary":"Resume a suspended grant","operationId":"postVGrantsIdResume","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResumeGrant"}}}},"responses":{"200":{"description":"Resume a suspended grant","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantTransition"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/grants/{id}/scope":{"patch":{"tags":["Grants"],"summary":"Preview or change grant scope","operationId":"patchVGrantsIdScope","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateGrantScope"}}}},"responses":{"200":{"description":"Preview or change grant scope","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScopeChange"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/operations/{id}":{"get":{"tags":["Grants"],"summary":"Per-gateway acknowledgment status for a change","operationId":"getVOperationsId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Per-gateway acknowledgment status for a change","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Operation"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workloads/{id}/binding":{"patch":{"tags":["Enrollment"],"summary":"Rebind an OIDC workload to a service account UID (partner administrator)","operationId":"patchVWorkloadsIdBinding","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWorkloadBinding"}}}},"responses":{"200":{"description":"Rebind an OIDC workload to a service account UID (partner administrator)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkloadBinding"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workloads/{id}/enrollment-tokens":{"post":{"tags":["Enrollment"],"summary":"Approve a sandbox enrollment (browser)","operationId":"postVWorkloadsIdEnrollmentTokens","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateEnrollmentToken"}}}},"responses":{"201":{"description":"Approve a sandbox enrollment (browser)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnrollmentTokenCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/enrollments":{"post":{"tags":["Enrollment"],"summary":"Present a workload attestation; receive a single-use challenge","operationId":"postVEnrollments","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateEnrollment"}}}},"responses":{"201":{"description":"Present a workload attestation; receive a single-use challenge","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnrollmentChallenge"}}}},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"workload_attestation"}},"/v1/enrollments/{id}/complete":{"post":{"tags":["Enrollment"],"summary":"Submit CSR + proof of possession; 202 when signing is pending","operationId":"postVEnrollmentsIdComplete","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteEnrollment"}}}},"responses":{"200":{"description":"Submit CSR + proof of possession; 202 when signing is pending","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CertificateIssued"}}}},"202":{"description":"Signing is pending; poll the issuance request.","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssuancePending"}}}},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"enrollment_challenge_and_key_proof"}},"/v1/issuance-requests/{id}":{"get":{"tags":["Enrollment"],"summary":"Poll a pending issuance (x-enrollment-challenge header)","operationId":"getVIssuanceRequestsId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"enrollmentChallenge":[]}],"responses":{"200":{"description":"Poll a pending issuance (x-enrollment-challenge header)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssuancePending"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"enrollment_challenge"}},"/v1/certificates/{id}/renew":{"post":{"tags":["Certificates"],"summary":"Renew by key continuity","operationId":"postVCertificatesIdRenew","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenewCertificate"}}}},"responses":{"200":{"description":"Renew by key continuity","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IssuanceResult"}}}},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"key_proof"}},"/v1/certificates/{id}/reloaded":{"post":{"tags":["Certificates"],"summary":"Confirm the workload reloaded its new credential","operationId":"postVCertificatesIdReloaded","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfirmReload"}}}},"responses":{"200":{"description":"Confirm the workload reloaded its new credential","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReloadConfirmed"}}}},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"key_proof"}},"/v1/certificates/{id}/revoke":{"post":{"tags":["Certificates"],"summary":"Revoke one leaf","operationId":"postVCertificatesIdRevoke","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeCertificate"}}}},"responses":{"200":{"description":"Revoke one leaf","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CertificateRevoked"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/certificates/{id}/chain.pem":{"get":{"tags":["Certificates"],"summary":"Download leaf + issuing CA + root (PEM)","operationId":"getVCertificatesIdChainPem","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Download leaf + issuing CA + root (PEM)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/x-pem-file":{"schema":{"type":"string"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/pairings":{"post":{"tags":["Gateways"],"summary":"Gateway registers its key and receives a pairing code","operationId":"postVPairings","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatePairing"}}}},"responses":{"201":{"description":"Gateway registers its key and receives a pairing code","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PairingCreated"}}}},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"none"}},"/v1/pairings/{id}":{"get":{"tags":["Gateways"],"summary":"Gateway collects its credential and pinned policy key (x-poll-secret)","operationId":"getVPairingsId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"pairingPollSecret":[]}],"responses":{"200":{"description":"Gateway collects its credential and pinned policy key (x-poll-secret)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PairingStatus"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"poll_secret"}},"/v1/gateways/{id}/disable":{"post":{"tags":["Gateways"],"summary":"Disable a gateway credential","operationId":"postVGatewaysIdDisable","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Disable a gateway credential","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayDisabled"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/gateways/{id}/manifest":{"get":{"tags":["Gateways"],"summary":"Signed, target-scoped policy manifest (JWS ES256, pinned kid)","operationId":"getVGatewaysIdManifest","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"gatewayCredential":[]}],"responses":{"200":{"description":"Signed, target-scoped policy manifest (JWS ES256, pinned kid)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedManifest"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"gateway"}},"/v1/gateways/{id}/acks":{"post":{"tags":["Gateways"],"summary":"Signed acknowledgment of an applied revision","operationId":"postVGatewaysIdAcks","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"gatewayCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayAck"}}}},"responses":{"202":{"description":"Signed acknowledgment of an applied revision","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AckAccepted"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"gateway"}},"/v1/gateways/{id}/receipts":{"post":{"tags":["Gateways"],"summary":"Signed verification receipts","operationId":"postVGatewaysIdReceipts","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"gatewayCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GatewayReceipts"}}}},"responses":{"202":{"description":"Signed verification receipts","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReceiptsAccepted"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"gateway"}},"/v1/adapters":{"get":{"tags":["Integrations"],"summary":"Adapter catalog: roles, delivery modes and tested platform versions","operationId":"getVAdapters","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Adapter catalog: roles, delivery modes and tested platform versions","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdapterList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations":{"post":{"tags":["Integrations"],"summary":"Register an integration (adapter, endpoint, optional service and partner connection); pins the approval key","operationId":"postVIntegrations","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RegisterIntegration"},"example":{"org_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","adapter_id":"nginx.oss.server","adapter_version":"1.0.0","environment":"sandbox","service_id":"svc_01jq3v8m2k9x4h7c5n6p0r1s2t","endpoint":{"hostname":"api.example.com","port":443,"route":"/orders","tls_terminator":"nginx edge","upstream":"http://10.0.0.12:8080"},"authorizer":{"address":"http://127.0.0.1:9191/authz","protocol":"forward_auth"}}}}},"responses":{"201":{"description":"Register an integration (adapter, endpoint, optional service and partner connection); pins the approval key","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Integration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"get":{"tags":["Integrations"],"summary":"Integrations owned by an organization","operationId":"getVIntegrations","parameters":[{"name":"org_id","in":"query","required":true,"description":"Owning organization.","schema":{"type":"string","pattern":"^org_[a-z0-9_]+$"}},{"name":"service_id","in":"query","required":false,"description":"Only integrations scoped to this service.","schema":{"type":"string","pattern":"^svc_[a-z0-9_]+$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Integrations owned by an organization","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntegrationList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations/{id}":{"get":{"tags":["Integrations"],"summary":"Integration with its target, pinned approval key and activity summary","operationId":"getVIntegrationsId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Integration with its target, pinned approval key and activity summary","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Integration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"patch":{"tags":["Integrations"],"summary":"Change the name, state, trust bundle mode or second-approver rule","operationId":"patchVIntegrationsId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateIntegration"}}}},"responses":{"200":{"description":"Change the name, state, trust bundle mode or second-approver rule","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Integration"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations/{id}/desired-state":{"get":{"tags":["Integrations"],"summary":"Desired state computed from the trust space (chain, bundle hash, revocation, identity bindings, policy mapping) with its fingerprint","description":"The default body is exactly DesiredStateV1 as mt-adapt plan --desired reads it; the fingerprint is in the Desired-State-Fingerprint header. detail=1 adds desired_state_fingerprint and the non-fingerprinted context (CRL URLs, deny set, policy routes).","operationId":"getVIntegrationsIdDesiredState","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"detail","in":"query","required":false,"description":"1 adds desired_state_fingerprint and context to the body.","schema":{"type":"string","enum":["0","1"]}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Desired state computed from the trust space (chain, bundle hash, revocation, identity bindings, policy mapping) with its fingerprint","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}},"Desired-State-Fingerprint":{"description":"SHA-256 of the canonical JSON of the fingerprinted members.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DesiredStateV1"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations/{id}/plans":{"post":{"tags":["Integrations"],"summary":"Submit a plan or rollback artifact (hash and desired-state fingerprint re-checked; idempotent by plan hash)","operationId":"postVIntegrationsIdPlans","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmitPlan"}}}},"responses":{"201":{"description":"Submit a plan or rollback artifact (hash and desired-state fingerprint re-checked; idempotent by plan hash)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlanSubmission"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"get":{"tags":["Integrations"],"summary":"Submitted plans with redacted diffs and decisions","operationId":"getVIntegrationsIdPlans","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Submitted plans with redacted diffs and decisions","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlanSubmissionList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations/{id}/plans/{plan_hash}":{"get":{"tags":["Integrations"],"summary":"One submitted plan","operationId":"getVIntegrationsIdPlansPlanHash","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"plan_hash","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"One submitted plan","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlanSubmission"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations/{id}/plans/{plan_hash}/approve":{"post":{"tags":["Integrations"],"summary":"Approve a plan (signed-in passkey or SSO session, step-up within 15 minutes, separate approver when required)","operationId":"postVIntegrationsIdPlansPlanHashApprove","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"plan_hash","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovePlan"}}}},"responses":{"200":{"description":"Approve a plan (signed-in passkey or SSO session, step-up within 15 minutes, separate approver when required)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlanDecision"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/integrations/{id}/plans/{plan_hash}/reject":{"post":{"tags":["Integrations"],"summary":"Reject a plan with a reason","operationId":"postVIntegrationsIdPlansPlanHashReject","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"plan_hash","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RejectPlan"}}}},"responses":{"200":{"description":"Reject a plan with a reason","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlanDecision"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/integrations/{id}/approvals/{plan_hash}":{"get":{"tags":["Integrations"],"summary":"Approval JWS for an approved plan (ES256, typ mt.adapter-approval.v1, at most one hour)","operationId":"getVIntegrationsIdApprovalsPlanHash","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"plan_hash","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Approval JWS for an approved plan (ES256, typ mt.adapter-approval.v1, at most one hour)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovalToken"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations/{id}/runs":{"post":{"tags":["Integrations"],"summary":"Record a runtime run (append-only; mutating runs need an approved plan; verification stored as evidence)","operationId":"postVIntegrationsIdRuns","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecordRun"}}}},"responses":{"201":{"description":"Record a runtime run (append-only; mutating runs need an approved plan; verification stored as evidence)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntegrationRun"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"get":{"tags":["Integrations"],"summary":"Run timeline, newest first","operationId":"getVIntegrationsIdRuns","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Run timeline, newest first","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntegrationRunList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations/{id}/exports":{"post":{"tags":["Integrations"],"summary":"Record a configuration export and get its signed export statement (plan hash checked; next version; idempotent by manifest hash)","description":"Send the export manifest mt-adapt render wrote (export/manifest.json). The plan hash must be a submitted, unrejected plan of this integration with the same desired-state fingerprint and adapter version, and the target must be the integration target. The statement is an ES256 JWS (typ mt.adapter-export.v1+jws) signed with the space manifest key pinned for the integration; mt-adapt export verify checks it offline together with every file hash.","operationId":"postVIntegrationsIdExports","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmitExport"}}}},"responses":{"201":{"description":"Record a configuration export and get its signed export statement (plan hash checked; next version; idempotent by manifest hash)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntegrationExport"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"get":{"tags":["Integrations"],"summary":"Export history, newest version first","operationId":"getVIntegrationsIdExports","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Export history, newest version first","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntegrationExportList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations/{id}/exports/{version}":{"get":{"tags":["Integrations"],"summary":"One export version with its manifest and signed statement","operationId":"getVIntegrationsIdExportsVersion","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"version","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"One export version with its manifest and signed statement","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntegrationExport"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations/{id}/evidence":{"get":{"tags":["Integrations"],"summary":"Latest result for each of the eight acceptance categories with provenance","operationId":"getVIntegrationsIdEvidence","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Latest result for each of the eight acceptance categories with provenance","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IntegrationEvidence"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/spaces/{id}/approval-policy":{"get":{"tags":["Spaces"],"summary":"Approval policy of this space: what it sets, the effective policy and where each value comes from","operationId":"getVSpacesIdApprovalPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Approval policy of this space: what it sets, the effective policy and where each value comes from","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}},"ETag":{"description":"Scope revision for If-Match.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovalPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"put":{"tags":["Spaces"],"summary":"Change the approval policy of this space (partial; null clears a field)","description":"Customer scopes may only tighten the floor that staff set at platform and tenant level. Owners and trust administrators can change it; relaxing a production scope needs a browser session re-authenticated with a passkey or the identity provider within 15 minutes (POST /v1/me/step-up), while tightening is also accepted from API credentials. Send If-Match with the scope revision (0 when nothing is set yet).","operationId":"putVSpacesIdApprovalPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateApprovalPolicy"},"example":{"min_approver_age_hours":72,"require_second_approver":true}}}},"responses":{"200":{"description":"Change the approval policy of this space (partial; null clears a field)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovalPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/services/{id}/approval-policy":{"get":{"tags":["Services"],"summary":"Approval policy of this service: what it sets, the effective policy and where each value comes from","operationId":"getVServicesIdApprovalPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Approval policy of this service: what it sets, the effective policy and where each value comes from","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}},"ETag":{"description":"Scope revision for If-Match.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovalPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"put":{"tags":["Services"],"summary":"Change the approval policy of this service (partial; null clears a field)","description":"Customer scopes may only tighten the floor that staff set at platform and tenant level. Owners and trust administrators can change it; relaxing a production scope needs a browser session re-authenticated with a passkey or the identity provider within 15 minutes (POST /v1/me/step-up), while tightening is also accepted from API credentials. Send If-Match with the scope revision (0 when nothing is set yet).","operationId":"putVServicesIdApprovalPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateApprovalPolicy"},"example":{"min_approver_age_hours":72,"require_second_approver":true}}}},"responses":{"200":{"description":"Change the approval policy of this service (partial; null clears a field)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovalPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/integrations/{id}/approval-policy":{"get":{"tags":["Integrations"],"summary":"Approval policy of this integration: what it sets, the effective policy and where each value comes from","operationId":"getVIntegrationsIdApprovalPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Approval policy of this integration: what it sets, the effective policy and where each value comes from","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}},"ETag":{"description":"Scope revision for If-Match.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovalPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"put":{"tags":["Integrations"],"summary":"Change the approval policy of this integration (partial; null clears a field)","description":"Customer scopes may only tighten the floor that staff set at platform and tenant level. Owners and trust administrators can change it; relaxing a production scope needs a browser session re-authenticated with a passkey or the identity provider within 15 minutes (POST /v1/me/step-up), while tightening is also accepted from API credentials. Send If-Match with the scope revision (0 when nothing is set yet).","operationId":"putVIntegrationsIdApprovalPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateApprovalPolicy"},"example":{"min_approver_age_hours":72,"require_second_approver":true}}}},"responses":{"200":{"description":"Change the approval policy of this integration (partial; null clears a field)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApprovalPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/approval-policy":{"get":{"tags":["Organizations"],"summary":"Approval policies across the organization: effective policy, staff floor and every scope that sets a value","operationId":"getVOrganizationsIdApprovalPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Approval policies across the organization: effective policy, staff floor and every scope that sets a value","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationApprovalPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces":{"post":{"tags":["Migrations"],"summary":"Create a connection workspace for one relationship and endpoint (owner side, or a consumer proposal under the owner initiation policy)","description":"Owner side: name the service (the resource) and, when known, the partner organization, invitation or grant. Consumer side: name the owner by partner handle; whether this is a proposal or only a private assessment depends on the owner initiation policy.","operationId":"postVWorkspaces","parameters":[{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateWorkspace"}}}},"responses":{"201":{"description":"Create a connection workspace for one relationship and endpoint (owner side, or a consumer proposal under the owner initiation policy)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectionWorkspace"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"get":{"tags":["Migrations"],"summary":"Workspaces this organization takes part in (owner or consumer), role-scoped","operationId":"getVWorkspaces","parameters":[{"name":"org_id","in":"query","required":true,"description":"Organization whose workspaces to list.","schema":{"type":"string","pattern":"^org_[a-z0-9_]+$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Workspaces this organization takes part in (owner or consumer), role-scoped","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectionWorkspaceList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces/{id}":{"get":{"tags":["Migrations"],"summary":"One workspace in the view the caller is entitled to (owner, consumer or delegated engineer)","operationId":"getVWorkspacesId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"One workspace in the view the caller is entitled to (owner, consumer or delegated engineer)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectionWorkspace"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces/{id}/authorize":{"post":{"tags":["Migrations"],"summary":"Resource owner: authorize a proposed workspace by binding the resource (service) and, optionally, the relationship","operationId":"postVWorkspacesIdAuthorize","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthorizeWorkspace"}}}},"responses":{"200":{"description":"Resource owner: authorize a proposed workspace by binding the resource (service) and, optionally, the relationship","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectionWorkspace"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces/{id}/assessments":{"post":{"tags":["Migrations"],"summary":"Submit discovery evidence (MigrationEvidenceV1, sanitized configuration, public certificates, mt-adapt inspection) and get the assessment","description":"Uploads are redacted and scanned for instruction-like text before anything is stored; a private key anywhere refuses the upload. Only the redacted extraction is kept (raw uploads are referenced by SHA-256). Delegated engineers with evidence.upload may call this.","operationId":"postVWorkspacesIdAssessments","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmitAssessment"}}}},"responses":{"201":{"description":"Submit discovery evidence (MigrationEvidenceV1, sanitized configuration, public certificates, mt-adapt inspection) and get the assessment","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationAssessment"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces/{id}/assessments/preview":{"post":{"tags":["Migrations"],"summary":"Assess a submission together with the stored evidence without storing anything (same redaction and checks)","operationId":"postVWorkspacesIdAssessmentsPreview","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmitAssessment"}}}},"responses":{"200":{"description":"Assess a submission together with the stored evidence without storing anything (same redaction and checks)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationAssessmentPreview"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces/{id}/diagnostics":{"get":{"tags":["Migrations"],"summary":"Diagnostic evidence visible to the caller (owner_only, consumer_only or shared_redacted), newest first, in pages","operationId":"getVWorkspacesIdDiagnostics","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"limit","in":"query","required":false,"description":"Page size, 1 to 200 (default 200).","schema":{"type":"integer","minimum":1,"maximum":200}},{"name":"cursor","in":"query","required":false,"description":"next_cursor of the previous page.","schema":{"type":"string","maxLength":200}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Diagnostic evidence visible to the caller (owner_only, consumer_only or shared_redacted), newest first, in pages","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DiagnosticEvidenceList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces/{id}/plans":{"post":{"tags":["Migrations"],"summary":"Draft the next immutable plan version from an assessment (replanning invalidates the approvals bound to earlier versions)","operationId":"postVWorkspacesIdPlans","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateMigrationPlan"}}}},"responses":{"201":{"description":"Draft the next immutable plan version from an assessment (replanning invalidates the approvals bound to earlier versions)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationPlan"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces/{id}/plans/preview":{"post":{"tags":["Migrations"],"summary":"Draft the next plan version without storing it: content, plan hash and the approvals it would invalidate","operationId":"postVWorkspacesIdPlansPreview","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateMigrationPlan"}}}},"responses":{"200":{"description":"Draft the next plan version without storing it: content, plan hash and the approvals it would invalidate","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationPlanPreview"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces/{id}/handover":{"get":{"tags":["Migrations"],"summary":"Immutable, role-scoped handover report with its signed statement (generated once the connection is active or rolled back)","operationId":"getVWorkspacesIdHandover","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Immutable, role-scoped handover report with its signed statement (generated once the connection is active or rolled back)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HandoverReport"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces/{id}/tasks":{"post":{"tags":["Migrations"],"summary":"Delegate discovery to an engineer: a task-scoped, expiring invitation (discovery and evidence upload on this workspace only)","operationId":"postVWorkspacesIdTasks","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDelegatedTask"}}}},"responses":{"201":{"description":"Delegate discovery to an engineer: a task-scoped, expiring invitation (discovery and evidence upload on this workspace only)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DelegatedTaskCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"get":{"tags":["Migrations"],"summary":"Delegated tasks of this workspace (your side)","operationId":"getVWorkspacesIdTasks","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Delegated tasks of this workspace (your side)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DelegatedTaskList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/tasks/{id}":{"get":{"tags":["Migrations"],"summary":"One delegated task (its creator side, or the engineer who claimed it)","operationId":"getVTasksId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"One delegated task (its creator side, or the engineer who claimed it)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DelegatedTask"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/tasks/{id}/claim":{"post":{"tags":["Migrations"],"summary":"Claim a delegated task with its token from a signed-in passkey or SSO account (the link alone confers nothing)","operationId":"postVTasksIdClaim","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClaimDelegatedTask"}}}},"responses":{"200":{"description":"Claim a delegated task with its token from a signed-in passkey or SSO account (the link alone confers nothing)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DelegatedTask"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/tasks/{id}/revoke":{"post":{"tags":["Migrations"],"summary":"Revoke a delegated task","operationId":"postVTasksIdRevoke","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Revoke a delegated task","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DelegatedTask"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/tasks/{id}/link":{"post":{"tags":["Migrations"],"summary":"Issue a new claim link for a pending task (the previous link stops working); how a task an agent created reaches the engineer","operationId":"postVTasksIdLink","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"responses":{"200":{"description":"Issue a new claim link for a pending task (the previous link stops working); how a task an agent created reaches the engineer","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DelegatedTaskCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/plans/{id}":{"get":{"tags":["Migrations"],"summary":"One plan version: content, plan hash, approvals and what is outstanding","operationId":"getVPlansId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"One plan version: content, plan hash, approvals and what is outstanding","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationPlan"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/plans/{id}/approvals":{"post":{"tags":["Migrations"],"summary":"Record an approval bound to plan hash, permission kind, action, target, actor, expiry and environment","description":"Signed-in passkey or SSO session re-authenticated within 15 minutes (or what the approval policy says). The approver must hold the permission kind on their side. Requesters cannot approve their own plans; mandatory controls are never self-approved.","operationId":"postVPlansIdApprovals","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RecordMigrationApproval"}}}},"responses":{"201":{"description":"Record an approval bound to plan hash, permission kind, action, target, actor, expiry and environment","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationApprovalRecorded"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/plans/{id}/readiness":{"get":{"tags":["Migrations"],"summary":"What stands between the caller (a person or the agent run) and the next action: every required approval checked as the action would check it","operationId":"getVPlansIdReadiness","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"What stands between the caller (a person or the agent run) and the next action: every required approval checked as the action would check it","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationPlanReadiness"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/plans/{id}/approval-requests":{"get":{"tags":["Migrations"],"summary":"Approval requests of a plan version, pending first","operationId":"getVPlansIdApprovalRequests","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Approval requests of a plan version, pending first","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationApprovalRequestList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"post":{"tags":["Migrations"],"summary":"Ask people for the approvals a plan needs (a request grants nothing; a supervised agent run waits until they are decided)","operationId":"postVPlansIdApprovalRequests","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateApprovalRequests"}}}},"responses":{"201":{"description":"Ask people for the approvals a plan needs (a request grants nothing; a supervised agent run waits until they are decided)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationApprovalRequestsCreated"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/plans/{id}/executions":{"post":{"tags":["Migrations"],"summary":"Start the durable execution of an approved plan (needs every pre-execution approval and the execution.start approval for the caller)","operationId":"postVPlansIdExecutions","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StartMigrationExecution"}}}},"responses":{"201":{"description":"Start the durable execution of an approved plan (needs every pre-execution approval and the execution.start approval for the caller)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationExecution"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/executions/{id}":{"get":{"tags":["Migrations"],"summary":"Execution with steps, receipts, fingerprints and events","operationId":"getVExecutionsId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Execution with steps, receipts, fingerprints and events","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationExecution"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/executions/{id}/evidence":{"post":{"tags":["Migrations"],"summary":"Guided mode: record evidence for the step the execution waits on (configuration applied, client configured, test results)","operationId":"postVExecutionsIdEvidence","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmitStepEvidence"}}}},"responses":{"200":{"description":"Guided mode: record evidence for the step the execution waits on (configuration applied, client configured, test results)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationExecution"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/executions/{id}/cutover":{"post":{"tags":["Migrations"],"summary":"Request cutover (needs passed validation and the production_cutover approval; old trust is retired only after that)","operationId":"postVExecutionsIdCutover","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RequestCutover"}}}},"responses":{"200":{"description":"Request cutover (needs passed validation and the production_cutover approval; old trust is retired only after that)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationExecution"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/executions/{id}/rollback":{"post":{"tags":["Migrations"],"summary":"Request rollback: compensations run newest first; revocation and other irreversible steps are reported, never undone","operationId":"postVExecutionsIdRollback","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RequestRollback"}}}},"responses":{"200":{"description":"Request rollback: compensations run newest first; revocation and other irreversible steps are reported, never undone","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MigrationExecution"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/workspaces/{id}/agent-runs":{"post":{"tags":["Migrations"],"summary":"Delegate to an agent: bind one MCP connection credential to this workspace side with a mode, a tool scope and an expiry","description":"Signed-in passkey or SSO session; supervised and delegated runs need a step-up within 15 minutes. The credential must be an MCP credential you created for the organization on that side. Agents never approve: approvals stay with people.","operationId":"postVWorkspacesIdAgentRuns","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"Idempotency-Key","in":"header","required":false,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAgentRun"}}}},"responses":{"201":{"description":"Delegate to an agent: bind one MCP connection credential to this workspace side with a mode, a tool scope and an expiry","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRun"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"},"get":{"tags":["Migrations"],"summary":"Agent runs of your sides on this workspace","operationId":"getVWorkspacesIdAgentRuns","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Agent runs of your sides on this workspace","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRunList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/agent-runs":{"get":{"tags":["Migrations"],"summary":"Agent runs: for an MCP connection, the runs bound to it; for a person, the runs of one workspace","operationId":"getVAgentRuns","parameters":[{"name":"workspace_id","in":"query","required":false,"description":"Workspace whose runs to list (required for people).","schema":{"type":"string","pattern":"^cws_[a-z0-9_]+$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Agent runs: for an MCP connection, the runs bound to it; for a person, the runs of one workspace","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRunList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/agent-runs/{id}":{"get":{"tags":["Migrations"],"summary":"One agent run: mode, scope, state, gate and counters","operationId":"getVAgentRunsId","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"One agent run: mode, scope, state, gate and counters","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRun"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/agent-runs/{id}/actions":{"get":{"tags":["Migrations"],"summary":"Every call the agent run made (allowed, refused or failed), oldest first, in pages","operationId":"getVAgentRunsIdActions","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"cursor","in":"query","required":false,"description":"next_cursor of the previous page.","schema":{"type":"string","maxLength":200}},{"name":"limit","in":"query","required":false,"description":"Page size, 1 to 200 (default 100).","schema":{"type":"integer","minimum":1,"maximum":200}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Every call the agent run made (allowed, refused or failed), oldest first, in pages","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRunActionList"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/agent-runs/{id}/pause":{"post":{"tags":["Migrations"],"summary":"Pause an agent run immediately (the delegator, the side, the resource owner, or the agent itself)","operationId":"postVAgentRunsIdPause","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PauseAgentRun"}}}},"responses":{"200":{"description":"Pause an agent run immediately (the delegator, the side, the resource owner, or the agent itself)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRun"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/agent-runs/{id}/resume":{"post":{"tags":["Migrations"],"summary":"Resume a paused agent run (a person, signed in; supervised and delegated runs need a step-up)","operationId":"postVAgentRunsIdResume","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResumeAgentRun"}}}},"responses":{"200":{"description":"Resume a paused agent run (a person, signed in; supervised and delegated runs need a step-up)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRun"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session"}},"/v1/agent-runs/{id}/cancel":{"post":{"tags":["Migrations"],"summary":"Cancel an agent run, optionally revoking its MCP credential; committed changes are not reversed (use rollback)","operationId":"postVAgentRunsIdCancel","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelAgentRun"}}}},"responses":{"200":{"description":"Cancel an agent run, optionally revoking its MCP credential; committed changes are not reversed (use rollback)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRun"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/agent-runs/{id}/complete":{"post":{"tags":["Migrations"],"summary":"End an agent run as completed (the agent itself or its delegator)","operationId":"postVAgentRunsIdComplete","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteAgentRun"}}}},"responses":{"200":{"description":"End an agent run as completed (the agent itself or its delegator)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRun"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/organizations/{id}/migration-policy":{"get":{"tags":["Migrations"],"summary":"Organization initiation policy for connection workspaces (default for its services)","operationId":"getVOrganizationsIdMigrationPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Organization initiation policy for connection workspaces (default for its services)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InitiationPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"put":{"tags":["Migrations"],"summary":"Change the organization initiation policy (partial; null clears a field)","operationId":"putVOrganizationsIdMigrationPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateInitiationPolicy"}}}},"responses":{"200":{"description":"Change the organization initiation policy (partial; null clears a field)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InitiationPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/services/{id}/migration-policy":{"get":{"tags":["Migrations"],"summary":"Service initiation policy override (may only be stricter than the organization default)","operationId":"getVServicesIdMigrationPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[]},{"apiCredential":[]}],"responses":{"200":{"description":"Service initiation policy override (may only be stricter than the organization default)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InitiationPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"},"put":{"tags":["Migrations"],"summary":"Change the service initiation policy override (looser values are not applied)","operationId":"putVServicesIdMigrationPolicy","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"If-Match","in":"header","required":true,"description":"Current grant revision as an entity tag, e.g. \"3\".","schema":{"type":"string"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateInitiationPolicy"}}}},"responses":{"200":{"description":"Change the service initiation policy override (looser values are not applied)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InitiationPolicy"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"412":{"$ref":"#/components/responses/Problem412"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/billing/checkout-sessions":{"post":{"tags":["Billing"],"summary":"Start Stripe Checkout for a capacity band","operationId":"postVBillingCheckoutSessions","parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Same key and body replay the original response (Idempotent-Replayed: true); same key with a different body is 409.","schema":{"type":"string","maxLength":255}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCheckoutSession"}}}},"responses":{"201":{"description":"Start Stripe Checkout for a capacity band","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckoutSession"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"428":{"$ref":"#/components/responses/Problem428"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/billing/portal-sessions":{"post":{"tags":["Billing"],"summary":"Open the Stripe customer portal","operationId":"postVBillingPortalSessions","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatePortalSession"}}}},"responses":{"201":{"description":"Open the Stripe customer portal","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PortalSession"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/v1/adoption-events":{"post":{"tags":["Platform"],"summary":"Record an adoption milestone (no personal data)","operationId":"postVAdoptionEvents","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"cookieSession":[],"csrfToken":[]},{"apiCredential":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdoptionEvent"}}}},"responses":{"202":{"description":"Record an adoption milestone (no personal data)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdoptionRecorded"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"415":{"$ref":"#/components/responses/Problem415"},"422":{"$ref":"#/components/responses/Problem422"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"session_or_api_credential"}},"/webhooks/stripe":{"post":{"tags":["Platform"],"summary":"Stripe webhook ingress (signature verified on raw bytes)","operationId":"postWebhooksStripe","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[{"stripeSignature":[]}],"responses":{"200":{"description":"Stripe webhook ingress (signature verified on raw bytes)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebhookReceived"}}}},"401":{"$ref":"#/components/responses/Problem401"},"403":{"$ref":"#/components/responses/Problem403"},"404":{"$ref":"#/components/responses/Problem404"},"409":{"$ref":"#/components/responses/Problem409"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"stripe_signature"}},"/healthz":{"get":{"tags":["Platform"],"summary":"Liveness and deployment environment","operationId":"getHealthz","parameters":[{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[],"responses":{"200":{"description":"Liveness and deployment environment","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Healthz"}}}},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"none"}},"/pki/crl/{issuer}":{"get":{"tags":["Platform"],"summary":"Latest CRL for an issuing CA (DER, cacheable 5 minutes)","operationId":"getPkiCrlIssuer","parameters":[{"name":"issuer","in":"path","required":true,"schema":{"type":"string","pattern":"^[A-Za-z0-9_.-]{1,80}$"}},{"name":"traceparent","in":"header","required":false,"description":"W3C trace context; echoed (with a new span id) on the response.","schema":{"type":"string","pattern":"^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$"}}],"security":[],"responses":{"200":{"description":"Latest CRL for an issuing CA (DER, cacheable 5 minutes)","headers":{"X-Request-Id":{"description":"Request identifier; quote it to support.","schema":{"type":"string"}},"traceparent":{"description":"W3C trace context of this request.","schema":{"type":"string"}}},"content":{"application/pkix-crl":{"schema":{"type":"string"}}}},"404":{"$ref":"#/components/responses/Problem404"},"429":{"$ref":"#/components/responses/Problem429"},"503":{"$ref":"#/components/responses/Problem503"}},"x-mt-auth":"none"}}},"components":{"schemas":{"AcceptInvitation":{"title":"AcceptInvitation","type":"object","additionalProperties":false,"required":["token","consumer_org_id","workload"],"properties":{"token":{"type":"string","minLength":20,"maxLength":200},"consumer_org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"workload":{"type":"object","additionalProperties":false,"required":["name","attestation_kind"],"properties":{"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"},"attestation_kind":{"type":"string","enum":["sandbox_token","oidc_jwt"]},"issuer":{"type":"string","format":"uri","maxLength":300},"audience":{"type":"string","maxLength":200},"subject":{"type":"string","maxLength":300},"subject_uid":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"}}}}},"AccountErased":{"title":"AccountErased","type":"object","required":["erased","pseudonym","privacy_request_id"],"properties":{"erased":{"const":true},"pseudonym":{"type":"string","pattern":"^psn_[0-9a-f]{26}$"},"privacy_request_id":{"$ref":"#/components/schemas/PrivacyRequestId"},"organizations":{"type":"array","items":{"type":"object","required":["tenant_id","audit_rows_rewritten","digest_before","digest_after"],"properties":{"tenant_id":{"type":"string"},"audit_rows_rewritten":{"type":"integer"},"digest_before":{"type":"string"},"digest_after":{"type":"string"}}}},"audit_rows_rewritten":{"type":"integer"},"operation_id":{"$ref":"#/components/schemas/OperationId"}}},"AckAccepted":{"title":"AckAccepted","type":"object","required":["accepted","received_at"],"properties":{"accepted":{"const":true},"received_at":{"$ref":"#/components/schemas/Timestamp"}}},"AdapterList":{"title":"AdapterList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/AdapterManifestV1"}},"catalog_version":{"type":"string"},"runtime":{"type":"object","required":["name","downloads"],"properties":{"name":{"type":"string"},"version":{"type":"string"},"downloads":{"type":"array","items":{"type":"object","required":["os","arch","url"],"properties":{"os":{"type":"string"},"arch":{"type":"string"},"url":{"type":"string","format":"uri"}}}}}}}},"AdapterManifestV1":{"title":"AdapterManifestV1","description":"One adapter version: roles, delivery modes (G guided, C generated configuration, A approved automatic apply, O observation, V active validation), capabilities, least privilege and provenance. `platform_versions` lists explicitly tested versions only.","type":"object","required":["adapter_id","version","display_name","platform_versions","deployment_models","roles","modes","capabilities","permissions","evidence","limitations","status"],"properties":{"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"version":{"type":"string","pattern":"^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$","maxLength":40,"examples":["1.0.0"]},"display_name":{"type":"string","maxLength":120},"platform_versions":{"type":"array","maxItems":50,"items":{"type":"string","maxLength":80}},"deployment_models":{"type":"array","maxItems":10,"items":{"type":"string","maxLength":40,"pattern":"^[a-z][a-z0-9-]*$","examples":["managed","self-hosted","hybrid"]}},"roles":{"type":"array","minItems":1,"maxItems":3,"items":{"type":"string","enum":["client","tls_terminator","policy_enforcer"]}},"modes":{"type":"array","minItems":1,"maxItems":5,"items":{"type":"string","enum":["G","C","A","O","V"]}},"capabilities":{"type":"object","required":["inspect","generate","apply","verify","rollback","telemetry","revocation_enforcement","identity_authorization","parallel_trust"],"properties":{"inspect":{"type":"boolean"},"generate":{"type":"boolean"},"apply":{"type":"boolean"},"verify":{"type":"boolean"},"rollback":{"type":"boolean"},"telemetry":{"type":"boolean"},"revocation_enforcement":{"type":"string","enum":["native","external_authorizer","unsupported","unknown"]},"identity_authorization":{"type":"string","enum":["native","external_authorizer","unsupported","unknown"]},"parallel_trust":{"type":"string","enum":["supported","unsupported","unknown"]}}},"permissions":{"type":"object","required":["inspect","apply"],"properties":{"inspect":{"type":"array","maxItems":20,"items":{"type":"string","maxLength":400}},"apply":{"type":"array","maxItems":20,"items":{"type":"string","maxLength":400}}}},"evidence":{"type":"array","maxItems":50,"items":{"title":"Evidence","description":"Provenance for a claim: where it came from, when, for which platform version, and how certain it is.","type":"object","required":["source","timestamp","platform_version","confidence"],"properties":{"source":{"type":"string","maxLength":500},"timestamp":{"type":"string","format":"date-time"},"platform_version":{"type":"string","maxLength":80},"confidence":{"type":"string","enum":["V","D","R"]},"detail":{"type":"string","maxLength":1000}}}},"limitations":{"type":"array","maxItems":50,"items":{"type":"string","maxLength":1000}},"status":{"type":"string","enum":["implemented","guided","planned"],"description":"implemented: the runtime ships the adapter; guided: guided setup and validation."},"sectors":{"type":"array","maxItems":20,"items":{"type":"string","maxLength":80}},"docs":{"type":"string","maxLength":300},"confidence":{"type":"string","enum":["V","D","R"],"description":"Runtime metadata: matrix grade of the adapter (not shown to customers)."},"owner":{"type":"string","maxLength":200},"target_modes":{"type":"array","maxItems":5,"items":{"type":"string","enum":["G","C","A","O","V"]},"description":"Runtime metadata: the delivery target from the specification matrix."},"termination":{"type":"string","maxLength":300},"integration_point":{"type":"string","maxLength":1000},"product":{"type":"string","maxLength":120},"vendor":{"type":"string","maxLength":80},"summary":{"type":"string","maxLength":400}},"examples":[{"adapter_id":"nginx.oss.server","version":"1.0.0","display_name":"NGINX (open source) server block","platform_versions":["1.30.6"],"deployment_models":["self-hosted"],"roles":["tls_terminator","policy_enforcer"],"modes":["G","C","V","A"],"capabilities":{"inspect":true,"generate":true,"apply":true,"verify":true,"rollback":true,"telemetry":false,"revocation_enforcement":"external_authorizer","identity_authorization":"external_authorizer","parallel_trust":"supported"},"permissions":{"inspect":["read nginx.conf and every included file"],"apply":["write the file holding the target server block","run nginx -t"]},"evidence":[{"source":"https://nginx.org/en/docs/http/ngx_http_ssl_module.html","timestamp":"2026-11-14T00:00:00Z","platform_version":"1.30.6","confidence":"D"}],"limitations":[]}]},"AddBreakGlassOwner":{"title":"AddBreakGlassOwner","type":"object","additionalProperties":false,"required":["user_id"],"properties":{"user_id":{"type":"string","pattern":"^usr_[a-z0-9_]+$","maxLength":64}}},"AddDomain":{"title":"AddDomain","type":"object","additionalProperties":false,"required":["domain"],"properties":{"domain":{"type":"string","minLength":4,"maxLength":253}},"examples":[{"domain":"example.com"}]},"AddPasskey":{"title":"AddPasskey","type":"object","additionalProperties":false,"required":["credential"],"properties":{"credential":{"type":"object","required":["id","rawId","type","response"],"properties":{"id":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,1400}$"},"rawId":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,1400}$"},"type":{"const":"public-key"},"response":{"type":"object","required":["clientDataJSON","attestationObject"],"properties":{"clientDataJSON":{"type":"string","maxLength":4096},"attestationObject":{"type":"string","maxLength":16384},"transports":{"type":"array","maxItems":8,"items":{"type":"string","maxLength":32}}}}}},"name":{"type":"string","maxLength":60}}},"AdoptionEvent":{"title":"AdoptionEvent","type":"object","additionalProperties":false,"required":["milestone"],"properties":{"milestone":{"type":"string","enum":["demo_started","paired","enrolled","first_allow","first_deny","unattended_renewal"]},"cohort_id":{"type":"string","maxLength":64},"elapsed_ms":{"type":"integer","minimum":0},"connector_version":{"type":"string","maxLength":40},"error_code":{"type":"string","maxLength":64}}},"AdoptionRecorded":{"title":"AdoptionRecorded","type":"object","required":["recorded"],"properties":{"recorded":{"const":true}}},"AgentRun":{"title":"AgentRun","type":"object","required":["id","workspace_id","side","mode","state","agent_identity","delegator","policy_version","correlation_id","scope","expires_at","created_at"],"properties":{"id":{"$ref":"#/components/schemas/AgentRunId"},"workspace_id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"side":{"type":"string","enum":["owner","consumer"]},"org_id":{"$ref":"#/components/schemas/OrgId"},"mode":{"type":"string","enum":["observe","supervised","delegated"]},"state":{"type":"string","enum":["pending","running","paused","completed","cancelled","failed","expired"],"description":"expired is derived from expires_at."},"stored_state":{"type":"string","enum":["pending","running","paused","completed","cancelled","failed"]},"waiting_on":{"type":["string","null"],"description":"approval while a supervised run waits at an approval gate."},"state_reason":{"type":["string","null"]},"agent_identity":{"type":"object","required":["credential_id"],"properties":{"credential_id":{"type":"string","maxLength":64},"client_name":{"type":["string","null"]}}},"delegator":{"type":"object","required":["user_id"],"properties":{"user_id":{"type":"string","maxLength":64},"display_name":{"type":["string","null"]}}},"delegator_id":{"type":"string","maxLength":64},"policy_version":{"type":"string","maxLength":40},"correlation_id":{"type":"string","maxLength":64},"scope":{"type":"object","required":["tools","preauthorized_actions"],"properties":{"tools":{"type":"array","items":{"type":"string","enum":["connections.inspect","connections.assess","migrations.plan.create","migrations.plan.get","migrations.approvals.request","migrations.tasks.delegate","migrations.execute.prepare","migrations.execute.apply","migrations.validate","migrations.cutover.request","migrations.rollback.request","connections.diagnostics.read","migrations.handover.export"]}},"preauthorized_actions":{"type":"array","items":{"type":"string","enum":["execution.start","rollback"]}}}},"tool_version":{"type":"integer"},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"paused_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"paused_by":{"type":["string","null"]},"resumed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"ended_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"ended_by":{"type":["string","null"]},"credential_revoked_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"last_action_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"action_count":{"type":"integer"},"version":{"type":"integer"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"},"note":{"type":"string","maxLength":300},"pending_approval_request_ids":{"type":"array","items":{"$ref":"#/components/schemas/MigrationApprovalRequestId"},"description":"In the workspace view: approval requests this run raised that are still pending."}},"description":"An agent run: one agent identity bound by a person to one workspace side, a mode, a tool scope and an expiry. Pausing or cancelling stops the agent; it never reverses committed changes."},"AgentRunAction":{"title":"AgentRunAction","type":"object","required":["id","tool","call_class","method","route","outcome","status","request_id","created_at"],"properties":{"id":{"$ref":"#/components/schemas/AgentRunActionId"},"tool":{"type":"string","maxLength":64},"call_class":{"type":"string","enum":["read","draft","propose","gated","run"]},"method":{"type":"string","maxLength":10},"route":{"type":"string","maxLength":120},"resource_ref":{"type":["string","null"]},"outcome":{"type":"string","enum":["ok","refused","failed"]},"status":{"type":"integer"},"error_code":{"type":["string","null"]},"request_id":{"type":"string","maxLength":64},"idempotency_key":{"type":["string","null"]},"created_at":{"$ref":"#/components/schemas/Timestamp"}}},"AgentRunActionId":{"title":"AgentRunActionId","description":"Opaque identifier with prefix `ara_`.","type":"string","pattern":"^ara_[a-z0-9_]+$","maxLength":64,"examples":["ara_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"AgentRunActionList":{"title":"AgentRunActionList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/AgentRunAction"}},"next_cursor":{"type":["string","null"]}}},"AgentRunId":{"title":"AgentRunId","description":"Opaque identifier with prefix `agr_`.","type":"string","pattern":"^agr_[a-z0-9_]+$","maxLength":64,"examples":["agr_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"AgentRunList":{"title":"AgentRunList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/AgentRun"}}}},"ApiCredential":{"title":"ApiCredential","type":"object","required":["id","name","roles","expires_at","active"],"properties":{"id":{"$ref":"#/components/schemas/ApiCredentialId"},"name":{"type":"string"},"roles":{"type":"array","items":{"$ref":"#/components/schemas/CustomerRole"}},"prefix":{"type":"string"},"purpose":{"type":"string","enum":["automation","mcp"]},"expires_at":{"type":"string","format":"date-time"},"revoked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"last_used_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"created_at":{"type":"string","format":"date-time"},"created_by":{"type":["string","null"]},"high_risk_allowed":{"type":"boolean","description":"May make high-risk production changes (created from a stepped-up session, expires within 30 days)."},"active":{"type":"boolean"}}},"ApiCredentialCreated":{"title":"ApiCredentialCreated","type":"object","required":["id","secret","expires_at","roles","name"],"properties":{"id":{"$ref":"#/components/schemas/ApiCredentialId"},"secret":{"type":"string","pattern":"^mtk_","description":"Shown once; send as Authorization: Bearer <secret>."},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"roles":{"type":"array","items":{"$ref":"#/components/schemas/CustomerRole"}},"name":{"type":"string"},"high_risk_allowed":{"type":"boolean"},"note":{"type":"string"}}},"ApiCredentialId":{"title":"ApiCredentialId","description":"Opaque identifier with prefix `cred_`.","type":"string","pattern":"^cred_[a-z0-9_]+$","maxLength":64,"examples":["cred_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"ApiCredentialList":{"title":"ApiCredentialList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ApiCredential"}}}},"ApiCredentialRevoked":{"title":"ApiCredentialRevoked","type":"object","required":["id","active"],"properties":{"id":{"$ref":"#/components/schemas/ApiCredentialId"},"active":{"const":false}}},"ApprovalPolicy":{"title":"ApprovalPolicy","type":"object","required":["tenant_id","scope_type","scope_id","revision","fields","effective","floor","chain"],"properties":{"tenant_id":{"$ref":"#/components/schemas/OrgId"},"scope_type":{"$ref":"#/components/schemas/ApprovalScopeType"},"scope_id":{"type":"string"},"revision":{"type":"integer","minimum":0,"description":"If-Match revision of this scope (0: nothing is set here yet). Also the ETag."},"fields":{"type":"object","properties":{"min_approver_age_hours":{"type":"integer","minimum":0,"maximum":720},"require_second_approver":{"type":"boolean"},"require_step_up":{"type":"boolean"},"step_up_max_age_minutes":{"type":"integer","minimum":1,"maximum":60},"independence":{"type":"string","enum":["strict","standard"]}},"description":"What this scope sets; absent fields inherit."},"effective":{"$ref":"#/components/schemas/ApprovalPolicySummary"},"floor":{"type":"object","required":["policy","sources"],"properties":{"policy":{"$ref":"#/components/schemas/ApprovalPolicyV1"},"sources":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/ApprovalPolicySource"}}},"description":"The staff floor (built-in defaults, platform and tenant): values here may only be tightened."},"clamped":{"type":"array","description":"Values set at this or an enclosing customer scope that are looser than the floor and are not applied.","items":{"type":"object","required":["field","scope_type","scope_id"],"properties":{"field":{"type":"string"},"scope_type":{"$ref":"#/components/schemas/ApprovalScopeType"},"scope_id":{"type":"string"}}}},"chain":{"type":"array","description":"Every scope that encloses this one, outermost first, with what each sets.","items":{"type":"object","required":["scope_type","scope_id","revision","fields"],"properties":{"scope_type":{"$ref":"#/components/schemas/ApprovalScopeType"},"scope_id":{"type":"string"},"revision":{"type":"integer","minimum":0},"fields":{"type":"object","properties":{"min_approver_age_hours":{"type":"integer","minimum":0,"maximum":720},"require_second_approver":{"type":"boolean"},"require_step_up":{"type":"boolean"},"step_up_max_age_minutes":{"type":"integer","minimum":1,"maximum":60},"independence":{"type":"string","enum":["strict","standard"]}}},"updated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}}},"can_edit":{"type":"boolean"},"step_up_required_to_loosen":{"type":"boolean","description":"Relaxing a production scope needs a browser session re-authenticated within 15 minutes."},"updated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}},"description":"One scope's approval policy: what it sets, the effective result for the approvals it governs and where each value comes from. Organization owners and trust administrators can change space, service and integration scopes."},"ApprovalPolicySource":{"title":"ApprovalPolicySource","type":"object","required":["scope_type","scope_id"],"properties":{"scope_type":{"type":"string","enum":["default","platform","tenant","space","service","integration"]},"scope_id":{"type":["string","null"]}},"description":"Where an effective value comes from; 'default' is the built-in behaviour of the approval context."},"ApprovalPolicySummary":{"title":"ApprovalPolicySummary","type":"object","required":["context","policy","source","sources"],"properties":{"context":{"type":"string","enum":["staff_dual_control","integration_plan","grant_review","high_risk_change","migration_approval"]},"policy":{"$ref":"#/components/schemas/ApprovalPolicyV1"},"source":{"$ref":"#/components/schemas/ApprovalPolicySource"},"sources":{"type":"object","description":"Source of each effective field.","required":["min_approver_age_hours","require_second_approver","require_step_up","step_up_max_age_minutes","independence"],"additionalProperties":{"$ref":"#/components/schemas/ApprovalPolicySource"}}},"description":"The resolved approval policy an approval was checked against, with the scope each value came from."},"ApprovalPolicyUpdatedDataV1":{"title":"ApprovalPolicyUpdatedDataV1","type":"object","required":["scope_type","scope_id","revision","changed"],"properties":{"scope_type":{"type":"string","enum":["tenant","space","service","integration"]},"scope_id":{"type":"string","pattern":"^(org|spc|svc|int)_[a-z0-9_]+$","maxLength":64},"revision":{"type":"integer","minimum":1},"changed":{"type":"array","items":{"type":"string","enum":["min_approver_age_hours","require_second_approver","require_step_up","step_up_max_age_minutes","independence"]}}}},"ApprovalPolicyV1":{"title":"ApprovalPolicyV1","type":"object","required":["min_approver_age_hours","require_second_approver","require_step_up","step_up_max_age_minutes","independence"],"properties":{"min_approver_age_hours":{"type":"integer","minimum":0,"maximum":720,"description":"Minimum approver age in hours: staff enrollment age, or the approver's membership age in the organization."},"require_second_approver":{"type":"boolean","description":"A different eligible person than the requester must approve."},"require_step_up":{"type":"boolean","description":"The approver must have re-authenticated with a passkey or the identity provider recently."},"step_up_max_age_minutes":{"type":"integer","minimum":1,"maximum":60,"description":"How recent that re-authentication must be."},"independence":{"type":"string","enum":["strict","standard"],"description":"strict: no exemption when no other eligible approver exists (staff: the two people may not be linked by an invitation). standard: a sole eligible member may approve alone."}},"examples":[{"min_approver_age_hours":24,"require_second_approver":true,"require_step_up":true,"step_up_max_age_minutes":15,"independence":"strict"}]},"ApprovalRecord":{"title":"ApprovalRecord","type":"object","required":["id","plan_hash","decision","approver","created_at"],"properties":{"id":{"$ref":"#/components/schemas/IntegrationApprovalId"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"decision":{"type":"string","enum":["approved","rejected"]},"approver":{"title":"UserRef","type":"object","required":["user_id"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"auth_method":{"type":"string"},"via":{"type":"string","enum":["session","api_key"]}}},"reason":{"type":["string","null"]},"step_up_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"expires_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"created_at":{"$ref":"#/components/schemas/Timestamp"}},"description":"A recorded decision on one plan hash. Approved decisions can be exchanged for approval JWSs until expires_at."},"ApprovalScopeType":{"title":"ApprovalScopeType","description":"Approval policy scope, outermost first: platform and tenant are staff-set floors; space, service and integration are set by the organization.","type":"string","enum":["platform","tenant","space","service","integration"]},"ApprovalToken":{"title":"ApprovalToken","type":"object","required":["approval_jws","plan_hash","kid","expires_at"],"properties":{"approval_jws":{"$ref":"#/components/schemas/Jws"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"kid":{"$ref":"#/components/schemas/KeyVersionId"},"approver":{"type":"string"},"issued_at":{"$ref":"#/components/schemas/Timestamp"},"expires_at":{"$ref":"#/components/schemas/Timestamp"}},"description":"An ES256 approval JWS (ApprovalV1 claims) for one plan hash. Fetch a fresh one for each apply; each lasts at most one hour."},"ApproveGrant":{"title":"ApproveGrant","type":"object","additionalProperties":false,"properties":{"note":{"type":"string","maxLength":500}}},"ApprovePairing":{"title":"ApprovePairing","type":"object","additionalProperties":false,"required":["code","name"],"properties":{"code":{"type":"string","pattern":"^[A-Z0-9]{4}-?[A-Z0-9]{4}$"},"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"}}},"ApprovePlan":{"title":"ApprovePlan","type":"object","additionalProperties":false,"properties":{"note":{"type":"string","maxLength":500}}},"ApproveWorkloadIssuer":{"title":"ApproveWorkloadIssuer","type":"object","additionalProperties":false,"required":["issuer_url","jwks_uri"],"properties":{"issuer_url":{"type":"string","format":"uri","pattern":"^https://"},"jwks_uri":{"type":"string","format":"uri","pattern":"^https://"}}},"AssignRole":{"title":"AssignRole","type":"object","additionalProperties":false,"required":["user_id","role"],"properties":{"user_id":{"type":"string","pattern":"^usr_[a-z0-9_]+$","maxLength":64},"role":{"type":"string","enum":["owner","trust_admin","service_owner","partner_admin","billing_admin","auditor"]}}},"AttestServerTls":{"title":"AttestServerTls","type":"object","additionalProperties":false,"required":["tls_mode"],"properties":{"tls_mode":{"type":"string","enum":["gateway_terminated","load_balancer_terminated","origin_terminated"]},"certificate_not_after":{"type":"string","format":"date-time","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"},"note":{"type":"string","maxLength":500}}},"AuditEvent":{"title":"AuditEvent","type":"object","required":["id","actor_type","actor_id","action","resource_type","resource_id","created_at"],"properties":{"id":{"$ref":"#/components/schemas/AuditEventId"},"actor_type":{"type":"string","enum":["user","workload","gateway","staff","system","provider"]},"actor_id":{"type":"string"},"action":{"type":"string"},"resource_type":{"type":"string"},"resource_id":{"type":"string"},"resource_revision":{"type":["integer","null"]},"reason":{"type":["string","null"]},"operation_id":{"type":["string","null"]},"request_id":{"type":["string","null"]},"environment":{"type":["string","null"]},"detail":{},"created_at":{"type":"string","format":"date-time"}}},"AuditEventId":{"title":"AuditEventId","description":"Opaque identifier with prefix `aud_`.","type":"string","pattern":"^aud_[a-z0-9_]+$","maxLength":64,"examples":["aud_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"AuditEventPage":{"title":"AuditEventPage","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/AuditEvent"}},"next_cursor":{"type":["string","null"],"description":"Pass as ?before= for the next page; null at the end."}}},"AuditExport":{"title":"AuditExport","type":"object","required":["schema","tenant_id","generated_at","range","row_count","rows"],"properties":{"schema":{"const":"mt.audit_export.v1"},"tenant_id":{"$ref":"#/components/schemas/OrgId"},"generated_at":{"$ref":"#/components/schemas/Timestamp"},"range":{"type":"object","required":["from","to"],"properties":{"from":{"type":["string","null"]},"to":{"type":["string","null"]}}},"row_count":{"type":"integer"},"rows":{"type":"array","items":{"$ref":"#/components/schemas/AuditEvent"}}},"description":"Canonical JSON; the x-content-sha256 response header is the SHA-256 of the exact body."},"AuthorizeMcp":{"title":"AuthorizeMcp","type":"object","additionalProperties":false,"required":["request_id","org_id","roles"],"properties":{"request_id":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,128}$"},"org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"roles":{"type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string","enum":["owner","trust_admin","service_owner","partner_admin","billing_admin","auditor"]}},"client_name":{"type":"string","maxLength":120}}},"AuthorizeWorkspace":{"title":"AuthorizeWorkspace","type":"object","additionalProperties":false,"required":["service_id"],"properties":{"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64},"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64},"invitation_id":{"type":"string","pattern":"^inv_[a-z0-9_]+$","maxLength":64}}},"BillingReconcileRequestedDataV1":{"title":"BillingReconcileRequestedDataV1","type":"object","properties":{"tenant_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64}}},"BillingSummary":{"title":"BillingSummary","type":"object","required":["configured","mode","subscription","usage","invoices","plans","grace_days"],"properties":{"configured":{"type":"boolean"},"mode":{"type":"string","enum":["test","live"]},"subscription":{"anyOf":[{"type":"object","required":["id","entitlement_state","connections"],"properties":{"id":{"$ref":"#/components/schemas/SubscriptionId"},"stripe_status":{"type":"string"},"entitlement_state":{"type":"string","enum":["active","grace","blocked","ended"]},"connections":{"type":"integer"},"current_period_end":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"grace_ends_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"cancel_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"currency":{"$ref":"#/components/schemas/Currency"},"plan_name":{"type":"string"},"unit_amount":{"type":"integer"},"interval":{"type":"string"}}},{"type":"null"}]},"usage":{"type":"object","required":["used","capacity","remaining"],"properties":{"used":{"type":"integer"},"capacity":{"type":"integer"},"remaining":{"type":"integer"}}},"invoices":{"type":"array","items":{"type":"object","required":["status","currency","total"],"properties":{"number":{"type":["string","null"]},"status":{"type":"string"},"currency":{"$ref":"#/components/schemas/Currency"},"total":{"type":"integer"},"amount_remaining":{"type":"integer"},"due_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"paid_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"hosted_invoice_url":{"type":["string","null"]},"issued_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}}},"plans":{"type":"array","items":{"type":"object","required":["sku","name","connections","unit_amount","currency"],"properties":{"sku":{"type":"string"},"name":{"type":"string"},"connections":{"type":"integer"},"unit_amount":{"type":"integer"},"currency":{"$ref":"#/components/schemas/Currency"},"interval":{"type":"string"}}}},"grace_days":{"type":"integer"},"note":{"type":"string"}}},"CancelAgentRun":{"title":"CancelAgentRun","type":"object","additionalProperties":false,"properties":{"reason":{"type":"string","maxLength":200},"revoke_credential":{"type":"boolean","description":"Also revoke the agent MCP credential (it stops working everywhere)."}}},"CancelOwnerRecovery":{"title":"CancelOwnerRecovery","type":"object","additionalProperties":false,"properties":{"reason":{"type":"string","maxLength":500}}},"Certificate":{"title":"Certificate","type":"object","required":["id","serial_hex","state","not_after"],"properties":{"id":{"$ref":"#/components/schemas/CertificateId"},"serial_hex":{"type":"string","pattern":"^[0-9a-f]+$"},"fingerprint":{"type":"string"},"not_before":{"type":"string","format":"date-time"},"not_after":{"type":"string","format":"date-time"},"renew_after":{"type":"string","format":"date-time"},"state":{"$ref":"#/components/schemas/CertificateState"},"revoked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"revocation_reason":{"type":["string","null"]},"predecessor_id":{"anyOf":[{"$ref":"#/components/schemas/CertificateId"},{"type":"null"}]},"reload_confirmed_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"issuer_id":{"$ref":"#/components/schemas/IssuerId"},"created_at":{"type":"string","format":"date-time"}}},"CertificateId":{"title":"CertificateId","description":"Opaque identifier with prefix `crt_`.","type":"string","pattern":"^crt_[a-z0-9_]+$","maxLength":64,"examples":["crt_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"CertificateIssued":{"title":"CertificateIssued","type":"object","required":["state","certificate_id","grant_id","principal","serial","not_after","certificate_pem","chain_pem","root_pem"],"properties":{"state":{"const":"issued"},"issuance_request_id":{"$ref":"#/components/schemas/IssuanceRequestId"},"certificate_id":{"$ref":"#/components/schemas/CertificateId"},"grant_id":{"$ref":"#/components/schemas/GrantId"},"principal":{"type":"string"},"serial":{"type":"string"},"fingerprint":{"type":"string"},"not_before":{"type":"string","format":"date-time"},"not_after":{"type":"string","format":"date-time"},"renewal_hint":{"type":"object","required":["renew_after"],"properties":{"renew_after":{"type":"string","format":"date-time"},"strategy":{"type":"string"}}},"certificate_pem":{"$ref":"#/components/schemas/Pem"},"chain_pem":{"$ref":"#/components/schemas/Pem"},"root_pem":{"$ref":"#/components/schemas/Pem"},"root_fingerprint":{"type":"string"},"ignored_csr_extensions":{"type":"array","items":{"type":"string"}},"note":{"type":"string"}}},"CertificateIssuedDataV1":{"title":"CertificateIssuedDataV1","type":"object","required":["certificate_id","grant_id","service_id","serial"],"properties":{"certificate_id":{"type":"string","pattern":"^crt_[a-z0-9_]+$","maxLength":64},"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64},"serial":{"type":"string","pattern":"^[0-9a-f]+$"}}},"CertificateRevoked":{"title":"CertificateRevoked","type":"object","required":["certificate_id","state","operation_id","effective_control_plane_time"],"properties":{"certificate_id":{"$ref":"#/components/schemas/CertificateId"},"state":{"const":"revoked"},"operation_id":{"$ref":"#/components/schemas/OperationId"},"effective_control_plane_time":{"$ref":"#/components/schemas/Timestamp"}}},"CertificateRevokedDataV1":{"title":"CertificateRevokedDataV1","type":"object","required":["certificate_id","service_id","serial"],"properties":{"certificate_id":{"type":"string","pattern":"^crt_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64},"serial":{"type":"string","pattern":"^[0-9a-f]+$"},"issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64}}},"CertificateState":{"title":"CertificateState","type":"string","enum":["issued","revoked"]},"CheckoutOperationId":{"title":"CheckoutOperationId","description":"Opaque identifier with prefix `chk_`.","type":"string","pattern":"^chk_[a-z0-9_]+$","maxLength":64,"examples":["chk_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"CheckoutSession":{"title":"CheckoutSession","type":"object","required":["operation_id","url","mode"],"properties":{"operation_id":{"$ref":"#/components/schemas/CheckoutOperationId"},"url":{"type":"string","format":"uri"},"mode":{"type":"string","enum":["test","live"]}}},"ClaimDelegatedTask":{"title":"ClaimDelegatedTask","type":"object","additionalProperties":false,"required":["token"],"properties":{"token":{"type":"string","pattern":"^mttask_[A-Za-z0-9_-]{20,}$","maxLength":120}}},"CompleteAgentRun":{"title":"CompleteAgentRun","type":"object","additionalProperties":false,"properties":{"summary":{"type":"string","maxLength":2000}}},"CompleteEnrollment":{"title":"CompleteEnrollment","type":"object","additionalProperties":false,"required":["csr","proof"],"properties":{"challenge":{"type":"string","maxLength":200},"csr":{"type":"string","minLength":100,"maxLength":8000},"proof":{"type":"string","minLength":40,"maxLength":200}}},"ConfigureSso":{"title":"ConfigureSso","description":"Organization OIDC identity provider. The issuer must be public https; discovery is fetched without redirects.","type":"object","additionalProperties":false,"required":["issuer","client_id","domains"],"properties":{"issuer":{"type":"string","format":"uri","pattern":"^https://","maxLength":300},"client_id":{"type":"string","minLength":1,"maxLength":200,"pattern":"^[\\x21-\\x7e]+$"},"client_secret":{"type":["string","null"],"minLength":1,"maxLength":512,"description":"Stored sealed (never returned). Omit to keep the stored secret; null for a public client (PKCE only)."},"domains":{"type":"array","minItems":1,"maxItems":10,"uniqueItems":true,"items":{"type":"string","minLength":4,"maxLength":253},"description":"Verified domains of the organization whose email addresses sign in through this IdP."}},"examples":[{"issuer":"https://example.okta.com","client_id":"0oa1example","client_secret":"redacted","domains":["example.com"]}]},"ConfirmReload":{"title":"ConfirmReload","type":"object","additionalProperties":false,"required":["proof","timestamp"],"properties":{"proof":{"type":"string","minLength":40,"maxLength":200},"timestamp":{"type":"integer"}}},"ConnectionWorkspace":{"title":"ConnectionWorkspace","type":"object","required":["id","status","environment","name","endpoint","view","participants","version","created_at","updated_at"],"properties":{"id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"status":{"type":"string","enum":["draft","discovery","plan_ready","awaiting_approvals","approved","staging","validating","cutover_pending","active","blocked","failed","rollback_pending","rolled_back","cancelled"]},"status_reason":{"type":["string","null"]},"blocked_from":{"type":["string","null"]},"environment":{"$ref":"#/components/schemas/Environment"},"name":{"type":"string","maxLength":120},"endpoint":{"type":"object","required":["hostname","port"],"properties":{"hostname":{"type":"string","maxLength":253},"port":{"type":"integer"}}},"view":{"type":"string","enum":["owner","consumer","delegate"],"description":"Which role-scoped view this is."},"proposal":{"type":"string","enum":["authorized","proposed","private"]},"execution_mode":{"type":"string","enum":["guided","automated","agent"]},"participants":{"type":"array","items":{"type":"object","required":["side","org_id","name"],"properties":{"side":{"type":"string","enum":["owner","consumer"]},"org_id":{"anyOf":[{"$ref":"#/components/schemas/OrgId"},{"type":"null"}]},"name":{"type":"string","maxLength":200},"you":{"type":"boolean"}}}},"resource":{"anyOf":[{"type":"object","required":["service_id","name"],"properties":{"service_id":{"$ref":"#/components/schemas/ServiceId"},"name":{"type":"string","maxLength":200}}},{"type":"null"}]},"relationship":{"type":"object","required":[],"properties":{"invitation_id":{"anyOf":[{"$ref":"#/components/schemas/InvitationId"},{"type":"null"}]},"grant_id":{"anyOf":[{"$ref":"#/components/schemas/GrantId"},{"type":"null"}]},"grant_state":{"type":["string","null"]}}},"integration_id":{"anyOf":[{"$ref":"#/components/schemas/IntegrationId"},{"type":"null"}]},"current_plan":{"anyOf":[{"type":"object","required":["id","version","plan_hash","status"],"properties":{"id":{"$ref":"#/components/schemas/MigrationPlanId"},"version":{"type":"integer"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"status":{"type":"string","maxLength":20}}},{"type":"null"}]},"latest_assessment":{"anyOf":[{"$ref":"#/components/schemas/MigrationAssessment"},{"type":"null"}]},"current_execution":{"anyOf":[{"type":"object","required":["id","state"],"properties":{"id":{"$ref":"#/components/schemas/MigrationExecutionId"},"state":{"type":"string","maxLength":20},"waiting_on":{}}},{"type":"null"}]},"approvals":{"type":"array","items":{"$ref":"#/components/schemas/MigrationApproval"}},"delegated_tasks":{"type":"array","items":{"$ref":"#/components/schemas/DelegatedTask"}},"shared_status":{"type":"object","description":"The status both sides see, deliberately published and redacted."},"certificates":{"type":"array","items":{"type":"object","required":["certificate_id","state","not_after"],"properties":{"certificate_id":{"$ref":"#/components/schemas/CertificateId"},"serial":{"type":"string","maxLength":80},"state":{"type":"string","maxLength":20},"not_after":{"$ref":"#/components/schemas/Timestamp"}}}},"health":{"type":"object","required":[],"properties":{"last_receipt_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"receipts_24h":{"type":"object","required":[],"properties":{"allow":{"type":"integer"},"deny":{"type":"integer"}}},"telemetry":{"type":"string","maxLength":300,"description":"Coverage and freshness of observed traffic; never fabricated."}}},"metrics":{"type":"object","required":[],"properties":{"human_touches":{"type":"integer"},"first_assessment_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"first_plan_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"activated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}},"delegate_scope":{"type":"array","items":{"type":"string","enum":["discovery.read","evidence.upload"]}},"agent_runs":{"type":"array","items":{"$ref":"#/components/schemas/AgentRun"},"description":"Agent runs of your sides on this workspace."},"approval_requests":{"type":"array","items":{"$ref":"#/components/schemas/MigrationApprovalRequest"},"description":"Approval requests for the current plan, pending first."},"version":{"type":"integer"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"}},"description":"A connection workspace, in the view the caller is entitled to (owner, consumer or delegate). Nothing of the other side is shown unless published."},"ConnectionWorkspaceId":{"title":"ConnectionWorkspaceId","description":"Opaque identifier with prefix `cws_`.","type":"string","pattern":"^cws_[a-z0-9_]+$","maxLength":64,"examples":["cws_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"ConnectionWorkspaceList":{"title":"ConnectionWorkspaceList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ConnectionWorkspace"}}}},"CreateAgentRun":{"title":"CreateAgentRun","type":"object","additionalProperties":false,"required":["agent_credential_id","mode"],"properties":{"agent_credential_id":{"type":"string","pattern":"^cred_[a-z0-9_]+$","maxLength":64,"description":"The agent identity: an MCP connection credential you created for the organization on the run side."},"mode":{"type":"string","enum":["observe","supervised","delegated"],"description":"observe (read and preview only), supervised (acts within the approved plan, waits at approval gates) or delegated (also uses standing approvals for preauthorized actions)."},"side":{"type":"string","enum":["owner","consumer"],"description":"The side the agent acts for (default: your side)."},"tools":{"type":"array","minItems":1,"maxItems":13,"uniqueItems":true,"items":{"type":"string","enum":["connections.inspect","connections.assess","migrations.plan.create","migrations.plan.get","migrations.approvals.request","migrations.tasks.delegate","migrations.execute.prepare","migrations.execute.apply","migrations.validate","migrations.cutover.request","migrations.rollback.request","connections.diagnostics.read","migrations.handover.export"]},"description":"Tool scope (default: every tool the mode allows)."},"preauthorized_actions":{"type":"array","maxItems":2,"uniqueItems":true,"items":{"type":"string","enum":["execution.start","rollback"]},"description":"Delegated mode only: non-mandatory actions the run may perform with a standing organization approval."},"expires_in_hours":{"type":"integer","minimum":1,"maximum":720,"description":"At most 720 (observe), 168 (supervised) or 24 (delegated)."},"note":{"type":"string","maxLength":200}}},"CreateApiCredential":{"title":"CreateApiCredential","type":"object","additionalProperties":false,"required":["name","roles"],"properties":{"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"},"roles":{"type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string","enum":["owner","trust_admin","service_owner","partner_admin","billing_admin","auditor"]}},"expires_in_days":{"type":"integer","minimum":1,"maximum":365},"high_risk_allowed":{"type":"boolean","description":"Allow high-risk production changes. Needs a stepped-up session; the credential expires within 30 days."}}},"CreateApprovalRequests":{"title":"CreateApprovalRequests","type":"object","additionalProperties":false,"required":["plan_hash"],"properties":{"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"requests":{"type":"array","minItems":1,"maxItems":20,"items":{"type":"object","additionalProperties":false,"required":["permission_kind","side","action","target_ref"],"properties":{"permission_kind":{"type":"string","enum":["request","identity_proof","trust_anchor_acceptance","resource_authorization","configuration_execution","production_cutover"]},"side":{"type":"string","enum":["owner","consumer"]},"action":{"type":"string","enum":["plan.approve","execution.start","step.execute","cutover","rollback"]},"target_ref":{"type":"string","pattern":"^[a-z_]+:[A-Za-z0-9_.:-]+$","maxLength":160}}},"description":"Approvals to ask for (default: every outstanding approval of the plan)."},"reason":{"type":"string","maxLength":500}}},"CreateCheckoutSession":{"title":"CreateCheckoutSession","type":"object","additionalProperties":false,"required":["org_id","sku"],"properties":{"org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"sku":{"type":"string","enum":["team_10","team_50"]}}},"CreateDelegatedTask":{"title":"CreateDelegatedTask","type":"object","additionalProperties":false,"required":["assignee_email"],"properties":{"assignee_email":{"type":"string","format":"email","maxLength":254},"scope":{"type":"array","minItems":1,"maxItems":2,"uniqueItems":true,"items":{"type":"string","enum":["discovery.read","evidence.upload"]}},"expires_in_hours":{"type":"integer","minimum":1,"maximum":168},"instructions":{"type":"string","maxLength":1000}}},"CreateEnrollment":{"title":"CreateEnrollment","type":"object","additionalProperties":false,"required":["attestation"],"properties":{"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64},"workload_id":{"type":"string","pattern":"^wl_[a-z0-9_]+$","maxLength":64},"attestation":{"type":"object","additionalProperties":false,"required":["kind","token"],"properties":{"kind":{"type":"string","enum":["sandbox_token","oidc_jwt"]},"token":{"type":"string","minLength":20,"maxLength":8000}}}}},"CreateEnrollmentToken":{"title":"CreateEnrollmentToken","type":"object","additionalProperties":false,"required":["grant_id"],"properties":{"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64}}},"CreateExportGrant":{"title":"CreateExportGrant","type":"object","additionalProperties":false,"required":["user_id","expires_in_hours"],"properties":{"user_id":{"type":"string","pattern":"^usr_[a-z0-9_]+$","maxLength":64},"expires_in_hours":{"type":"integer","minimum":1,"maximum":168}}},"CreateInvitation":{"title":"CreateInvitation","type":"object","additionalProperties":false,"required":["consumer","scope"],"properties":{"consumer":{"type":"object","additionalProperties":false,"properties":{"org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"org_handle":{"type":"string","pattern":"^[a-z0-9]+(-[a-z0-9]+)*$","minLength":6,"maxLength":64},"new_org_name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"}},"oneOf":[{"required":["org_id"]},{"required":["org_handle"]},{"required":["new_org_name"]}]},"scope":{"type":"object","additionalProperties":false,"required":["routes"],"properties":{"v":{"const":1},"routes":{"type":"array","minItems":1,"maxItems":50,"items":{"type":"object","additionalProperties":false,"required":["methods","path"],"properties":{"methods":{"type":"array","minItems":1,"maxItems":7,"items":{"type":"string","enum":["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"]},"uniqueItems":true},"path":{"type":"string","pattern":"^/[A-Za-z0-9._~\\-/]*(/\\*)?$","maxLength":200}}}}}},"expires_in_hours":{"type":"integer","minimum":1,"maximum":720},"grant_expires_at":{"type":"string","format":"date-time"}}},"CreateMigrationPlan":{"title":"CreateMigrationPlan","type":"object","additionalProperties":false,"properties":{"assessment_id":{"type":"string","pattern":"^mas_[a-z0-9_]+$","maxLength":64},"execution_mode":{"type":"string","enum":["guided","automated","agent"]},"cutover_strategy":{"type":"string","enum":["parallel_trust","maintenance_window"]},"retire_old_trust":{"type":"boolean"}}},"CreateOrganization":{"title":"CreateOrganization","type":"object","additionalProperties":false,"required":["name"],"properties":{"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"},"data_region":{"type":"string","pattern":"^[a-z]{2,12}$","description":"Data region of the organization. Only `us` is offered today (one D1 database, location hint ENAM); others are refused with region_unsupported."}}},"CreateOriginCheck":{"title":"CreateOriginCheck","type":"object","additionalProperties":false,"required":["origin_url"],"properties":{"origin_url":{"type":"string","minLength":8,"maxLength":2000,"pattern":"^https?://"}}},"CreateOwnerRecovery":{"title":"CreateOwnerRecovery","description":"Owner recovery when every owner is locked out: a verified domain of the organization and a contact attestation.","type":"object","additionalProperties":false,"required":["domain","contact_name","contact_title","contact_email","attestation"],"properties":{"domain":{"type":"string","minLength":4,"maxLength":253},"contact_name":{"type":"string","minLength":2,"maxLength":120,"pattern":"\\S"},"contact_title":{"type":"string","minLength":2,"maxLength":120,"pattern":"\\S"},"contact_email":{"type":"string","maxLength":254,"pattern":"^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$"},"contact_phone":{"type":"string","maxLength":40,"pattern":"^[+0-9 ().-]{6,40}$"},"attestation":{"type":"string","minLength":20,"maxLength":2000,"description":"Why every owner is locked out and why the signed-in person should become an owner."}}},"CreatePairing":{"title":"CreatePairing","type":"object","additionalProperties":false,"required":["gateway_public_jwk"],"properties":{"gateway_public_jwk":{"type":"object","additionalProperties":true,"required":["kty","crv","x","y"],"properties":{"kty":{"const":"EC"},"crv":{"const":"P-256"},"x":{"type":"string"},"y":{"type":"string"}}},"connector_version":{"type":"string","maxLength":40}}},"CreatePortalSession":{"title":"CreatePortalSession","type":"object","additionalProperties":false,"required":["org_id"],"properties":{"org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64}}},"CreateScimToken":{"title":"CreateScimToken","type":"object","additionalProperties":false,"required":["name"],"properties":{"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"}}},"CreateService":{"title":"CreateService","type":"object","additionalProperties":false,"required":["space_id","name","route_templates"],"properties":{"space_id":{"type":"string","pattern":"^spc_[a-z0-9_]+$","maxLength":64},"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"},"contact":{"type":"string","maxLength":200},"grant_approval":{"type":"string","enum":["automatic","sponsor_review"]},"route_templates":{"type":"array","minItems":1,"maxItems":50,"items":{"type":"object","additionalProperties":false,"required":["name","methods","path"],"properties":{"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"},"methods":{"type":"array","minItems":1,"maxItems":7,"items":{"type":"string","enum":["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"]},"uniqueItems":true},"path":{"type":"string","pattern":"^/[A-Za-z0-9._~\\-/]*(/\\*)?$","maxLength":200},"restricted":{"type":"boolean"}}}}}},"CreateSpace":{"title":"CreateSpace","type":"object","additionalProperties":false,"required":["org_id","name","environment"],"properties":{"org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"},"environment":{"type":"string","enum":["sandbox","production"]}}},"CreateSupportGrant":{"title":"CreateSupportGrant","type":"object","additionalProperties":false,"required":["staff_email","action","reason_code","expires_in_hours"],"properties":{"staff_email":{"type":"string","format":"email","maxLength":200,"pattern":"^[^@\\s]+@[^@\\s]+$"},"action":{"type":"string","enum":["audit.detail","invitation.resend"]},"reason_code":{"type":"string","enum":["customer_request","incident","diagnostics"]},"expires_in_hours":{"type":"integer","minimum":1,"maximum":72}}},"CreateWorkspace":{"title":"CreateWorkspace","type":"object","additionalProperties":false,"required":["org_id","environment","endpoint"],"properties":{"org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64,"description":"The organization creating the workspace (owner or consumer side)."},"name":{"type":"string","maxLength":120,"minLength":1,"pattern":"^[^\\u0000-\\u001f<>]+$"},"environment":{"type":"string","enum":["sandbox","production"]},"endpoint":{"type":"object","additionalProperties":false,"required":["hostname"],"properties":{"hostname":{"type":"string","minLength":1,"maxLength":253,"pattern":"^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$"},"port":{"type":"integer","minimum":1,"maximum":65535}}},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64,"description":"Owner side: the resource (service) this connection reaches."},"consumer_org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64,"description":"Owner side: the partner organization, when known."},"owner_handle":{"type":"string","pattern":"^[a-z0-9]+(-[a-z0-9]+)*$","minLength":6,"maxLength":64,"description":"Consumer side: the owner partner handle."},"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64},"invitation_id":{"type":"string","pattern":"^inv_[a-z0-9_]+$","maxLength":64},"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"execution_mode":{"type":"string","enum":["guided","automated","agent"]}}},"Currency":{"title":"Currency","description":"Lowercase ISO 4217 code.","type":"string","pattern":"^[a-z]{3}$","examples":["usd"]},"CustomerRole":{"title":"CustomerRole","type":"string","enum":["owner","trust_admin","service_owner","partner_admin","billing_admin","auditor"]},"DataGovernance":{"title":"DataGovernance","type":"object","required":["org_id","data_region","retention","deletion_suspended"],"properties":{"org_id":{"$ref":"#/components/schemas/OrgId"},"data_region":{"type":"string"},"data_region_detail":{"type":"object","required":["label","hosting"],"properties":{"label":{"type":"string"},"hosting":{"type":"string"},"gcp":{"type":"string"},"supported_regions":{"type":"array","items":{"type":"string"}}}},"retention":{"type":"object","required":["receipt_days","audit_months","bounds"],"properties":{"receipt_days":{"type":"integer"},"audit_months":{"type":"integer"},"receipt_days_custom":{"type":["integer","null"]},"audit_months_custom":{"type":["integer","null"]},"webhook_payload_days":{"type":"integer"},"bounds":{"type":"object"},"revision":{"type":"integer"},"updated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}},"deletion_suspended":{"type":"boolean","description":"True while a legal hold suspends deletion (no details are shown)."},"terminated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"backups":{"type":"string"}}},"DelegatedTask":{"title":"DelegatedTask","type":"object","required":["id","workspace_id","state","scope","expires_at"],"properties":{"id":{"$ref":"#/components/schemas/DelegatedTaskId"},"workspace_id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"side":{"type":"string","maxLength":20},"state":{"type":"string","enum":["pending","active","completed","revoked","expired"]},"scope":{"type":"array","items":{"type":"string","enum":["discovery.read","evidence.upload"]}},"assignee_email":{"type":"string","maxLength":254},"assignee":{"anyOf":[{"type":"object","required":["user_id"],"properties":{"user_id":{"type":"string","maxLength":64},"display_name":{"type":["string","null"]}}},{"type":"null"}]},"instructions":{"type":["string","null"]},"created_by":{"type":"object","required":["user_id"],"properties":{"user_id":{"type":"string","maxLength":64},"display_name":{"type":["string","null"]}}},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"claimed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"revoked_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"created_at":{"$ref":"#/components/schemas/Timestamp"}}},"DelegatedTaskCreated":{"title":"DelegatedTaskCreated","type":"object","required":["task"],"properties":{"task":{"$ref":"#/components/schemas/DelegatedTask"},"token":{"type":"string","pattern":"^mttask_","description":"Shown once, to people only. It identifies the task only: the engineer signs in (passkey or organization SSO) and claims it. Not returned to an agent run (link_delivery delegator)."},"claim_url":{"type":"string","format":"uri"},"link_delivery":{"type":"string","enum":["returned","delegator"],"description":"returned: token and claim_url are in this response. delegator: an agent created the task; the person who delegated the run issues the link (POST /v1/tasks/{id}/link)."}},"description":"A task-scoped invitation for an external engineer: discovery and evidence upload on one workspace, expiring."},"DelegatedTaskId":{"title":"DelegatedTaskId","description":"Opaque identifier with prefix `dtk_`.","type":"string","pattern":"^dtk_[a-z0-9_]+$","maxLength":64,"examples":["dtk_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"DelegatedTaskList":{"title":"DelegatedTaskList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DelegatedTask"}}}},"DelegatedTenantList":{"title":"DelegatedTenantList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Delegation"}},"reseller":{"type":"object","required":["org_id","active"],"properties":{"org_id":{"$ref":"#/components/schemas/OrgId"},"active":{"type":"boolean"}}}}},"Delegation":{"title":"Delegation","type":"object","required":["id","reseller_org_id","customer_org_id","roles","state","in_effect","effective_from"],"properties":{"id":{"$ref":"#/components/schemas/DelegationId"},"reseller_org_id":{"$ref":"#/components/schemas/OrgId"},"reseller_name":{"type":["string","null"]},"customer_org_id":{"$ref":"#/components/schemas/OrgId"},"customer_name":{"type":["string","null"]},"roles":{"type":"array","items":{"$ref":"#/components/schemas/CustomerRole"}},"state":{"type":"string","enum":["proposed","active","declined","revoked"]},"in_effect":{"type":"boolean","description":"Accepted and inside its effective dates: the reseller holds the roles now."},"effective_from":{"$ref":"#/components/schemas/Timestamp"},"effective_to":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"accepted_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"ended_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"ended_by_type":{"type":["string","null"],"enum":["customer","reseller","staff",null]},"end_reason":{"type":["string","null"]},"revision":{"type":"integer"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"your_roles":{"type":"array","items":{"$ref":"#/components/schemas/CustomerRole"},"description":"Reseller console: the roles you hold in this tenant through the delegation."}}},"DelegationChangedDataV1":{"title":"DelegationChangedDataV1","type":"object","required":["delegation_id","reseller_org_id","customer_org_id","state"],"properties":{"delegation_id":{"type":"string","pattern":"^dlg_[a-z0-9_]+$","maxLength":64},"reseller_org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"customer_org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"state":{"type":"string","enum":["proposed","active","declined","revoked"]}}},"DelegationId":{"title":"DelegationId","description":"Opaque identifier with prefix `dlg_`.","type":"string","pattern":"^dlg_[a-z0-9_]+$","maxLength":64,"examples":["dlg_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"DelegationList":{"title":"DelegationList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Delegation"}}}},"DeploymentEnv":{"title":"DeploymentEnv","type":"string","enum":["dev","test","sandbox","production"]},"DesiredStateV1":{"title":"DesiredStateV1","description":"What the control plane wants a target to enforce, computed from the authoritative trust space. `desired_state_fingerprint` is SHA-256 over the canonical JSON of the fingerprinted members (tenant_id, integration_id, revision, issuer_chain, trust_bundle, policy_mapping, identity_bindings, revocation_mode, verify_depth); `context` is informational and not fingerprinted. Both are returned only with ?detail=1; the default body is exactly the fingerprinted document.","type":"object","required":["tenant_id","integration_id","revision","trust_bundle","policy_mapping","revocation_mode"],"properties":{"tenant_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"revision":{"type":"integer","minimum":0,"description":"Increments whenever the fingerprinted content changes."},"issuer_chain":{"type":"array","maxItems":20,"items":{"type":"string","maxLength":500},"description":"Subjects of the issuing chain (informational)."},"trust_bundle":{"type":"object","required":["pem","sha256"],"properties":{"pem":{"type":"string","maxLength":200000,"description":"Issuing chain PEMs (issuing CA, then root) for every active issuer of the space."},"sha256":{"type":"string","pattern":"^[0-9a-f]{64}$"},"mode":{"type":"string","enum":["replace","merge"],"description":"merge keeps anchors the target already trusts (parallel trust)."}}},"policy_mapping":{"type":"object","required":["authorizer"],"properties":{"authorizer":{"type":"string","enum":["mutual_trust_enforcer","native_acl",""]},"protocol":{"type":"string","enum":["forward_auth","ext_authz_grpc","lua"]},"address":{"type":"string","maxLength":500},"resource":{"type":"string","maxLength":200},"fail_closed":{"const":true}}},"identity_bindings":{"type":"array","maxItems":1000,"items":{"type":"object","required":["principal"],"properties":{"principal":{"type":"string","maxLength":500,"description":"URI SAN of the workload certificate (urn:mutualtrust:workload:...)."},"match":{"type":"string","enum":["uri_san","subject_cn"]},"routes":{"type":"array","maxItems":100,"items":{"type":"string","maxLength":200},"description":"Path prefixes; empty means the whole resource."}}}},"revocation_mode":{"type":"string","enum":["external_authorizer","crl","none"]},"verify_depth":{"type":"integer","minimum":1,"maximum":10},"desired_state_fingerprint":{"type":"string","pattern":"^[0-9a-f]{64}$"},"context":{"type":"object","description":"Not fingerprinted: issuing chain detail, CRL URLs, the enforcer deny set and the policy routes behind the identity bindings."}}},"DiagnosticEvidence":{"title":"DiagnosticEvidence","type":"object","required":["id","source","kind","visibility","observed_at","result"],"properties":{"id":{"$ref":"#/components/schemas/DiagnosticEvidenceId"},"source":{"type":"string","maxLength":40},"kind":{"type":"string","enum":["discovery","step_evidence","verification"]},"visibility":{"type":"string","enum":["owner_only","consumer_only","shared_redacted"]},"contributed_by":{"type":"object","required":["side"],"properties":{"side":{"type":"string","maxLength":20},"delegated_task_id":{"anyOf":[{"$ref":"#/components/schemas/DelegatedTaskId"},{"type":"null"}]}}},"observed_at":{"$ref":"#/components/schemas/Timestamp"},"result":{"type":"object","description":"The redacted extraction. Raw uploads are never stored."},"result_ref":{"type":["string","null"]},"content_sha256":{"$ref":"#/components/schemas/Sha256Hex"},"step_ordinal":{"type":["integer","null"]},"retention_until":{"$ref":"#/components/schemas/Timestamp"},"created_at":{"$ref":"#/components/schemas/Timestamp"}}},"DiagnosticEvidenceId":{"title":"DiagnosticEvidenceId","description":"Opaque identifier with prefix `dev_`.","type":"string","pattern":"^dev_[a-z0-9_]+$","maxLength":64,"examples":["dev_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"DiagnosticEvidenceList":{"title":"DiagnosticEvidenceList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DiagnosticEvidence"}},"visibility_note":{"type":"string","maxLength":500},"next_cursor":{"type":["string","null"],"description":"Pass as cursor for the next (older) page; null on the last page."}}},"Domain":{"title":"Domain","type":"object","required":["id","org_id","domain","state","record"],"properties":{"id":{"$ref":"#/components/schemas/DomainId"},"org_id":{"$ref":"#/components/schemas/OrgId"},"domain":{"type":"string"},"state":{"type":"string","enum":["pending","verified","failed","expired"]},"label":{"type":["string","null"],"description":"\"Domain control verified\" while verified."},"record":{"type":"object","required":["type","name","value"],"properties":{"type":{"const":"TXT"},"name":{"type":"string"},"value":{"type":"string"}}},"last_checked_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"next_check_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"last_result":{"type":["string","null"],"description":"found, not_found, resolvers_disagree, resolver_unavailable or claimed_elsewhere."},"verified_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"expires_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"}}},"DomainId":{"title":"DomainId","description":"Opaque identifier with prefix `dom_`.","type":"string","pattern":"^dom_[a-z0-9_]+$","maxLength":64,"examples":["dom_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"DomainList":{"title":"DomainList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Domain"}},"label":{"type":"string"}}},"DomainRemoved":{"title":"DomainRemoved","type":"object","required":["id","removed"],"properties":{"id":{"$ref":"#/components/schemas/DomainId"},"removed":{"const":true}}},"EndDelegation":{"title":"EndDelegation","type":"object","additionalProperties":false,"properties":{"reason":{"type":"string","maxLength":500}}},"EnrollmentChallenge":{"title":"EnrollmentChallenge","type":"object","required":["enrollment_id","challenge","expires_at","proof_input","workload_id","grant_id"],"properties":{"enrollment_id":{"$ref":"#/components/schemas/EnrollmentId"},"challenge":{"type":"string"},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"proof_input":{"type":"string","pattern":"^mt-enroll-v1:"},"workload_id":{"$ref":"#/components/schemas/WorkloadId"},"grant_id":{"$ref":"#/components/schemas/GrantId"}}},"EnrollmentId":{"title":"EnrollmentId","description":"Opaque identifier with prefix `enr_`.","type":"string","pattern":"^enr_[a-z0-9_]+$","maxLength":64,"examples":["enr_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"EnrollmentTokenCreated":{"title":"EnrollmentTokenCreated","type":"object","required":["token","expires_at","grant_id","workload_id"],"properties":{"token":{"type":"string","description":"Single-use sandbox attestation token."},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"grant_id":{"$ref":"#/components/schemas/GrantId"},"workload_id":{"$ref":"#/components/schemas/WorkloadId"},"label":{"type":"string"}}},"EntitlementTermsId":{"title":"EntitlementTermsId","description":"Opaque identifier with prefix `etm_`.","type":"string","pattern":"^etm_[a-z0-9_]+$","maxLength":64,"examples":["etm_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"Environment":{"title":"Environment","type":"string","enum":["sandbox","production"]},"EraseAccount":{"title":"EraseAccount","type":"object","additionalProperties":false,"required":["confirm"],"properties":{"confirm":{"type":"string","const":"erase my account","description":"Type exactly \"erase my account\"."}}},"EventEnvelopeV1":{"title":"EventEnvelopeV1","type":"object","required":["schema_version","event_id","type","tenant_id","occurred_at","data"],"properties":{"schema_version":{"const":1},"event_id":{"type":"string","pattern":"^evt_[A-Za-z0-9_]+$"},"type":{"type":"string"},"tenant_id":{"type":"string","pattern":"^org_[a-z0-9_]+$"},"occurred_at":{"type":"string","format":"date-time"},"data":{"type":"object"}}},"EvidenceCategory":{"title":"EvidenceCategory","type":"object","required":["category","title","outcome"],"properties":{"category":{"type":"integer","minimum":1,"maximum":8},"title":{"type":"string"},"name":{"type":"string"},"outcome":{"type":"string","enum":["pass","fail","skip","unsupported","missing"]},"cases":{"type":"integer"},"failed":{"type":"integer"},"duration_ms":{"type":["number","null"]},"run_id":{"anyOf":[{"$ref":"#/components/schemas/IntegrationRunId"},{"type":"null"}]},"plan_hash":{"anyOf":[{"$ref":"#/components/schemas/Sha256Hex"},{"type":"null"}]},"suite":{"type":["string","null"]},"adapter_version":{"type":["string","null"]},"platform_version":{"type":["string","null"]},"observed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"source":{"type":["string","null"]}}},"ExportGrant":{"title":"ExportGrant","type":"object","required":["id","user_id","expires_at"],"properties":{"id":{"$ref":"#/components/schemas/ExportGrantId"},"user_id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"expires_at":{"type":"string","format":"date-time"},"revoked_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"created_at":{"type":"string","format":"date-time"},"active":{"type":"boolean"}}},"ExportGrantCreated":{"title":"ExportGrantCreated","type":"object","required":["id","user_id","expires_at"],"properties":{"id":{"$ref":"#/components/schemas/ExportGrantId"},"user_id":{"$ref":"#/components/schemas/UserId"},"expires_at":{"$ref":"#/components/schemas/Timestamp"}}},"ExportGrantId":{"title":"ExportGrantId","description":"Opaque identifier with prefix `exg_`.","type":"string","pattern":"^exg_[a-z0-9_]+$","maxLength":64,"examples":["exg_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"ExportGrantList":{"title":"ExportGrantList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ExportGrant"}}}},"ExportGrantRevoked":{"title":"ExportGrantRevoked","type":"object","required":["id","active"],"properties":{"id":{"$ref":"#/components/schemas/ExportGrantId"},"active":{"const":false}}},"ExportManifestV1":{"title":"ExportManifestV1","description":"The export manifest of one rendering (mt-adapt render writes it to export/manifest.json): every rendered file with its SHA-256, the adapter, plan hash, desired-state fingerprint, target and creation time. The control plane signs its canonical SHA-256 in an export statement (ExportStatementV1).","type":"object","required":["typ","adapter_id","adapter_version","plan_hash","desired_state_fingerprint","target","created_at","files"],"properties":{"typ":{"const":"mt.adapter-export-manifest.v1"},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"adapter_version":{"type":"string","pattern":"^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$","maxLength":40,"examples":["1.0.0"]},"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"desired_state_fingerprint":{"type":"string","pattern":"^[0-9a-f]{64}$"},"target":{"title":"TargetRef","description":"What an adapter operation acts on. `endpoint` is the protected endpoint descriptor approvals bind; `locator` holds adapter-specific coordinates (config path, server name, listener). Every member is covered by plan hashes.","type":"object","additionalProperties":false,"required":["tenant_id","integration_id","adapter_id","endpoint"],"properties":{"tenant_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"organization_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"connection_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"endpoint":{"type":"string","maxLength":300,"minLength":1},"locator":{"type":"object","maxProperties":32,"additionalProperties":{"type":"string","maxLength":1000}}},"examples":[{"tenant_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","integration_id":"int_01jq3v8m2k9x4h7c5n6p0r1s2t","adapter_id":"nginx.oss.server","endpoint":"https://api.example.com:443","locator":{"config":"/etc/nginx/nginx.conf","server_name":"api.example.com"}}]},"created_at":{"type":"string","format":"date-time"},"files":{"type":"array","maxItems":200,"items":{"type":"object","additionalProperties":false,"required":["path","sha256","size","role"],"properties":{"path":{"type":"string","maxLength":1000,"description":"Path inside the bundle (files/... or changes.diff).","pattern":"^(?!/)(?!.*\\.\\.)[^\\u0000-\\u001f\\\\]+$"},"target_path":{"type":"string","maxLength":1000,"description":"Destination on the target, when the file is applied."},"sha256":{"type":"string","pattern":"^[0-9a-f]{64}$"},"size":{"type":"integer","minimum":0},"role":{"type":"string","maxLength":40},"mode":{"type":"string","maxLength":8}}}}}},"Gateway":{"title":"Gateway","type":"object","required":["id","name","state"],"properties":{"id":{"$ref":"#/components/schemas/GatewayId"},"name":{"type":"string"},"state":{"type":"string","enum":["paired","disabled"]},"connector_version":{"type":["string","null"]},"last_ack_epoch":{"type":["integer","null"]},"last_ack_revision":{"type":["integer","null"]},"last_ack_hash":{"type":["string","null"]},"last_ack_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"last_seen_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"gateway_key_thumbprint":{"type":"string"},"status":{"type":"string","enum":["disabled","never_connected","offline","current","pending"]},"policy_age_seconds":{"type":["integer","null"]},"created_at":{"type":"string","format":"date-time"}}},"GatewayAck":{"title":"GatewayAck","type":"object","additionalProperties":false,"required":["ack"],"properties":{"ack":{"type":"string","maxLength":4000}}},"GatewayApproved":{"title":"GatewayApproved","type":"object","required":["gateway_id","service_id","name","key_thumbprint"],"properties":{"gateway_id":{"$ref":"#/components/schemas/GatewayId"},"service_id":{"$ref":"#/components/schemas/ServiceId"},"name":{"type":"string"},"key_thumbprint":{"type":"string"}}},"GatewayDisabled":{"title":"GatewayDisabled","type":"object","required":["gateway_id","state"],"properties":{"gateway_id":{"$ref":"#/components/schemas/GatewayId"},"state":{"const":"disabled"}}},"GatewayId":{"title":"GatewayId","description":"Opaque identifier with prefix `gw_`.","type":"string","pattern":"^gw_[a-z0-9_]+$","maxLength":64,"examples":["gw_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"GatewayReceipts":{"title":"GatewayReceipts","type":"object","additionalProperties":false,"required":["receipts"],"properties":{"receipts":{"type":"array","maxItems":100,"items":{"type":"string","maxLength":6000}}}},"Grant":{"title":"Grant","type":"object","required":["id","state","revision","environment","scope"],"properties":{"id":{"$ref":"#/components/schemas/GrantId"},"side":{"type":"string","enum":["sponsor","consumer"]},"sides":{"type":"array","items":{"type":"string","enum":["sponsor","consumer"]}},"state":{"$ref":"#/components/schemas/GrantState"},"revision":{"type":"integer","minimum":1},"environment":{"$ref":"#/components/schemas/Environment"},"scope":{"$ref":"#/components/schemas/GrantScope"},"expires_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"reason_code":{"anyOf":[{"$ref":"#/components/schemas/GrantReasonCode"},{"type":"null"}]},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"service":{"$ref":"#/components/schemas/NamedRef"},"sponsor":{"$ref":"#/components/schemas/NamedRef"},"consumer":{"$ref":"#/components/schemas/NamedRef"},"workload":{"anyOf":[{"$ref":"#/components/schemas/WorkloadRef"},{"type":"null"}]},"certificates":{"type":"array","items":{"$ref":"#/components/schemas/Certificate"}},"last_successful_call":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"examples":[{"id":"gr_01jq3v8m2k9x4h7c5n6p0r1s2t","state":"active","revision":3,"environment":"sandbox","scope":{"v":1,"routes":[{"methods":["GET"],"path":"/orders/*"}]}}]},"GrantActivatedDataV1":{"title":"GrantActivatedDataV1","type":"object","required":["grant_id","service_id","revision"],"properties":{"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64},"revision":{"type":"integer","minimum":1}}},"GrantApproval":{"title":"GrantApproval","description":"How an accepted invitation becomes a grant: 'automatic' activates it, 'sponsor_review' creates it pending until a service owner approves.","type":"string","enum":["automatic","sponsor_review"]},"GrantExpiredDataV1":{"title":"GrantExpiredDataV1","type":"object","required":["grant_id","service_id","revision"],"properties":{"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64},"revision":{"type":"integer","minimum":1}}},"GrantId":{"title":"GrantId","description":"Opaque identifier with prefix `gr_`.","type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64,"examples":["gr_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"GrantList":{"title":"GrantList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/GrantSummary"}}}},"GrantReason":{"title":"GrantReason","type":"object","additionalProperties":false,"required":["reason_code"],"properties":{"reason_code":{"type":"string","enum":["contract_ended","security_incident","owner_request"]},"note":{"type":"string","maxLength":500}}},"GrantReasonCode":{"title":"GrantReasonCode","type":"string","enum":["contract_ended","security_incident","owner_request"]},"GrantResumedDataV1":{"title":"GrantResumedDataV1","type":"object","required":["grant_id","service_id","revision"],"properties":{"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64},"revision":{"type":"integer","minimum":1}}},"GrantRevokedDataV1":{"title":"GrantRevokedDataV1","type":"object","required":["grant_id","service_id","revision","reason_code"],"properties":{"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$"},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$"},"revision":{"type":"integer","minimum":1},"reason_code":{"type":"string","enum":["contract_ended","security_incident","owner_request"]}}},"GrantScope":{"title":"GrantScope","type":"object","required":["routes"],"properties":{"v":{"const":1},"routes":{"type":"array","items":{"$ref":"#/components/schemas/RouteRule"}}},"examples":[{"v":1,"routes":[{"methods":["GET"],"path":"/orders/*"},{"methods":["POST"],"path":"/orders"}]}]},"GrantScopeChangedDataV1":{"title":"GrantScopeChangedDataV1","type":"object","required":["grant_id","service_id","revision"],"properties":{"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64},"revision":{"type":"integer","minimum":1}}},"GrantState":{"title":"GrantState","type":"string","enum":["pending","active","suspended","revoked","expired"]},"GrantSummary":{"title":"GrantSummary","type":"object","required":["id","state","revision","scope","environment"],"properties":{"id":{"$ref":"#/components/schemas/GrantId"},"state":{"$ref":"#/components/schemas/GrantState"},"revision":{"type":"integer"},"scope":{"$ref":"#/components/schemas/GrantScope"},"expires_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"environment":{"$ref":"#/components/schemas/Environment"},"consumer_org_id":{"$ref":"#/components/schemas/OrgId"},"consumer_name":{"type":"string"},"service_name":{"type":"string"},"sponsor_name":{"type":"string"},"contact":{"type":["string","null"]},"workload_id":{"$ref":"#/components/schemas/WorkloadId"},"workload_name":{"type":"string"},"updated_at":{"type":"string","format":"date-time"},"cert_expires_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"renew_after":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}}},"GrantSuspendedDataV1":{"title":"GrantSuspendedDataV1","type":"object","required":["grant_id","service_id","revision","reason_code"],"properties":{"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64},"revision":{"type":"integer","minimum":1},"reason_code":{"type":"string","enum":["contract_ended","security_incident","owner_request"]}}},"GrantTransition":{"title":"GrantTransition","type":"object","required":["grant_id","state","revision","operation_id","effective_control_plane_time","intended_policy_revision","pending_gateway_count"],"properties":{"grant_id":{"$ref":"#/components/schemas/GrantId"},"state":{"$ref":"#/components/schemas/GrantState"},"revision":{"type":"integer"},"operation_id":{"$ref":"#/components/schemas/OperationId"},"effective_control_plane_time":{"type":"string","format":"date-time"},"intended_policy_revision":{"$ref":"#/components/schemas/PolicyRevisionRef"},"pending_gateway_count":{"type":"integer","minimum":0},"approval_policy":{"$ref":"#/components/schemas/ApprovalPolicySummary","description":"Approving a sponsor-review grant: the approval policy the approver was checked against."}}},"HandoverReport":{"title":"HandoverReport","type":"object","required":["id","workspace_id","audience","plan_hash","report_sha256","report","generated_at"],"properties":{"id":{"$ref":"#/components/schemas/HandoverReportId"},"workspace_id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"audience":{"type":"string","enum":["owner","consumer"]},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"report_sha256":{"$ref":"#/components/schemas/Sha256Hex"},"report":{"$ref":"#/components/schemas/HandoverReportV1"},"statement_jws":{"anyOf":[{"$ref":"#/components/schemas/Jws"},{"type":"null"}],"description":"ES256 JWS (typ mt.handover-report.v1+jws) over the report hash, signed by the space manifest key."},"kid":{"anyOf":[{"$ref":"#/components/schemas/KeyVersionId"},{"type":"null"}]},"verification_key":{"type":["object","null"],"description":"The public JWK of kid, for offline verification."},"artifact_ref":{"type":"string","maxLength":300},"generated_at":{"$ref":"#/components/schemas/Timestamp"},"signed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}},"HandoverReportId":{"title":"HandoverReportId","description":"Opaque identifier with prefix `hor_`.","type":"string","pattern":"^hor_[a-z0-9_]+$","maxLength":64,"examples":["hor_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"HandoverReportV1":{"title":"HandoverReportV1","type":"object","required":["schema","audience","workspace_id","plan_hash","generated_at"],"properties":{"schema":{"const":"mt.handover-report.v1"},"audience":{"type":"string","enum":["owner","consumer"]},"workspace_id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"plan_version":{"type":"integer"},"status":{"type":"string","maxLength":30},"parties":{"type":"array","items":{"type":"object","required":["org_id","name"],"properties":{"org_id":{"anyOf":[{"$ref":"#/components/schemas/OrgId"},{"type":"null"}]},"name":{"type":"string","maxLength":200}}}},"approvals":{"type":"array","items":{"type":"object"}},"change_version":{"type":"object"},"tests":{"type":"array","items":{"type":"object"}},"certificates":{"type":"array","items":{"type":"object"}},"timeline":{"type":"array","items":{"type":"object"}},"rollback":{"type":["object","null"]},"limitations":{"type":"array","items":{"type":"string","maxLength":1000}},"generated_at":{"$ref":"#/components/schemas/Timestamp"}},"description":"The handover report document exactly as hashed (report_sha256) and signed."},"Healthz":{"title":"Healthz","type":"object","required":["ok","deployment"],"properties":{"ok":{"const":true},"deployment":{"$ref":"#/components/schemas/DeploymentEnv"}}},"HttpMethod":{"title":"HttpMethod","type":"string","enum":["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"]},"InitiationPolicy":{"title":"InitiationPolicy","type":"object","required":["scope_type","scope_id","revision","fields","effective"],"properties":{"scope_type":{"type":"string","enum":["organization","service"]},"scope_id":{"type":"string","maxLength":64},"revision":{"type":"integer","minimum":0},"fields":{"type":"object","description":"What this scope sets; absent fields inherit."},"effective":{"type":"object","required":["policy","sources"],"properties":{"policy":{"type":"object"},"sources":{"type":"object"},"clamped":{"type":"array","items":{"type":"object"}}}},"updated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}},"Integration":{"title":"Integration","type":"object","required":["id","tenant_id","space_id","environment","adapter_id","adapter_version","role","endpoint","state","revision","target"],"properties":{"id":{"$ref":"#/components/schemas/IntegrationId"},"tenant_id":{"$ref":"#/components/schemas/OrgId"},"org_id":{"$ref":"#/components/schemas/OrgId"},"space_id":{"$ref":"#/components/schemas/SpaceId"},"service_id":{"anyOf":[{"$ref":"#/components/schemas/ServiceId"},{"type":"null"}]},"service_name":{"type":["string","null"]},"grant_id":{"anyOf":[{"$ref":"#/components/schemas/GrantId"},{"type":"null"}]},"environment":{"$ref":"#/components/schemas/Environment"},"adapter_id":{"type":"string"},"adapter_version":{"type":"string"},"adapter_name":{"type":["string","null"]},"adapter_status":{"type":["string","null"]},"modes":{"type":"array","items":{"type":"string","enum":["G","C","A","O","V"]}},"role":{"type":"string","enum":["client","tls_terminator","policy_enforcer"]},"name":{"type":"string"},"endpoint":{"type":"string","description":"The endpoint string approvals bind (TargetRef.endpoint)."},"endpoint_descriptor":{"title":"EndpointDescriptor","type":"object","required":["hostname","port"],"properties":{"hostname":{"type":"string"},"port":{"type":"integer"},"sni":{"type":["string","null"]},"route":{"type":"string"},"tls_terminator":{"type":["string","null"]},"upstream":{"type":["string","null"],"description":"Protected detail: shown to members, never logged or shown to staff."}}},"authorizer":{"type":"object","required":[],"properties":{"address":{"type":["string","null"]},"protocol":{"type":["string","null"]}}},"trust_bundle_mode":{"type":"string","enum":["replace","merge"]},"require_second_approver":{"type":"boolean"},"state":{"type":"string","enum":["active","disabled"]},"revision":{"type":"integer","minimum":1,"description":"Entity tag for If-Match on approve and reject."},"desired_revision":{"type":"integer"},"target":{"$ref":"#/components/schemas/TargetRef"},"approval_verification_key":{"title":"ApprovalVerificationKey","type":"object","required":["kid","alg","jwk"],"properties":{"kid":{"$ref":"#/components/schemas/KeyVersionId"},"alg":{"const":"ES256"},"jwk":{"type":"object","required":["kty","crv","x","y"],"properties":{"kty":{"const":"EC"},"crv":{"const":"P-256"},"x":{"type":"string"},"y":{"type":"string"}}}}},"summary":{"type":"object","required":[],"properties":{"pending_plans":{"type":"integer"},"approved_plans":{"type":"integer"},"runs":{"type":"integer"},"failed_runs":{"type":"integer"},"last_run_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"last_verification_outcome":{"type":["string","null"]}}},"created_by":{"anyOf":[{"title":"UserRef","type":"object","required":["user_id"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"auth_method":{"type":"string"},"via":{"type":"string","enum":["session","api_key"]}}},{"type":"null"}]},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"}},"description":"A registered adapter integration owned by the API owner organization, optionally scoped to a service and a partner connection (grant). Approvals are verified by the runtime with approval_verification_key (the space manifest key, pinned at registration)."},"IntegrationApprovalId":{"title":"IntegrationApprovalId","description":"Opaque identifier with prefix `iap_`.","type":"string","pattern":"^iap_[a-z0-9_]+$","maxLength":64,"examples":["iap_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"IntegrationEvidence":{"title":"IntegrationEvidence","type":"object","required":["integration_id","categories"],"properties":{"integration_id":{"$ref":"#/components/schemas/IntegrationId"},"adapter_id":{"type":"string"},"categories":{"type":"array","items":{"$ref":"#/components/schemas/EvidenceCategory"}},"revocation":{"anyOf":[{"type":"object","required":["mode","measured_seconds"],"properties":{"mode":{"type":"string"},"enforced_by":{"type":"string"},"measured_seconds":{"type":"number"},"bound_seconds":{"type":"number"},"reason":{"type":"string"},"run_id":{"$ref":"#/components/schemas/IntegrationRunId"},"observed_at":{"$ref":"#/components/schemas/Timestamp"}}},{"type":"null"}]},"passed":{"type":"integer"},"failed":{"type":"integer"},"missing":{"type":"integer"},"complete":{"type":"boolean","description":"Every category has a passing or documented-unsupported result."}}},"IntegrationExport":{"title":"IntegrationExport","type":"object","required":["id","integration_id","version","plan_hash","desired_state_fingerprint","adapter_id","adapter_version","manifest_sha256","file_count","created_at"],"properties":{"id":{"$ref":"#/components/schemas/IntegrationExportId"},"integration_id":{"$ref":"#/components/schemas/IntegrationId"},"version":{"type":"integer","minimum":1,"description":"Export version, monotonically increasing per integration."},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"desired_state_fingerprint":{"$ref":"#/components/schemas/Sha256Hex"},"adapter_id":{"type":"string"},"adapter_version":{"type":"string"},"manifest_sha256":{"$ref":"#/components/schemas/Sha256Hex","description":"SHA-256 of the canonical JSON of the export manifest (bound by the statement)."},"file_count":{"type":"integer"},"total_bytes":{"type":"integer"},"manifest_created_at":{"$ref":"#/components/schemas/Timestamp"},"statement_jws":{"anyOf":[{"$ref":"#/components/schemas/Jws"},{"type":"null"}],"description":"ExportStatementV1 signed with the pinned space manifest key; null until signed."},"kid":{"anyOf":[{"$ref":"#/components/schemas/KeyVersionId"},{"type":"null"}]},"signed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"manifest":{"anyOf":[{"$ref":"#/components/schemas/ExportManifestV1"},{"type":"null"}],"description":"The manifest exactly as hashed (single-export reads and submissions only)."},"submitted_by":{"title":"UserRef","type":"object","required":["user_id"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"auth_method":{"type":"string"},"via":{"type":"string","enum":["session","api_key"]}}},"created":{"type":"boolean","description":"false when this manifest was already exported (idempotent by manifest hash)."},"created_at":{"$ref":"#/components/schemas/Timestamp"}},"description":"A signed, versioned configuration export of one rendering. Verify offline with mt-adapt export verify."},"IntegrationExportId":{"title":"IntegrationExportId","description":"Opaque identifier with prefix `iex_`.","type":"string","pattern":"^iex_[a-z0-9_]+$","maxLength":64,"examples":["iex_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"IntegrationExportList":{"title":"IntegrationExportList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/IntegrationExport"}}}},"IntegrationId":{"title":"IntegrationId","description":"Opaque identifier with prefix `int_`.","type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64,"examples":["int_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"IntegrationList":{"title":"IntegrationList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Integration"}}}},"IntegrationPlanApprovedDataV1":{"title":"IntegrationPlanApprovedDataV1","type":"object","required":["integration_id","plan_hash","approval_id"],"properties":{"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"approval_id":{"type":"string","pattern":"^iap_[a-z0-9_]+$","maxLength":64}}},"IntegrationPlanId":{"title":"IntegrationPlanId","description":"Opaque identifier with prefix `ipl_`.","type":"string","pattern":"^ipl_[a-z0-9_]+$","maxLength":64,"examples":["ipl_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"IntegrationPlanRejectedDataV1":{"title":"IntegrationPlanRejectedDataV1","type":"object","required":["integration_id","plan_hash"],"properties":{"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"approval_id":{"type":"string","pattern":"^iap_[a-z0-9_]+$","maxLength":64}}},"IntegrationPlanSubmittedDataV1":{"title":"IntegrationPlanSubmittedDataV1","type":"object","required":["integration_id","plan_hash"],"properties":{"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"kind":{"type":"string","enum":["plan","rollback"]}}},"IntegrationRegisteredDataV1":{"title":"IntegrationRegisteredDataV1","type":"object","required":["integration_id","adapter_id","environment"],"properties":{"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"environment":{"type":"string","enum":["sandbox","production"]},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64}}},"IntegrationRun":{"title":"IntegrationRun","type":"object","required":["id","integration_id","operation","plan_hash","idempotency_key","outcome","started_at","finished_at"],"properties":{"id":{"$ref":"#/components/schemas/IntegrationRunId"},"integration_id":{"$ref":"#/components/schemas/IntegrationId"},"operation":{"type":"string","enum":["inspect","plan","render","apply","verify","rollback","observe"]},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"idempotency_key":{"type":"string"},"adapter_id":{"type":"string"},"adapter_version":{"type":"string"},"before_fingerprint":{"type":"string"},"after_fingerprint":{"type":"string"},"outcome":{"type":"string","enum":["succeeded","failed","noop","aborted"]},"error_code":{"type":["string","null"]},"verification_outcome":{"type":["string","null"],"enum":["passed","failed",null]},"verification":{"anyOf":[{"$ref":"#/components/schemas/VerificationV1"},{"type":"null"}]},"categories":{"type":"array","items":{"type":"object","required":["category","outcome"],"properties":{"category":{"type":"integer"},"name":{"type":"string"},"outcome":{"type":"string"},"cases":{"type":"integer"},"failed":{"type":"integer"},"duration_ms":{"type":"number"}}}},"started_at":{"$ref":"#/components/schemas/Timestamp"},"finished_at":{"$ref":"#/components/schemas/Timestamp"},"duration_ms":{"type":"integer"},"reported_by":{"title":"UserRef","type":"object","required":["user_id"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"auth_method":{"type":"string"},"via":{"type":"string","enum":["session","api_key"]}}},"created_at":{"$ref":"#/components/schemas/Timestamp"}},"description":"One reported runtime operation (append-only). Mutating runs reference an approved plan hash."},"IntegrationRunId":{"title":"IntegrationRunId","description":"Opaque identifier with prefix `irn_`.","type":"string","pattern":"^irn_[a-z0-9_]+$","maxLength":64,"examples":["irn_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"IntegrationRunList":{"title":"IntegrationRunList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/IntegrationRun"}}}},"IntegrationRunRecordedDataV1":{"title":"IntegrationRunRecordedDataV1","type":"object","required":["integration_id","run_id","operation","outcome"],"properties":{"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"run_id":{"type":"string","pattern":"^irn_[a-z0-9_]+$","maxLength":64},"operation":{"type":"string","enum":["inspect","plan","render","apply","verify","rollback","observe"]},"outcome":{"type":"string","enum":["succeeded","failed","noop","aborted"]},"verification_outcome":{"type":"string","enum":["passed","failed"]}}},"Invitation":{"title":"Invitation","type":"object","required":["id","state","expires_at"],"properties":{"id":{"$ref":"#/components/schemas/InvitationId"},"service_id":{"$ref":"#/components/schemas/ServiceId"},"consumer_org_id":{"$ref":"#/components/schemas/OrgId"},"consumer_name":{"type":"string"},"consumer_binding":{"type":"string","enum":["existing_org","new_org"]},"state":{"$ref":"#/components/schemas/InvitationState"},"expires_at":{"type":"string","format":"date-time"},"created_at":{"type":"string","format":"date-time"},"scope":{"$ref":"#/components/schemas/GrantScope"}}},"InvitationAccepted":{"title":"InvitationAccepted","type":"object","required":["grant_id","state","service","environment","workload","scope"],"properties":{"grant_id":{"$ref":"#/components/schemas/GrantId"},"state":{"type":"string","enum":["active","pending"],"description":"'pending' when the service requires sponsor review."},"awaiting_approval":{"type":"boolean"},"service":{"type":"string"},"environment":{"$ref":"#/components/schemas/Environment"},"workload":{"$ref":"#/components/schemas/WorkloadRef"},"scope":{"$ref":"#/components/schemas/GrantScope"}}},"InvitationCreated":{"title":"InvitationCreated","type":"object","required":["id","service_id","consumer_org_id","state","expires_at","scope","token","accept_url"],"properties":{"id":{"$ref":"#/components/schemas/InvitationId"},"service_id":{"$ref":"#/components/schemas/ServiceId"},"consumer_org_id":{"$ref":"#/components/schemas/OrgId"},"state":{"const":"pending"},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"scope":{"$ref":"#/components/schemas/GrantScope"},"token":{"type":"string","pattern":"^mtinv_","description":"One-time invitation secret; shown once, stored only as a hash."},"accept_url":{"type":"string","format":"uri"}}},"InvitationId":{"title":"InvitationId","description":"Opaque identifier with prefix `inv_`.","type":"string","pattern":"^inv_[a-z0-9_]+$","maxLength":64,"examples":["inv_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"InvitationList":{"title":"InvitationList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Invitation"}}}},"InvitationPreview":{"title":"InvitationPreview","type":"object","required":["id","state","expires_at","scope","consumer_org"],"properties":{"id":{"$ref":"#/components/schemas/InvitationId"},"state":{"$ref":"#/components/schemas/InvitationState"},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"sponsor":{"type":"string"},"service":{"type":"string"},"environment":{"$ref":"#/components/schemas/Environment"},"contact":{"type":["string","null"]},"scope":{"$ref":"#/components/schemas/GrantScope"},"consumer_org":{"type":"object","required":["id","unclaimed","you_are_member"],"properties":{"id":{"$ref":"#/components/schemas/OrgId"},"name":{"type":"string"},"unclaimed":{"type":"boolean","description":"True only for an invitation that created a new organization nobody has claimed yet."},"you_are_member":{"type":"boolean"},"binding":{"type":"string","enum":["existing_org","new_org"]}}},"grant_approval":{"$ref":"#/components/schemas/GrantApproval"}}},"InvitationResponded":{"title":"InvitationResponded","type":"object","required":["id","state"],"properties":{"id":{"$ref":"#/components/schemas/InvitationId"},"state":{"type":"string","enum":["declined","canceled"]}}},"InvitationState":{"title":"InvitationState","type":"string","enum":["pending","accepted","declined","canceled","expired"]},"IssuancePending":{"title":"IssuancePending","type":"object","required":["state","issuance_request_id"],"properties":{"state":{"type":"string","enum":["pending","approved","signed","failed"]},"issuance_request_id":{"$ref":"#/components/schemas/IssuanceRequestId"},"poll_url":{"type":"string"},"retry_after_seconds":{"type":"integer"}}},"IssuanceRequestId":{"title":"IssuanceRequestId","description":"Opaque identifier with prefix `isr_`.","type":"string","pattern":"^isr_[a-z0-9_]+$","maxLength":64,"examples":["isr_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"IssuanceResult":{"title":"IssuanceResult","anyOf":[{"$ref":"#/components/schemas/CertificateIssued"},{"$ref":"#/components/schemas/IssuancePending"}]},"Issuer":{"title":"Issuer","type":"object","required":["id","kind","state"],"properties":{"id":{"$ref":"#/components/schemas/IssuerId"},"kind":{"type":"string","enum":["root","intermediate"]},"subject_dn":{"type":"string"},"cert_fingerprint":{"type":"string"},"not_before":{"type":"string","format":"date-time"},"not_after":{"type":"string","format":"date-time"},"state":{"type":"string","enum":["active","retiring","retired","suspended"]},"signer_mode":{"type":"string"},"custody":{"type":"string","enum":["signer","external_ca"],"description":"Who holds the private key: the Mutual Trust signer (simulator or Cloud HSM) or an external private CA."},"profile":{"type":"string"}}},"IssuerId":{"title":"IssuerId","description":"Opaque identifier with prefix `iss_`.","type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64,"examples":["iss_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"IssuerRolloverAbortedDataV1":{"title":"IssuerRolloverAbortedDataV1","type":"object","required":["rollover_id","space_id","kind","state","emergency"],"properties":{"rollover_id":{"type":"string","pattern":"^trl_[a-z0-9_]+$","maxLength":64},"space_id":{"type":"string","pattern":"^spc_[a-z0-9_]+$","maxLength":64},"kind":{"type":"string","enum":["issuing_ca","root","manifest_key"]},"state":{"type":"string","enum":["started","staged","issuing","draining","retired","aborted"]},"emergency":{"type":"boolean"},"old_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64},"new_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64}}},"IssuerRolloverDrainingDataV1":{"title":"IssuerRolloverDrainingDataV1","type":"object","required":["rollover_id","space_id","kind","state","emergency"],"properties":{"rollover_id":{"type":"string","pattern":"^trl_[a-z0-9_]+$","maxLength":64},"space_id":{"type":"string","pattern":"^spc_[a-z0-9_]+$","maxLength":64},"kind":{"type":"string","enum":["issuing_ca","root","manifest_key"]},"state":{"type":"string","enum":["started","staged","issuing","draining","retired","aborted"]},"emergency":{"type":"boolean"},"old_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64},"new_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64}}},"IssuerRolloverIssuingDataV1":{"title":"IssuerRolloverIssuingDataV1","type":"object","required":["rollover_id","space_id","kind","state","emergency"],"properties":{"rollover_id":{"type":"string","pattern":"^trl_[a-z0-9_]+$","maxLength":64},"space_id":{"type":"string","pattern":"^spc_[a-z0-9_]+$","maxLength":64},"kind":{"type":"string","enum":["issuing_ca","root","manifest_key"]},"state":{"type":"string","enum":["started","staged","issuing","draining","retired","aborted"]},"emergency":{"type":"boolean"},"old_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64},"new_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64}}},"IssuerRolloverRetiredDataV1":{"title":"IssuerRolloverRetiredDataV1","type":"object","required":["rollover_id","space_id","kind","state","emergency"],"properties":{"rollover_id":{"type":"string","pattern":"^trl_[a-z0-9_]+$","maxLength":64},"space_id":{"type":"string","pattern":"^spc_[a-z0-9_]+$","maxLength":64},"kind":{"type":"string","enum":["issuing_ca","root","manifest_key"]},"state":{"type":"string","enum":["started","staged","issuing","draining","retired","aborted"]},"emergency":{"type":"boolean"},"old_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64},"new_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64}}},"IssuerRolloverStagedDataV1":{"title":"IssuerRolloverStagedDataV1","type":"object","required":["rollover_id","space_id","kind","state","emergency"],"properties":{"rollover_id":{"type":"string","pattern":"^trl_[a-z0-9_]+$","maxLength":64},"space_id":{"type":"string","pattern":"^spc_[a-z0-9_]+$","maxLength":64},"kind":{"type":"string","enum":["issuing_ca","root","manifest_key"]},"state":{"type":"string","enum":["started","staged","issuing","draining","retired","aborted"]},"emergency":{"type":"boolean"},"old_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64},"new_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64}}},"IssuerRolloverStartedDataV1":{"title":"IssuerRolloverStartedDataV1","type":"object","required":["rollover_id","space_id","kind","state","emergency"],"properties":{"rollover_id":{"type":"string","pattern":"^trl_[a-z0-9_]+$","maxLength":64},"space_id":{"type":"string","pattern":"^spc_[a-z0-9_]+$","maxLength":64},"kind":{"type":"string","enum":["issuing_ca","root","manifest_key"]},"state":{"type":"string","enum":["started","staged","issuing","draining","retired","aborted"]},"emergency":{"type":"boolean"},"old_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64},"new_issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64}}},"IssuerSuspendedDataV1":{"title":"IssuerSuspendedDataV1","type":"object","required":["issuer_id","space_id"],"properties":{"issuer_id":{"type":"string","pattern":"^iss_[a-z0-9_]+$","maxLength":64},"space_id":{"type":"string","pattern":"^spc_[a-z0-9_]+$","maxLength":64}}},"Jws":{"title":"Jws","description":"Compact JWS (header.payload.signature).","type":"string","pattern":"^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]*\\.[A-Za-z0-9_-]+$"},"KeyVersionId":{"title":"KeyVersionId","description":"Opaque identifier with prefix `kv_`.","type":"string","pattern":"^kv_[a-z0-9_]+$","maxLength":64,"examples":["kv_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"LegalEntityStatus":{"title":"LegalEntityStatus","type":"object","required":["label","verified","current","data"],"properties":{"label":{"const":"Legal entity verified"},"verified":{"type":"boolean"},"current":{"anyOf":[{"$ref":"#/components/schemas/LegalEntityVerification"},{"type":"null"}]},"data":{"type":"array","items":{"$ref":"#/components/schemas/LegalEntityVerification"}}}},"LegalEntityVerification":{"title":"LegalEntityVerification","type":"object","required":["id","org_id","state","legal_name","registration_number","jurisdiction","submitted_at"],"properties":{"id":{"$ref":"#/components/schemas/LegalEntityVerificationId"},"org_id":{"$ref":"#/components/schemas/OrgId"},"state":{"type":"string","enum":["submitted","in_review","approved","rejected","superseded"]},"label":{"type":["string","null"],"description":"\"Legal entity verified\" once approved."},"legal_name":{"type":"string"},"registration_number":{"type":"string"},"jurisdiction":{"type":"string"},"evidence_notes":{"type":["string","null"]},"submitted_at":{"$ref":"#/components/schemas/Timestamp"},"reviewed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"decided_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"decision_reason":{"type":["string","null"],"description":"Set when staff rejected the submission."},"updated_at":{"$ref":"#/components/schemas/Timestamp"}}},"LegalEntityVerificationId":{"title":"LegalEntityVerificationId","description":"Opaque identifier with prefix `lev_`.","type":"string","pattern":"^lev_[a-z0-9_]+$","maxLength":64,"examples":["lev_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"McpAuthorization":{"title":"McpAuthorization","type":"object","required":["redirect_url","credential_id","expires_at"],"properties":{"redirect_url":{"type":"string","format":"uri"},"credential_id":{"$ref":"#/components/schemas/ApiCredentialId"},"expires_at":{"$ref":"#/components/schemas/Timestamp"}}},"Me":{"title":"Me","type":"object","required":["user_id","auth_method","csrf_token","memberships"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"auth_method":{"type":"string","enum":["oidc","sandbox_guest","passkey","recovery_code"],"description":"'recovery_code' sessions can only register a new passkey."},"csrf_token":{"type":"string","description":"Echo as x-csrf-token on state-changing cookie requests."},"memberships":{"type":"array","items":{"type":"object","required":["tenant_id","role"],"properties":{"tenant_id":{"$ref":"#/components/schemas/OrgId"},"role":{"$ref":"#/components/schemas/CustomerRole"},"via":{"type":"string","enum":["delegation"],"description":"Present when the role is held through an accepted partner delegation."},"delegation_id":{"$ref":"#/components/schemas/DelegationId"}}}},"sso_required":{"type":"array","items":{"$ref":"#/components/schemas/OrgId"},"description":"Organizations that enforce SSO-only sign-in and whose roles this session does not carry: sign in through their identity provider."},"sso_connection_id":{"anyOf":[{"$ref":"#/components/schemas/SsoConnectionId"},{"type":"null"}],"description":"The organization identity provider that signed this session in."},"environment_notice":{"type":["string","null"]},"authenticated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}],"description":"When this browser session last signed in or re-authenticated (step-up); null for API credentials."}},"examples":[{"user_id":"usr_01jq3v8m2k9x4h7c5n6p0r1s2t","display_name":"Guest","auth_method":"sandbox_guest","csrf_token":"k3J9...","memberships":[{"tenant_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","role":"owner"}],"environment_notice":"Sandbox guest: production actions are unavailable."}]},"Member":{"title":"Member","type":"object","required":["user_id","roles"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"email":{"type":["string","null"]},"roles":{"type":"array","items":{"$ref":"#/components/schemas/CustomerRole"}}}},"MemberList":{"title":"MemberList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Member"}}}},"MemberRemoved":{"title":"MemberRemoved","type":"object","required":["user_id","removed","roles","credentials_revoked"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"removed":{"const":true},"roles":{"type":"array","items":{"$ref":"#/components/schemas/CustomerRole"},"description":"Roles the member held before removal."},"credentials_revoked":{"type":"integer","minimum":0}}},"MigrationApproval":{"title":"MigrationApproval","type":"object","required":["id","plan_id","plan_hash","permission_kind","side","action","target_ref","actor_ref","environment","decision","expires_at","created_at"],"properties":{"id":{"$ref":"#/components/schemas/MigrationApprovalId"},"plan_id":{"$ref":"#/components/schemas/MigrationPlanId"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"permission_kind":{"type":"string","enum":["request","identity_proof","trust_anchor_acceptance","resource_authorization","configuration_execution","production_cutover"]},"side":{"type":"string","enum":["owner","consumer"]},"action":{"type":"string","enum":["plan.approve","execution.start","step.execute","cutover","rollback"]},"target_ref":{"type":"string","maxLength":160},"actor_ref":{"type":"string","maxLength":80},"environment":{"$ref":"#/components/schemas/Environment"},"decision":{"type":"string","enum":["approved","rejected"]},"approver":{"type":"object","required":["user_id"],"properties":{"user_id":{"type":"string","maxLength":64},"display_name":{"type":["string","null"]}}},"step_up_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"reason":{"type":["string","null"]},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"invalidated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"invalidated_reason":{"type":["string","null"]},"consumed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"approval_policy":{"$ref":"#/components/schemas/ApprovalPolicySummary","description":"The approval policy the approver was checked against."},"created_at":{"$ref":"#/components/schemas/Timestamp"}},"description":"An approval bound to plan hash, action, target, actor, expiry and environment."},"MigrationApprovalId":{"title":"MigrationApprovalId","description":"Opaque identifier with prefix `map_`.","type":"string","pattern":"^map_[a-z0-9_]+$","maxLength":64,"examples":["map_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"MigrationApprovalRecorded":{"title":"MigrationApprovalRecorded","type":"object","required":["approval","plan_status","workspace_status","approvals_outstanding"],"properties":{"approval":{"$ref":"#/components/schemas/MigrationApproval"},"plan_status":{"type":"string","maxLength":20},"workspace_status":{"type":"string","enum":["draft","discovery","plan_ready","awaiting_approvals","approved","staging","validating","cutover_pending","active","blocked","failed","rollback_pending","rolled_back","cancelled"]},"approvals_outstanding":{"type":"array","items":{"type":"object"}}}},"MigrationApprovalRecordedDataV1":{"title":"MigrationApprovalRecordedDataV1","type":"object","required":["workspace_id","plan_id","approval_id"],"properties":{"workspace_id":{"type":"string","pattern":"^cws_[a-z0-9_]+$","maxLength":64},"plan_id":{"type":"string","pattern":"^mpl_[a-z0-9_]+$","maxLength":64},"approval_id":{"type":"string","pattern":"^map_[a-z0-9_]+$","maxLength":64},"permission_kind":{"type":"string","enum":["request","identity_proof","trust_anchor_acceptance","resource_authorization","configuration_execution","production_cutover"]},"decision":{"type":"string","enum":["approved","rejected"]}}},"MigrationApprovalRequest":{"title":"MigrationApprovalRequest","type":"object","required":["id","plan_id","plan_hash","permission_kind","side","action","target_ref","actor_ref","environment","state","created_at"],"properties":{"id":{"$ref":"#/components/schemas/MigrationApprovalRequestId"},"plan_id":{"$ref":"#/components/schemas/MigrationPlanId"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"permission_kind":{"type":"string","enum":["request","identity_proof","trust_anchor_acceptance","resource_authorization","configuration_execution","production_cutover"]},"side":{"type":"string","enum":["owner","consumer"]},"action":{"type":"string","enum":["plan.approve","execution.start","step.execute","cutover","rollback"]},"target_ref":{"type":"string","maxLength":160},"actor_ref":{"type":"string","maxLength":80},"environment":{"$ref":"#/components/schemas/Environment"},"state":{"type":"string","enum":["pending","approved","rejected","withdrawn","superseded"]},"requested_by":{"type":"object","required":["user_id"],"properties":{"agent_run_id":{"anyOf":[{"$ref":"#/components/schemas/AgentRunId"},{"type":"null"}]},"user_id":{"type":"string","maxLength":64}}},"reason":{"type":["string","null"]},"approval_id":{"anyOf":[{"$ref":"#/components/schemas/MigrationApprovalId"},{"type":"null"}]},"decided_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"created_at":{"$ref":"#/components/schemas/Timestamp"}},"description":"A request for an approval with this exact binding. It grants nothing; a person records the approval."},"MigrationApprovalRequestId":{"title":"MigrationApprovalRequestId","description":"Opaque identifier with prefix `mar_`.","type":"string","pattern":"^mar_[a-z0-9_]+$","maxLength":64,"examples":["mar_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"MigrationApprovalRequestList":{"title":"MigrationApprovalRequestList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/MigrationApprovalRequest"}}}},"MigrationApprovalRequestsCreated":{"title":"MigrationApprovalRequestsCreated","type":"object","required":["plan_id","plan_hash","results","requests","approvals_outstanding"],"properties":{"plan_id":{"$ref":"#/components/schemas/MigrationPlanId"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"results":{"type":"array","items":{"type":"object","required":["request_id","status"],"properties":{"request_id":{"type":"string","maxLength":64},"status":{"type":"string","enum":["requested","already_requested","already_approved"]}}}},"requests":{"type":"array","items":{"$ref":"#/components/schemas/MigrationApprovalRequest"}},"approvals_outstanding":{"type":"array","items":{"type":"object"}},"agent_run_waiting_on":{"type":["string","null"]},"note":{"type":"string","maxLength":300}}},"MigrationAssessment":{"title":"MigrationAssessment","type":"object","required":["id","workspace_id","exposure","findings","coverage","evidence_ids","created_at"],"properties":{"id":{"$ref":"#/components/schemas/MigrationAssessmentId"},"workspace_id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"exposure":{"type":"string","enum":["affected","not_affected","unknown"]},"exposure_reason":{"type":"string","maxLength":500},"deadline":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"cutoff":{"$ref":"#/components/schemas/Timestamp"},"findings":{"type":"array","items":{"type":"object","required":["code","label","confidence","detail","provenance"],"properties":{"code":{"type":"string","maxLength":80},"label":{"type":"string","maxLength":300},"confidence":{"type":"string","enum":["verified","inferred","unknown"]},"detail":{"type":"string","maxLength":4000},"provenance":{"type":"array","items":{"type":"object","required":["evidence_id","source","collected_at","collector"],"properties":{"evidence_id":{"type":"string","maxLength":64},"source":{"type":"string","maxLength":40},"collected_at":{"$ref":"#/components/schemas/Timestamp"},"collector":{"type":"string","maxLength":200}}}}}}},"coverage":{"type":"object","required":["dimensions","known","verified"],"properties":{"dimensions":{"type":"integer"},"known":{"type":"integer"},"verified":{"type":"integer"}}},"detected_gateway":{"type":"object","required":["confidence"],"properties":{"kind":{"type":["string","null"]},"version":{"type":["string","null"]},"confidence":{"type":"string","enum":["verified","inferred","unknown"]},"adapter_id":{"type":["string","null"]}}},"untrusted_content":{"type":"boolean"},"evidence_ids":{"type":"array","items":{"$ref":"#/components/schemas/DiagnosticEvidenceId"}},"result_sha256":{"$ref":"#/components/schemas/Sha256Hex"},"rejected_uploads":{"type":"array","items":{"type":"object","required":["filename","reason"],"properties":{"filename":{"type":"string","maxLength":200},"reason":{"type":"string","maxLength":200}}}},"created_at":{"$ref":"#/components/schemas/Timestamp"}},"description":"What the evidence says about one connection. Every finding is labelled verified, inferred or unknown with the evidence it rests on. The public TLS clientAuth transition affects public-CA clientAuth certificates only; private-CA mTLS is not affected."},"MigrationAssessmentId":{"title":"MigrationAssessmentId","description":"Opaque identifier with prefix `mas_`.","type":"string","pattern":"^mas_[a-z0-9_]+$","maxLength":64,"examples":["mas_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"MigrationAssessmentPreview":{"title":"MigrationAssessmentPreview","type":"object","required":["preview","workspace_id","exposure","findings","coverage"],"properties":{"preview":{"const":true},"workspace_id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"exposure":{"type":"string","enum":["affected","not_affected","unknown"]},"exposure_reason":{"type":"string","maxLength":500},"deadline":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"cutoff":{"$ref":"#/components/schemas/Timestamp"},"findings":{"type":"array","items":{"type":"object","required":["code","label","confidence","detail","provenance"],"properties":{"code":{"type":"string","maxLength":80},"label":{"type":"string","maxLength":300},"confidence":{"type":"string","enum":["verified","inferred","unknown"]},"detail":{"type":"string","maxLength":4000},"provenance":{"type":"array","items":{"type":"object","required":["evidence_id","source","collected_at","collector"],"properties":{"evidence_id":{"type":"string","maxLength":64},"source":{"type":"string","maxLength":40},"collected_at":{"$ref":"#/components/schemas/Timestamp"},"collector":{"type":"string","maxLength":200}}}}}}},"coverage":{"type":"object","required":["dimensions","known","verified"],"properties":{"dimensions":{"type":"integer"},"known":{"type":"integer"},"verified":{"type":"integer"}}},"detected_gateway":{"type":"object"},"untrusted_content":{"type":"boolean"},"evidence_count":{"type":"integer"},"note":{"type":"string","maxLength":300}},"description":"An assessment of the submitted evidence together with what is stored. Nothing is stored."},"MigrationEventId":{"title":"MigrationEventId","description":"Opaque identifier with prefix `mev_`.","type":"string","pattern":"^mev_[a-z0-9_]+$","maxLength":64,"examples":["mev_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"MigrationExecution":{"title":"MigrationExecution","type":"object","required":["id","workspace_id","plan_id","plan_hash","state","steps","version","created_at"],"properties":{"id":{"$ref":"#/components/schemas/MigrationExecutionId"},"workspace_id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"plan_id":{"$ref":"#/components/schemas/MigrationPlanId"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"execution_mode":{"type":"string","enum":["guided","automated","agent"]},"state":{"type":"string","enum":["running","waiting","succeeded","failed","compensating","rolled_back","cancelled"]},"workspace_status":{"type":"string","enum":["draft","discovery","plan_ready","awaiting_approvals","approved","staging","validating","cutover_pending","active","blocked","failed","rollback_pending","rolled_back","cancelled"]},"waiting_on":{},"steps":{"type":"array","items":{"type":"object","required":["ordinal","operation","state","idempotency_key","attempts"],"properties":{"id":{"$ref":"#/components/schemas/MigrationStepId"},"ordinal":{"type":"integer"},"operation":{"type":"string","maxLength":60},"side":{"type":"string","maxLength":20},"permission_kind":{"type":"string","maxLength":40},"target_ref":{"type":"string","maxLength":160},"state":{"type":"string","enum":["pending","running","waiting","succeeded","failed","skipped","cancelled"]},"gate":{"type":["string","null"]},"idempotency_key":{"type":"string","maxLength":120},"attempts":{"type":"integer"},"max_attempts":{"type":"integer"},"next_attempt_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"deadline_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"receipt_ref":{"type":["string","null"]},"before_fingerprint":{"type":["string","null"]},"after_fingerprint":{"type":["string","null"]},"error_code":{"type":["string","null"]},"detail":{},"compensation_state":{"type":"string","maxLength":20},"compensation_ref":{"type":["string","null"]},"started_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"finished_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}}},"events":{"type":"array","items":{"type":"object","required":["type","created_at"],"properties":{"id":{"$ref":"#/components/schemas/MigrationEventId"},"type":{"type":"string","maxLength":60},"step_ordinal":{"type":["integer","null"]},"detail":{},"created_at":{"$ref":"#/components/schemas/Timestamp"}}}},"cutover_requested_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"rollback_requested_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"rollback":{"type":["object","null"],"description":"Rollback record: what was undone, what is irreversible, what needs a person."},"version":{"type":"integer"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"},"finished_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}},"description":"A durable execution of one plan version: steps with idempotency keys, receipts and fingerprints, and its immutable event log."},"MigrationExecutionAdvanceRequestedDataV1":{"title":"MigrationExecutionAdvanceRequestedDataV1","type":"object","required":["workspace_id","execution_id"],"properties":{"workspace_id":{"type":"string","pattern":"^cws_[a-z0-9_]+$","maxLength":64},"execution_id":{"type":"string","pattern":"^mex_[a-z0-9_]+$","maxLength":64},"cause":{"type":"string","maxLength":60}}},"MigrationExecutionId":{"title":"MigrationExecutionId","description":"Opaque identifier with prefix `mex_`.","type":"string","pattern":"^mex_[a-z0-9_]+$","maxLength":64,"examples":["mex_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"MigrationHandoverGeneratedDataV1":{"title":"MigrationHandoverGeneratedDataV1","type":"object","required":["workspace_id","handover_id"],"properties":{"workspace_id":{"type":"string","pattern":"^cws_[a-z0-9_]+$","maxLength":64},"handover_id":{"type":"string","pattern":"^hor_[a-z0-9_]+$","maxLength":64},"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"audience":{"type":"string","enum":["owner","consumer"]}}},"MigrationPlan":{"title":"MigrationPlan","type":"object","required":["id","workspace_id","version","plan_hash","status","content","created_at"],"properties":{"id":{"$ref":"#/components/schemas/MigrationPlanId"},"workspace_id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"version":{"type":"integer"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"status":{"type":"string","enum":["proposed","approved","executing","completed","rolled_back","superseded","rejected"]},"environment":{"$ref":"#/components/schemas/Environment"},"execution_mode":{"type":"string","enum":["guided","automated","agent"]},"content":{"$ref":"#/components/schemas/MigrationPlanV1"},"evidence_snapshot_ref":{"$ref":"#/components/schemas/MigrationAssessmentId"},"approvals":{"type":"array","items":{"$ref":"#/components/schemas/MigrationApproval"}},"approvals_outstanding":{"type":"array","items":{"type":"object"}},"invalidated_approvals":{"type":"array","items":{"$ref":"#/components/schemas/MigrationApprovalId"},"description":"Approvals of earlier versions this replan invalidated."},"created_by":{"type":"object","required":["user_id"],"properties":{"user_id":{"type":"string","maxLength":64},"display_name":{"type":["string","null"]}}},"created_at":{"$ref":"#/components/schemas/Timestamp"},"approved_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"superseded_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}},"description":"One immutable plan version with its approvals."},"MigrationPlanCreatedDataV1":{"title":"MigrationPlanCreatedDataV1","type":"object","required":["workspace_id","plan_id","plan_hash"],"properties":{"workspace_id":{"type":"string","pattern":"^cws_[a-z0-9_]+$","maxLength":64},"plan_id":{"type":"string","pattern":"^mpl_[a-z0-9_]+$","maxLength":64},"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"version":{"type":"integer","minimum":1}}},"MigrationPlanId":{"title":"MigrationPlanId","description":"Opaque identifier with prefix `mpl_`.","type":"string","pattern":"^mpl_[a-z0-9_]+$","maxLength":64,"examples":["mpl_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"MigrationPlanPreview":{"title":"MigrationPlanPreview","type":"object","required":["preview","workspace_id","version","plan_hash","content","would_invalidate_approvals"],"properties":{"preview":{"const":true},"workspace_id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"version":{"type":"integer"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"content":{"$ref":"#/components/schemas/MigrationPlanV1"},"evidence_snapshot_ref":{"$ref":"#/components/schemas/MigrationAssessmentId"},"would_invalidate_approvals":{"type":"array","items":{"$ref":"#/components/schemas/MigrationApprovalId"}},"note":{"type":"string","maxLength":300}},"description":"The plan version that would be drafted now, with its hash. Nothing is stored and no approval is invalidated."},"MigrationPlanReadiness":{"title":"MigrationPlanReadiness","type":"object","required":["plan_id","plan_hash","plan_status","workspace_status","actor_ref","checks","can_start","can_request_cutover","next"],"properties":{"plan_id":{"$ref":"#/components/schemas/MigrationPlanId"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"plan_status":{"type":"string","maxLength":20},"workspace_status":{"type":"string","enum":["draft","discovery","plan_ready","awaiting_approvals","approved","staging","validating","cutover_pending","active","blocked","failed","rollback_pending","rolled_back","cancelled"]},"actor_ref":{"type":"string","maxLength":80},"execution":{"anyOf":[{"type":"object","required":["id","state"],"properties":{"id":{"$ref":"#/components/schemas/MigrationExecutionId"},"state":{"type":"string","maxLength":20},"cutover_requested_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"validation_state":{"type":["string","null"]}}},{"type":"null"}]},"checks":{"type":"array","items":{"type":"object","required":["permission_kind","side","action","target_ref","status"],"properties":{"permission_kind":{"type":"string","maxLength":40},"side":{"type":"string","maxLength":20},"action":{"type":"string","maxLength":40},"target_ref":{"type":"string","maxLength":160},"status":{"type":"string","description":"usable, or the approval failure code (approval_actor_mismatch, approval_expired, migration_approval_missing, ...)."},"approval_id":{"anyOf":[{"$ref":"#/components/schemas/MigrationApprovalId"},{"type":"null"}]},"pending_request_id":{"anyOf":[{"$ref":"#/components/schemas/MigrationApprovalRequestId"},{"type":"null"}]},"optional":{"type":"boolean"}}}},"pending_requests":{"type":"integer"},"can_start":{"type":"boolean"},"can_request_cutover":{"type":"boolean"},"next":{"type":"string","enum":["request_approvals","start_execution","wait_for_steps","request_cutover_approvals","request_cutover","replan","done"]}},"description":"Every required approval checked as the action would check it for this caller, without changing anything."},"MigrationPlanV1":{"title":"MigrationPlanV1","type":"object","required":["schema","workspace_id","version","environment","execution_mode","summary","parties","steps","approvals_required","tests","rollback","cutover"],"properties":{"schema":{"const":"mt.migration-plan.v1"},"workspace_id":{"$ref":"#/components/schemas/ConnectionWorkspaceId"},"version":{"type":"integer"},"environment":{"$ref":"#/components/schemas/Environment"},"execution_mode":{"type":"string","enum":["guided","automated","agent"]},"parties":{"type":"array","items":{"type":"object"}},"summary":{"type":"object","required":["why","stays","changes"],"properties":{"why":{"type":"string","maxLength":1000},"deadline":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"stays":{"type":"array","items":{"type":"string","maxLength":500}},"changes":{"type":"array","items":{"type":"string","maxLength":500}}}},"evidence_snapshot":{"type":"object"},"desired_state":{"type":"object"},"steps":{"type":"array","items":{"type":"object","required":["ordinal","operation","side","permission_kind","target_ref","description","approval_required"],"properties":{"ordinal":{"type":"integer"},"operation":{"type":"string","maxLength":60},"side":{"type":"string","enum":["owner","consumer"]},"permission_kind":{"type":"string","enum":["request","identity_proof","trust_anchor_acceptance","resource_authorization","configuration_execution","production_cutover"]},"target_ref":{"type":"string","maxLength":160},"performed_by":{"type":"string","maxLength":40},"description":{"type":"string","maxLength":1000},"approval_required":{"type":"boolean"},"compensation":{},"timeout_seconds":{"type":"integer"}}}},"approvals_required":{"type":"array","items":{"type":"object","required":["permission_kind","side","action","target_ref"],"properties":{"permission_kind":{"type":"string","maxLength":40},"side":{"type":"string","maxLength":20},"action":{"type":"string","maxLength":40},"target_ref":{"type":"string","maxLength":160},"reason":{"type":"string","maxLength":1000}}}},"tests":{"type":"array","items":{"type":"object","required":["id","kind","expect"],"properties":{"id":{"type":"string","maxLength":80},"kind":{"type":"string","enum":["positive","negative"]},"description":{"type":"string","maxLength":500},"client":{"type":"string","maxLength":60},"expect":{"type":"string","maxLength":10},"after_cutover":{"type":"boolean"}}}},"impact":{"type":"object"},"cutover":{"type":"object","required":["strategy"],"properties":{"strategy":{"type":"string","enum":["parallel_trust","maintenance_window"]},"detail":{"type":"string","maxLength":1000}}},"rollback":{"type":"object","required":["feasible"],"properties":{"feasible":{"type":"boolean"},"detail":{"type":"string","maxLength":1000},"irreversible":{"type":"array","items":{"type":"string","maxLength":300}}}},"limitations":{"type":"array","items":{"type":"string","maxLength":1000}}},"description":"The immutable plan document. plan_hash is the SHA-256 (hex) of its canonical JSON (sorted keys, the same canonicalization as adapter plans). Plain-language summary and per-party technical changes."},"MigrationStepId":{"title":"MigrationStepId","description":"Opaque identifier with prefix `mst_`.","type":"string","pattern":"^mst_[a-z0-9_]+$","maxLength":64,"examples":["mst_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"MigrationWorkspaceChangedDataV1":{"title":"MigrationWorkspaceChangedDataV1","type":"object","required":["workspace_id","status"],"properties":{"workspace_id":{"type":"string","pattern":"^cws_[a-z0-9_]+$","maxLength":64},"status":{"type":"string","enum":["draft","discovery","plan_ready","awaiting_approvals","approved","staging","validating","cutover_pending","active","blocked","failed","rollback_pending","rolled_back","cancelled"]},"from":{"type":"string"}}},"NamedRef":{"title":"NamedRef","type":"object","required":["id"],"properties":{"id":{"type":"string"},"name":{"type":["string","null"]},"contact":{"type":["string","null"]}}},"OffboardingId":{"title":"OffboardingId","description":"Opaque identifier with prefix `ofb_`.","type":"string","pattern":"^ofb_[a-z0-9_]+$","maxLength":64,"examples":["ofb_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"OffboardingStatus":{"title":"OffboardingStatus","type":"object","required":["offboarding","checklist","deletion_suspended"],"properties":{"offboarding":{"anyOf":[{"type":"object","required":["id","state","requested_at","revision"],"properties":{"id":{"$ref":"#/components/schemas/OffboardingId"},"tenant_id":{"$ref":"#/components/schemas/OrgId"},"state":{"type":"string","enum":["requested","exported","scheduled","terminated","canceled"]},"reason":{"type":"string"},"requested_at":{"$ref":"#/components/schemas/Timestamp"},"exported_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"export_sha256":{"type":["string","null"]},"terminate_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"terminated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"canceled_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"revision":{"type":"integer"}}},{"type":"null"}]},"checklist":{"type":"object","required":["items","ready","missing"],"properties":{"items":{"type":"array","items":{"type":"object","required":["key","label","done","required"],"properties":{"key":{"type":"string"},"label":{"type":"string"},"done":{"type":"boolean"},"required":{"type":"boolean"},"count":{"type":"integer"}}}},"ready":{"type":"boolean"},"missing":{"type":"array","items":{"type":"string"}}}},"deletion_suspended":{"type":"boolean"},"notice_days":{"type":"object"},"bundle":{"$ref":"#/components/schemas/SignedBundle"}}},"Operation":{"title":"Operation","type":"object","required":["id","kind","state","gateways"],"properties":{"id":{"$ref":"#/components/schemas/OperationId"},"kind":{"type":"string"},"resource_id":{"type":"string"},"effective_control_plane_time":{"type":"string","format":"date-time"},"target_policy_revision":{"anyOf":[{"$ref":"#/components/schemas/PolicyRevisionRef"},{"type":"null"}]},"state":{"type":"string","enum":["publishing","awaiting_acknowledgments","complete"]},"gateways":{"type":"array","items":{"$ref":"#/components/schemas/OperationGateway"}},"note":{"type":"string"}}},"OperationGateway":{"title":"OperationGateway","type":"object","required":["gateway_id","status"],"properties":{"gateway_id":{"$ref":"#/components/schemas/GatewayId"},"name":{"type":"string"},"status":{"type":"string","enum":["applied","delivered","offline_pending","pending"]},"delivered_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"applied_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"apply_latency_seconds":{"type":["integer","null"]}}},"OperationId":{"title":"OperationId","description":"Opaque identifier with prefix `op_`.","type":"string","pattern":"^op_[a-z0-9_]+$","maxLength":64,"examples":["op_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"Organization":{"title":"Organization","type":"object","required":["id","name"],"properties":{"id":{"$ref":"#/components/schemas/OrgId"},"name":{"type":"string"},"kind":{"type":"string","enum":["customer","sample"]},"domain_verification":{"type":["string","null"]},"roles":{"type":"array","items":{"$ref":"#/components/schemas/CustomerRole"}},"partner_handle":{"type":["string","null"],"description":"Shareable handle API owners use to invite this organization (members only)."},"data_region":{"type":"string","description":"Data region (only us today; see GET /v1/organizations/{id}/data-governance)."}}},"OrganizationApprovalPolicy":{"title":"OrganizationApprovalPolicy","type":"object","required":["tenant_id","effective","floor","scopes"],"properties":{"tenant_id":{"$ref":"#/components/schemas/OrgId"},"effective":{"$ref":"#/components/schemas/ApprovalPolicySummary"},"floor":{"type":"object","required":["policy","sources"],"properties":{"policy":{"$ref":"#/components/schemas/ApprovalPolicyV1"},"sources":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/ApprovalPolicySource"}}}},"scopes":{"type":"array","description":"Every scope in the organization that sets anything (platform and tenant included), outermost first.","items":{"type":"object","required":["scope_type","scope_id","revision","fields"],"properties":{"scope_type":{"$ref":"#/components/schemas/ApprovalScopeType"},"scope_id":{"type":"string"},"revision":{"type":"integer","minimum":0},"fields":{"type":"object","properties":{"min_approver_age_hours":{"type":"integer","minimum":0,"maximum":720},"require_second_approver":{"type":"boolean"},"require_step_up":{"type":"boolean"},"step_up_max_age_minutes":{"type":"integer","minimum":1,"maximum":60},"independence":{"type":"string","enum":["strict","standard"]}}},"name":{"type":["string","null"]},"updated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}}}},"description":"Organization-wide view: the effective policy for sponsor-review grant approvals at organization level and every scope that sets a value."},"OrganizationCreated":{"title":"OrganizationCreated","type":"object","required":["id","name","kind"],"properties":{"id":{"$ref":"#/components/schemas/OrgId"},"name":{"type":"string"},"kind":{"type":"string","enum":["customer","sample"]}},"examples":[{"id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","name":"Northstar","kind":"customer"}]},"OrganizationTerminatedDataV1":{"title":"OrganizationTerminatedDataV1","type":"object","required":["org_id","offboarding_id"],"properties":{"org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"offboarding_id":{"type":"string","pattern":"^ofb_[a-z0-9_]+$","maxLength":64}}},"OrganizationVerificationChangedDataV1":{"title":"OrganizationVerificationChangedDataV1","type":"object","required":["org_id","kind","state"],"properties":{"org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"kind":{"type":"string","enum":["domain_control","legal_entity","production_access","invoice_terms"]},"state":{"type":"string","enum":["verified","failed","expired","approved","rejected","declined","active","ended"]},"resource_id":{"type":"string","pattern":"^(dom|lev|prq|etm)_[a-z0-9_]+$","maxLength":64}}},"OrgHandle":{"title":"OrgHandle","description":"Shareable, non-guessable organization handle (lowercase letters, digits and hyphens).","type":"string","pattern":"^[a-z0-9]+(-[a-z0-9]+)*$","minLength":6,"maxLength":64,"examples":["harbor-7kq2m9xd"]},"OrgId":{"title":"OrgId","description":"Opaque identifier with prefix `org_`.","type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64,"examples":["org_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"OriginCheckCreated":{"title":"OriginCheckCreated","type":"object","required":["id","service_id","origin_url","token","expires_at","command"],"properties":{"id":{"$ref":"#/components/schemas/OriginCheckId"},"service_id":{"$ref":"#/components/schemas/ServiceId"},"origin_url":{"type":"string"},"token":{"type":"string","pattern":"^mtoc_","description":"One-time check token (shown once, valid for an hour). It keys the HMAC over the result."},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"command":{"type":"string","description":"Run from a machine outside the private network."},"note":{"type":"string"}}},"OriginCheckId":{"title":"OriginCheckId","description":"Opaque identifier with prefix `och_`.","type":"string","pattern":"^och_[a-z0-9_]+$","maxLength":64,"examples":["och_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"OriginCheckRecorded":{"title":"OriginCheckRecorded","type":"object","required":["id","service_id","state","outcome","passed"],"properties":{"id":{"$ref":"#/components/schemas/OriginCheckId"},"service_id":{"$ref":"#/components/schemas/ServiceId"},"state":{"type":"string","enum":["closed","reachable"]},"outcome":{"type":"string"},"completed_at":{"$ref":"#/components/schemas/Timestamp"},"passed":{"type":"boolean"}}},"OriginCheckResult":{"title":"OriginCheckResult","type":"object","additionalProperties":false,"required":["result","signature"],"properties":{"result":{"type":"object","additionalProperties":false,"required":["check_id","origin_url","outcome","observed_at"],"properties":{"check_id":{"type":"string","pattern":"^och_[a-z0-9_]+$","maxLength":64},"origin_url":{"type":"string","maxLength":2000},"outcome":{"type":"string","enum":["connection_refused","timeout","dns_failure","tls_rejected","http_rejected","reachable"]},"detail":{"type":"string","maxLength":200},"observed_at":{"type":"string","pattern":"^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"},"cli_version":{"type":"string","maxLength":40}}},"signature":{"type":"string","pattern":"^[A-Za-z0-9_-]{43}$","description":"base64url HMAC-SHA256 over the canonical JSON of result, keyed by the check token."}}},"Overview":{"title":"Overview","type":"object","required":["user","organizations","spaces","services","relationships","alerts"],"properties":{"user":{"type":"object","required":["id"],"properties":{"id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"auth_method":{"type":"string"}}},"organizations":{"type":"array","items":{"$ref":"#/components/schemas/Organization"}},"spaces":{"type":"array","items":{"type":"object","required":["id","tenant_id","name","environment"],"properties":{"id":{"$ref":"#/components/schemas/SpaceId"},"tenant_id":{"$ref":"#/components/schemas/OrgId"},"name":{"type":"string"},"environment":{"$ref":"#/components/schemas/Environment"},"trust_fingerprint":{"type":["string","null"]}}}},"services":{"type":"array","items":{"type":"object","required":["id","tenant_id","space_id","name","environment"],"properties":{"id":{"$ref":"#/components/schemas/ServiceId"},"tenant_id":{"$ref":"#/components/schemas/OrgId"},"space_id":{"$ref":"#/components/schemas/SpaceId"},"name":{"type":"string"},"environment":{"$ref":"#/components/schemas/Environment"},"active_grants":{"type":"integer"},"pending_grants":{"type":"integer"},"gateways":{"type":"integer"},"stale_gateways":{"type":"integer"},"last_allow":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}}},"relationships":{"type":"array","items":{"type":"object","required":["id","state"],"properties":{"id":{"$ref":"#/components/schemas/GrantId"},"state":{"$ref":"#/components/schemas/GrantState"},"consumer_org_id":{"$ref":"#/components/schemas/OrgId"},"sponsor_org_id":{"$ref":"#/components/schemas/OrgId"},"service_name":{"type":"string"},"sponsor_name":{"type":"string"},"consumer_name":{"type":"string"},"workload_name":{"type":"string"},"cert_expires_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"renew_after":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}}},"alerts":{"type":"array","items":{"type":"object","required":["level","message"],"properties":{"level":{"type":"string","enum":["warning","info"]},"message":{"type":"string"},"href":{"type":"string"}}}}}},"OwnerRecovery":{"title":"OwnerRecovery","type":"object","required":["id","org_id","domain","state","record","contact","created_at"],"properties":{"id":{"$ref":"#/components/schemas/OwnerRecoveryRequestId"},"org_id":{"$ref":"#/components/schemas/OrgId"},"domain":{"type":"string"},"state":{"type":"string","enum":["submitted","in_review","approved","rejected","canceled","completed","expired"]},"record":{"anyOf":[{"type":"object","required":["type","name","value"],"properties":{"type":{"const":"TXT"},"name":{"type":"string"},"value":{"type":"string"}}},{"type":"null"}],"description":"The fresh DNS TXT challenge to publish (shown to the requester only)."},"dns_verified_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"dns_last_result":{"type":["string","null"]},"contact":{"type":"object","required":["name","title","email"],"properties":{"name":{"type":"string"},"title":{"type":"string"},"email":{"type":"string"},"phone":{"type":["string","null"]}}},"requester_user_id":{"$ref":"#/components/schemas/UserId"},"reviewed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"decided_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"decision_reason":{"type":["string","null"]},"bootstrap_expires_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}],"description":"Approved recoveries must be claimed by the named identity before this time."},"completed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"}}},"OwnerRecoveryCompletedDataV1":{"title":"OwnerRecoveryCompletedDataV1","type":"object","required":["recovery_id","org_id","user_id"],"properties":{"recovery_id":{"type":"string","pattern":"^orr_[a-z0-9_]+$","maxLength":64},"org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"user_id":{"type":"string","pattern":"^usr_[a-z0-9_]+$","maxLength":64}}},"OwnerRecoveryList":{"title":"OwnerRecoveryList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/OwnerRecovery"}}}},"OwnerRecoveryRequestId":{"title":"OwnerRecoveryRequestId","description":"Opaque identifier with prefix `orr_`.","type":"string","pattern":"^orr_[a-z0-9_]+$","maxLength":64,"examples":["orr_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"PairingCreated":{"title":"PairingCreated","type":"object","required":["pairing_id","code","poll_secret","expires_at","key_thumbprint","approve_url"],"properties":{"pairing_id":{"$ref":"#/components/schemas/PairingId"},"code":{"type":"string","pattern":"^[A-Z0-9]{4}-[A-Z0-9]{4}$"},"poll_secret":{"type":"string"},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"key_thumbprint":{"type":"string"},"approve_url":{"type":"string","format":"uri"}}},"PairingId":{"title":"PairingId","description":"Opaque identifier with prefix `pair_`.","type":"string","pattern":"^pair_[a-z0-9_]+$","maxLength":64,"examples":["pair_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"PairingStatus":{"title":"PairingStatus","anyOf":[{"type":"object","required":["state"],"properties":{"state":{"type":"string","enum":["pending","expired","collected","approved"]}}},{"type":"object","required":["state","gateway_id","tenant_id","service_id","environment","credential","manifest_url","policy_verification_key","refresh_seconds"],"properties":{"state":{"const":"approved"},"gateway_id":{"$ref":"#/components/schemas/GatewayId"},"tenant_id":{"$ref":"#/components/schemas/OrgId"},"service_id":{"$ref":"#/components/schemas/ServiceId"},"environment":{"$ref":"#/components/schemas/Environment"},"credential":{"type":"string","pattern":"^mtgw_","description":"Gateway credential; delivered exactly once."},"manifest_url":{"type":"string","format":"uri"},"policy_verification_key":{"type":"object","required":["kid","alg","jwk"],"properties":{"kid":{"type":"string"},"alg":{"const":"ES256"},"jwk":{"type":"object","required":["kty","crv","x","y"],"properties":{"kty":{"const":"EC"},"crv":{"const":"P-256"},"x":{"type":"string"},"y":{"type":"string"}}}}},"refresh_seconds":{"type":"integer"}}}]},"PartnerHandle":{"title":"PartnerHandle","type":"object","required":["org_id","handle"],"properties":{"org_id":{"$ref":"#/components/schemas/OrgId"},"handle":{"$ref":"#/components/schemas/OrgHandle"},"rotated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"note":{"type":"string"}}},"PartnerHandleLookup":{"title":"PartnerHandleLookup","type":"object","required":["handle","organization_name"],"properties":{"handle":{"$ref":"#/components/schemas/OrgHandle"},"organization_name":{"type":"string"}},"description":"Only the display name is revealed; invite with consumer.org_handle."},"Passkey":{"title":"Passkey","type":"object","required":["id","name","created_at"],"properties":{"id":{"$ref":"#/components/schemas/PasskeyId"},"name":{"type":"string"},"authenticator":{"type":["string","null"]},"synced":{"type":"boolean"},"backup_eligible":{"type":"boolean"},"transports":{"type":"array","items":{"type":"string"}},"created_at":{"$ref":"#/components/schemas/Timestamp"},"last_used_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}},"PasskeyCreationOptions":{"title":"PasskeyCreationOptions","type":"object","required":["rp","user","challenge","pubKeyCredParams"],"properties":{"rp":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string"},"name":{"type":"string"}}},"user":{"type":"object","required":["id","name","displayName"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"displayName":{"type":"string"}}},"challenge":{"type":"string"},"pubKeyCredParams":{"type":"array"},"timeout":{"type":"integer"},"attestation":{"type":"string"}},"description":"PublicKeyCredentialCreationOptionsJSON (W3C WebAuthn Level 3)."},"PasskeyId":{"title":"PasskeyId","description":"Opaque identifier with prefix `pk_`.","type":"string","pattern":"^pk_[a-z0-9_]+$","maxLength":64,"examples":["pk_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"PasskeyList":{"title":"PasskeyList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Passkey"}},"account":{"type":"object","required":["user_id"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"email":{"type":["string","null"]},"created_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"sign_in":{"type":"string","enum":["passkey","sandbox_guest","organization_sso"]},"current_session":{"type":"string"}}},"min_passkeys":{"type":"integer"},"can_add":{"type":"boolean"}}},"PasskeyRemoved":{"title":"PasskeyRemoved","type":"object","required":["id","removed"],"properties":{"id":{"$ref":"#/components/schemas/PasskeyId"},"removed":{"const":true}}},"PauseAgentRun":{"title":"PauseAgentRun","type":"object","additionalProperties":false,"properties":{"reason":{"type":"string","maxLength":200}}},"Pem":{"title":"Pem","type":"string","pattern":"^-----BEGIN [A-Z ]+-----"},"PersonalDataExport":{"title":"PersonalDataExport","type":"object","required":["privacy_request_id","bundle"],"properties":{"privacy_request_id":{"$ref":"#/components/schemas/PrivacyRequestId"},"bundle":{"$ref":"#/components/schemas/SignedBundle"}}},"PlanDecision":{"title":"PlanDecision","type":"object","required":["integration_id","plan_hash","state","revision","approval"],"properties":{"integration_id":{"$ref":"#/components/schemas/IntegrationId"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"state":{"type":"string","enum":["approved","rejected"]},"revision":{"type":"integer","minimum":1,"description":"New integration revision (ETag)."},"approval":{"$ref":"#/components/schemas/ApprovalRecord"},"approval_policy":{"$ref":"#/components/schemas/ApprovalPolicySummary","description":"Approvals: the approval policy the approver was checked against."}}},"PlanSubmission":{"title":"PlanSubmission","type":"object","required":["id","integration_id","plan_hash","kind","state","adapter_id","adapter_version","desired_state_fingerprint","created_at"],"properties":{"id":{"$ref":"#/components/schemas/IntegrationPlanId"},"integration_id":{"$ref":"#/components/schemas/IntegrationId"},"plan_hash":{"$ref":"#/components/schemas/Sha256Hex"},"kind":{"type":"string","enum":["plan","rollback"]},"state":{"type":"string","enum":["pending","approved","rejected"]},"adapter_id":{"type":"string"},"adapter_version":{"type":"string"},"mode":{"type":["string","null"]},"platform_version":{"type":["string","null"]},"desired_state_fingerprint":{"$ref":"#/components/schemas/Sha256Hex"},"desired_revision":{"type":"integer"},"inspection_fingerprint":{"type":"string"},"after_fingerprint":{"type":["string","null"]},"forward_plan_hash":{"anyOf":[{"$ref":"#/components/schemas/Sha256Hex"},{"type":"null"}]},"current":{"type":"boolean","description":"The desired state still has the fingerprint this plan was computed against."},"diff":{"type":"string","description":"Redacted, human-readable unified diff."},"changes":{"type":"array","items":{"type":"object","required":["id","kind","action","summary"],"properties":{"id":{"type":"string"},"kind":{"type":"string"},"action":{"type":"string"},"summary":{"type":"string"},"settings":{"type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"type":"string"},"scope":{"type":"string"},"before":{"type":"string"},"after":{"type":"string"}}}},"files":{"type":"array","items":{"type":"object","required":["path","role"],"properties":{"path":{"type":"string"},"role":{"type":"string"},"before_sha256":{"type":"string"},"after_sha256":{"type":"string"}}}}}}},"test_vectors":{"type":"array","items":{"type":"object"}},"parallel_trust":{"anyOf":[{"type":"object","required":["supported","detail"],"properties":{"supported":{"type":"boolean"},"detail":{"type":"string"}}},{"type":"null"}]},"rollback":{"anyOf":[{"type":"object","required":["supported","detail"],"properties":{"supported":{"type":"boolean"},"detail":{"type":"string"}}},{"type":"null"}]},"findings":{"type":"array","items":{"type":"object"}},"limitations":{"type":"array","items":{"type":"string"}},"guided_steps":{"type":"array","items":{"type":"string"}},"submitted_by":{"title":"UserRef","type":"object","required":["user_id"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"auth_method":{"type":"string"},"via":{"type":"string","enum":["session","api_key"]}}},"approval":{"anyOf":[{"$ref":"#/components/schemas/ApprovalRecord"},{"type":"null"}]},"created":{"type":"boolean","description":"false when the plan hash was already submitted (idempotent by plan hash)."},"created_at":{"$ref":"#/components/schemas/Timestamp"},"decided_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}},"description":"A plan (or rollback artifact) submitted by the runtime, stored with its redacted diff. Idempotent by plan hash."},"PlanSubmissionList":{"title":"PlanSubmissionList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/PlanSubmission"}}}},"PolicyPublishRequestedDataV1":{"title":"PolicyPublishRequestedDataV1","type":"object","required":["service_id"],"properties":{"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64},"cause":{"type":"string","maxLength":80}}},"PolicyRevision":{"title":"PolicyRevision","type":"object","required":["epoch","revision","policy_hash"],"properties":{"epoch":{"type":"integer"},"revision":{"type":"integer"},"policy_hash":{"$ref":"#/components/schemas/Sha256Hex"},"created_at":{"type":"string","format":"date-time"},"cause":{"type":"string"}}},"PolicyRevisionRef":{"title":"PolicyRevisionRef","type":"object","required":["epoch","revision"],"properties":{"epoch":{"type":"integer"},"revision":{"type":"integer"}}},"PortalSession":{"title":"PortalSession","type":"object","required":["url"],"properties":{"url":{"type":"string","format":"uri"}}},"PrivacyRequestId":{"title":"PrivacyRequestId","description":"Opaque identifier with prefix `prv_`.","type":"string","pattern":"^prv_[a-z0-9_]+$","maxLength":64,"examples":["prv_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"PrivacySigningKeys":{"title":"PrivacySigningKeys","type":"object","required":["keys"],"properties":{"keys":{"type":"array","items":{"type":"object","required":["kty","crv","x","kid"],"properties":{"kty":{"const":"OKP"},"crv":{"const":"Ed25519"},"x":{"type":"string"},"kid":{"type":"string"},"alg":{"type":"string"},"use":{"type":"string"}}}},"format":{"type":"string"},"signature_input":{"type":"string"}}},"Problem":{"title":"Problem","type":"object","required":["type","title","status","code"],"properties":{"type":{"type":"string","format":"uri"},"title":{"type":"string"},"status":{"type":"integer","minimum":400,"maximum":599},"code":{"type":"string","pattern":"^[a-z][a-z0-9_]*$","description":"Stable machine code from the error catalogue (packages/contracts/src/errors.ts)."},"detail":{"type":"string"},"instance":{"type":"string"},"request_id":{"type":"string"},"errors":{"type":"array","items":{"type":"object","required":["path","message"],"properties":{"path":{"type":"string"},"message":{"type":"string"}}}},"retry_after":{"type":"integer"}},"description":"RFC 9457 problem details.","examples":[{"type":"https://mutualtrust.io/problems/revision_mismatch","title":"The resource changed since you last read it. Reload and retry.","status":412,"code":"revision_mismatch","instance":"/v1/grants/gr_01jq3v8m2k9x4h7c5n6p0r1s2t/revoke","request_id":"req_01jq3v8m2k9x4h7c5n6p0r1s2t"}]},"ProductionAccessRequest":{"title":"ProductionAccessRequest","type":"object","required":["id","org_id","state","created_at"],"properties":{"id":{"$ref":"#/components/schemas/ProductionAccessRequestId"},"org_id":{"$ref":"#/components/schemas/OrgId"},"state":{"type":"string","enum":["requested","in_review","approved","declined","withdrawn"]},"assurance":{"type":"string","enum":["domain_control","legal_entity"]},"decided_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"decision_reason":{"type":["string","null"],"description":"Set when the request was declined."},"contact_email":{"type":["string","null"]},"use_case":{"type":["string","null"]},"requested_by_user_id":{"$ref":"#/components/schemas/UserId"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"},"already_requested":{"type":"boolean"}}},"ProductionAccessRequestId":{"title":"ProductionAccessRequestId","description":"Opaque identifier with prefix `prq_`.","type":"string","pattern":"^prq_[a-z0-9_]+$","maxLength":64,"examples":["prq_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"ProductionAccessRequestList":{"title":"ProductionAccessRequestList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ProductionAccessRequest"}},"open":{"type":"boolean"}}},"ProductionReadiness":{"title":"ProductionReadiness","type":"object","required":["org_id","domain_control","legal_entity","production_access","entitlement","missing","checklist","ready"],"properties":{"org_id":{"$ref":"#/components/schemas/OrgId"},"organization_kind":{"type":["string","null"]},"domain_control":{"type":"object","required":["label","verified"],"properties":{"label":{"const":"Domain control verified"},"verified":{"type":"boolean"},"domain":{"type":["string","null"]},"verified_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"expires_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}}},"legal_entity":{"type":"object","required":["label","verified","state"],"properties":{"label":{"const":"Legal entity verified"},"verified":{"type":"boolean"},"state":{"type":"string"},"legal_name":{"type":["string","null"]},"jurisdiction":{"type":["string","null"]},"verified_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}}},"production_access":{"type":"object","required":["approved","state"],"properties":{"approved":{"type":"boolean"},"state":{"type":"string"},"request_id":{"anyOf":[{"$ref":"#/components/schemas/ProductionAccessRequestId"},{"type":"null"}]},"assurance":{"type":["string","null"]}}},"entitlement":{"type":"object","required":["active","source","connections"],"properties":{"active":{"type":"boolean"},"source":{"type":["string","null"],"enum":["subscription","invoice_terms",null]},"connections":{"type":"integer"},"invoice_terms":{"anyOf":[{"type":"object","required":["id","connections","effective_from"],"properties":{"id":{"$ref":"#/components/schemas/EntitlementTermsId"},"connections":{"type":"integer"},"effective_from":{"type":"string","format":"date-time"},"effective_until":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"reference":{"type":["string","null"]}}},{"type":"null"}]}}},"missing":{"type":"array","items":{"type":"string","enum":["verified_domain","production_access","entitlement","legal_entity"]}},"checklist":{"type":"array","items":{"$ref":"#/components/schemas/ReadinessStep"}},"ready":{"type":"boolean"}},"description":"What the organization still needs before it can create production spaces and services. Domain control and legal entity are separate verifications."},"PutScimRoleMappings":{"title":"PutScimRoleMappings","description":"Replaces the group to role mapping. Group names match SCIM displayName case-insensitively; the owner role is never mappable.","type":"object","additionalProperties":false,"required":["mappings"],"properties":{"mappings":{"type":"array","maxItems":50,"items":{"type":"object","additionalProperties":false,"required":["group","roles"],"properties":{"group":{"type":"string","minLength":1,"maxLength":200,"pattern":"\\S"},"roles":{"type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string","enum":["trust_admin","service_owner","partner_admin","billing_admin","auditor"]}}}}}}},"ReadinessStep":{"title":"ReadinessStep","type":"object","required":["step","label","ok"],"properties":{"step":{"type":"string"},"label":{"type":"string"},"ok":{"type":"boolean"},"detail":{"type":["string","null"],"description":"What is missing, or the evidence that passed this step."}}},"Receipt":{"title":"Receipt","type":"object","required":["receipt_id","gateway_id","tls_verdict","authz_verdict","authz_reason","observed_at"],"properties":{"receipt_id":{"type":"string"},"request_id":{"type":"string"},"gateway_id":{"$ref":"#/components/schemas/GatewayId"},"gateway_name":{"type":"string"},"epoch":{"type":"integer"},"revision":{"type":"integer"},"tls_verdict":{"type":"string"},"tls_reason":{"type":["string","null"]},"authz_verdict":{"$ref":"#/components/schemas/Verdict"},"authz_reason":{"type":"string"},"grant_id":{"anyOf":[{"$ref":"#/components/schemas/GrantId"},{"type":"null"}]},"principal":{"type":["string","null"]},"cert_serial":{"type":["string","null"]},"method":{"type":"string"},"route":{"type":"string"},"observed_at":{"type":"string","format":"date-time"}}},"ReceiptList":{"title":"ReceiptList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Receipt"}}}},"ReceiptsAccepted":{"title":"ReceiptsAccepted","type":"object","required":["accepted","rejected"],"properties":{"accepted":{"type":"integer","minimum":0},"rejected":{"type":"integer","minimum":0}}},"RecordMigrationApproval":{"title":"RecordMigrationApproval","type":"object","additionalProperties":false,"required":["plan_hash","permission_kind","action","target_ref","environment","decision"],"properties":{"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"permission_kind":{"type":"string","enum":["request","identity_proof","trust_anchor_acceptance","resource_authorization","configuration_execution","production_cutover"]},"action":{"type":"string","enum":["plan.approve","execution.start","step.execute","cutover","rollback"]},"target_ref":{"type":"string","pattern":"^[a-z_]+:[A-Za-z0-9_.:-]+$","maxLength":160},"environment":{"type":"string","enum":["sandbox","production"]},"side":{"type":"string","enum":["owner","consumer"]},"actor_ref":{"type":"string","pattern":"^(org|user|agent_run):[a-z]+_[a-z0-9_]+$","maxLength":80,"description":"Who may perform the approved action: org:<org_id> (default: the side organization), user:<user_id>, or agent_run:<agent_run_id> (that agent run only; its delegator cannot approve it)."},"decision":{"type":"string","enum":["approved","rejected"]},"note":{"type":"string","maxLength":500}}},"RecordRun":{"title":"RecordRun","description":"Run report from the adapter runtime (append-only; idempotent by idempotency_key).","type":"object","additionalProperties":false,"required":["operation","plan_hash","idempotency_key","adapter_id","adapter_version","before_fingerprint","after_fingerprint","outcome","started_at","finished_at"],"properties":{"operation":{"type":"string","enum":["inspect","plan","render","apply","verify","rollback","observe"]},"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"idempotency_key":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[\\x21-\\x7e]+$"},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"adapter_version":{"type":"string","pattern":"^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$","maxLength":40,"examples":["1.0.0"]},"before_fingerprint":{"type":"string","pattern":"^([0-9a-f]{64}|absent)?$"},"after_fingerprint":{"type":"string","pattern":"^([0-9a-f]{64}|absent)?$"},"outcome":{"type":"string","enum":["succeeded","failed","noop","aborted"]},"error_code":{"type":"string","maxLength":80,"pattern":"^[a-z][a-z0-9_]*$"},"verification":{"title":"VerificationV1","description":"Result of verify or of the acceptance suite: every case with expected and observed behavior and its duration, aggregated into the eight mandatory acceptance categories, plus the measured revocation enforcement time.","type":"object","required":["adapter_id","adapter_version","target","platform_version","suite","outcome","started_at","finished_at","cases"],"properties":{"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"adapter_version":{"type":"string","pattern":"^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$","maxLength":40,"examples":["1.0.0"]},"target":{"title":"TargetRef","description":"What an adapter operation acts on. `endpoint` is the protected endpoint descriptor approvals bind; `locator` holds adapter-specific coordinates (config path, server name, listener). Every member is covered by plan hashes.","type":"object","additionalProperties":false,"required":["tenant_id","integration_id","adapter_id","endpoint"],"properties":{"tenant_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"organization_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"connection_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"endpoint":{"type":"string","maxLength":300,"minLength":1},"locator":{"type":"object","maxProperties":32,"additionalProperties":{"type":"string","maxLength":1000}}},"examples":[{"tenant_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","integration_id":"int_01jq3v8m2k9x4h7c5n6p0r1s2t","adapter_id":"nginx.oss.server","endpoint":"https://api.example.com:443","locator":{"config":"/etc/nginx/nginx.conf","server_name":"api.example.com"}}]},"plan_hash":{"type":"string","pattern":"^([0-9a-f]{64})?$"},"platform_version":{"type":"string","maxLength":80},"suite":{"type":"string","enum":["verify","acceptance"]},"outcome":{"type":"string","enum":["passed","failed"]},"started_at":{"type":"string","format":"date-time"},"finished_at":{"type":"string","format":"date-time"},"categories":{"type":"array","maxItems":8,"items":{"type":"object","required":["category","name","outcome","cases","failed"],"properties":{"category":{"type":"integer","minimum":1,"maximum":8},"name":{"type":"string","maxLength":200},"outcome":{"type":"string","enum":["pass","fail","skip","unsupported"]},"cases":{"type":"integer","minimum":0},"failed":{"type":"integer","minimum":0}}}},"cases":{"type":"array","maxItems":500,"items":{"type":"object","required":["id","category","name","expected","observed","outcome","duration_ms"],"properties":{"id":{"type":"string","maxLength":120},"category":{"type":"integer","minimum":1,"maximum":8},"name":{"type":"string","maxLength":300},"expected":{"type":"string","maxLength":500},"observed":{"type":"string","maxLength":4000},"outcome":{"type":"string","enum":["pass","fail","skip","unsupported"]},"duration_ms":{"type":"number","minimum":0},"detail":{"type":"string","maxLength":4000}}}},"revocation":{"type":"object","required":["mode","enforced_by","measured_seconds","bound_seconds"],"properties":{"mode":{"type":"string","enum":["external_authorizer","native","unsupported"]},"enforced_by":{"type":"string","maxLength":200},"measured_seconds":{"type":"number","minimum":0},"bound_seconds":{"type":"number","minimum":0},"reason":{"type":"string","maxLength":1000}}},"environment":{"type":"object","maxProperties":50,"additionalProperties":{"type":"string","maxLength":500}}}},"started_at":{"type":"string","format":"date-time"},"finished_at":{"type":"string","format":"date-time"}}},"RecoveryCodesCreated":{"title":"RecoveryCodesCreated","type":"object","required":["codes","generated_at"],"properties":{"codes":{"type":"array","minItems":10,"maxItems":10,"items":{"type":"string","pattern":"^mtrc_"},"description":"Ten one-time codes, shown once and stored only as hashes. Earlier unused codes stop working."},"generated_at":{"$ref":"#/components/schemas/Timestamp"},"note":{"type":"string"}}},"RecoveryCodeStatus":{"title":"RecoveryCodeStatus","type":"object","required":["available","remaining","total"],"properties":{"available":{"type":"boolean","description":"Recovery codes apply to passkey accounts only."},"remaining":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"generated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"last_used_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}},"RegisterIntegration":{"title":"RegisterIntegration","type":"object","additionalProperties":false,"required":["org_id","adapter_id","adapter_version","environment","endpoint"],"properties":{"org_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"adapter_version":{"type":"string","pattern":"^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$","maxLength":40,"examples":["1.0.0"]},"environment":{"type":"string","enum":["sandbox","production"]},"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"},"role":{"type":"string","enum":["client","tls_terminator","policy_enforcer"]},"space_id":{"type":"string","pattern":"^spc_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64},"grant_id":{"type":"string","pattern":"^gr_[a-z0-9_]+$","maxLength":64},"endpoint":{"type":"object","additionalProperties":false,"required":["hostname"],"properties":{"hostname":{"type":"string","minLength":1,"maxLength":253,"pattern":"^[A-Za-z0-9]([A-Za-z0-9-]{0,62})(\\.[A-Za-z0-9]([A-Za-z0-9-]{0,62}))*$"},"port":{"type":"integer","minimum":1,"maximum":65535},"sni":{"type":"string","minLength":1,"maxLength":253,"pattern":"^[A-Za-z0-9.-]+$"},"route":{"type":"string","maxLength":200,"pattern":"^/[A-Za-z0-9._~\\-/*]*$"},"tls_terminator":{"type":"string","maxLength":120,"pattern":"^[^\\u0000-\\u001f<>]*$"},"upstream":{"type":"string","maxLength":300,"pattern":"^[^\\u0000-\\u001f<>\\s]*$"}}},"authorizer":{"type":"object","additionalProperties":false,"properties":{"address":{"type":"string","maxLength":300,"pattern":"^(https?|grpc)://[^\\s<>]+$"},"protocol":{"type":"string","enum":["forward_auth","ext_authz_grpc","lua"]}}},"trust_bundle_mode":{"type":"string","enum":["replace","merge"]},"require_second_approver":{"type":"boolean"}},"examples":[{"org_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","adapter_id":"nginx.oss.server","adapter_version":"1.0.0","environment":"sandbox","service_id":"svc_01jq3v8m2k9x4h7c5n6p0r1s2t","endpoint":{"hostname":"api.example.com","port":443,"route":"/orders","tls_terminator":"nginx edge","upstream":"http://10.0.0.12:8080"},"authorizer":{"address":"http://127.0.0.1:9191/authz","protocol":"forward_auth"}}]},"RejectPlan":{"title":"RejectPlan","type":"object","additionalProperties":false,"required":["reason"],"properties":{"reason":{"type":"string","minLength":3,"maxLength":500}}},"ReloadConfirmed":{"title":"ReloadConfirmed","type":"object","required":["certificate_id","reload_confirmed"],"properties":{"certificate_id":{"$ref":"#/components/schemas/CertificateId"},"reload_confirmed":{"const":true},"predecessor_retirable":{"anyOf":[{"$ref":"#/components/schemas/CertificateId"},{"type":"null"}]}}},"RenewCertificate":{"title":"RenewCertificate","type":"object","additionalProperties":false,"required":["csr","proof","timestamp"],"properties":{"csr":{"type":"string","minLength":100,"maxLength":8000},"proof":{"type":"string","minLength":40,"maxLength":200},"timestamp":{"type":"integer"}}},"RequestCutover":{"title":"RequestCutover","type":"object","additionalProperties":false,"required":["plan_hash"],"properties":{"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"}}},"RequestOffboarding":{"title":"RequestOffboarding","type":"object","additionalProperties":false,"required":["reason"],"properties":{"reason":{"type":"string","minLength":3,"maxLength":500,"pattern":"\\S"}},"examples":[{"reason":"Contract ends 2027-03-31; moving to another provider."}]},"RequestProductionAccess":{"title":"RequestProductionAccess","type":"object","additionalProperties":false,"properties":{"contact_email":{"type":"string","maxLength":254,"pattern":"^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$"},"use_case":{"type":"string","maxLength":1000},"assurance":{"type":"string","enum":["domain_control","legal_entity"],"description":"Assurance policy: domain control (default), or domain control plus a verified legal entity."}}},"RequestRollback":{"title":"RequestRollback","type":"object","additionalProperties":false,"required":["plan_hash","reason"],"properties":{"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"reason":{"type":"string","maxLength":500,"minLength":3}}},"RespondInvitation":{"title":"RespondInvitation","type":"object","additionalProperties":false,"required":["token"],"properties":{"token":{"type":"string","minLength":20,"maxLength":200}}},"ResumeAgentRun":{"title":"ResumeAgentRun","type":"object","additionalProperties":false,"properties":{"note":{"type":"string","maxLength":200}}},"ResumeGrant":{"title":"ResumeGrant","type":"object","additionalProperties":false,"properties":{"note":{"type":"string","maxLength":500}}},"RevokeCertificate":{"title":"RevokeCertificate","type":"object","additionalProperties":false,"required":["reason_code"],"properties":{"reason_code":{"type":"string","enum":["key_compromise","superseded","cessation_of_operation","owner_request"]}}},"RoleAssigned":{"title":"RoleAssigned","type":"object","required":["user_id","role"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"role":{"$ref":"#/components/schemas/CustomerRole"}}},"RoleRemoved":{"title":"RoleRemoved","type":"object","required":["user_id","role","removed","member_removed","credentials_revoked"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"role":{"$ref":"#/components/schemas/CustomerRole"},"removed":{"const":true},"member_removed":{"type":"boolean","description":"True when this was the last role, so the user is no longer a member."},"credentials_revoked":{"type":"integer","minimum":0,"description":"API credentials the member created in this organization, revoked when membership ends."}}},"Rollover":{"title":"Rollover","type":"object","required":["id","space_id","kind","state","revision","emergency","next","timeline","gateways","canaries","workloads_on_old_issuer"],"properties":{"id":{"$ref":"#/components/schemas/RolloverId"},"tenant_id":{"$ref":"#/components/schemas/OrgId"},"space_id":{"$ref":"#/components/schemas/SpaceId"},"environment":{"$ref":"#/components/schemas/Environment"},"kind":{"type":"string","enum":["issuing_ca","root","manifest_key"]},"state":{"type":"string","enum":["requested","started","staged","issuing","draining","retired","aborted"]},"revision":{"type":"integer","minimum":1,"description":"Compare-and-swap guard: send it as If-Match on every rollover action."},"emergency":{"type":"boolean"},"overlap_seconds":{"type":"integer"},"reason":{"type":["string","null"]},"old_issuer_id":{"anyOf":[{"$ref":"#/components/schemas/IssuerId"},{"type":"null"}]},"new_issuer_id":{"anyOf":[{"$ref":"#/components/schemas/IssuerId"},{"type":"null"}]},"old_root_issuer_id":{"anyOf":[{"$ref":"#/components/schemas/IssuerId"},{"type":"null"}]},"new_root_issuer_id":{"anyOf":[{"$ref":"#/components/schemas/IssuerId"},{"type":"null"}]},"old_key_version_id":{"anyOf":[{"$ref":"#/components/schemas/KeyVersionId"},{"type":"null"}]},"new_key_version_id":{"anyOf":[{"$ref":"#/components/schemas/KeyVersionId"},{"type":"null"}]},"rotation_expires_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"requested_by_type":{"type":"string","enum":["user","staff","system"]},"requested_by":{"type":"string"},"approved_by":{"type":["string","null"]},"pending_approval":{"type":["string","null"],"enum":["start","ack_override","retire",null]},"pending_requested_by":{"type":["string","null"]},"ack_override":{"anyOf":[{"type":"object","required":["by","at","gateways"],"properties":{"by":{"type":"string"},"reason":{"type":["string","null"]},"at":{"$ref":"#/components/schemas/Timestamp"},"gateways":{"type":"array","items":{"type":"string"}}}},{"type":"null"}]},"retire_approved_by":{"type":["string","null"]},"drain_until":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"last_error":{"type":["string","null"]},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"},"started_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"staged_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"issuing_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"draining_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"retired_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"aborted_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"next":{"type":"object","required":["waiting_for","description","pending","abortable"],"properties":{"waiting_for":{"type":["string","null"],"enum":["awaiting_approval","awaiting_successor","awaiting_gateway_acks","awaiting_canary","draining","awaiting_retire_approval","finished",null]},"description":{"type":"string"},"pending":{"type":"array","items":{"type":"string"},"description":"Gateway ids (acknowledgments) or service ids (canaries) still outstanding."},"abortable":{"type":"boolean"},"retire_requires_approval":{"type":"boolean"}}},"timeline":{"type":"array","items":{"type":"object","required":["to_state","actor_type","actor_id","created_at"],"properties":{"from_state":{"type":["string","null"]},"to_state":{"type":"string"},"actor_type":{"type":"string"},"actor_id":{"type":"string"},"note":{"type":["string","null"]},"created_at":{"$ref":"#/components/schemas/Timestamp"}}}},"gateways":{"type":"array","items":{"type":"object","required":["gateway_id","name","service_id","acked"],"properties":{"gateway_id":{"$ref":"#/components/schemas/GatewayId"},"name":{"type":"string"},"service_id":{"$ref":"#/components/schemas/ServiceId"},"service_name":{"type":"string"},"last_ack_epoch":{"type":["integer","null"]},"last_ack_revision":{"type":["integer","null"]},"last_ack_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"last_seen_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"manifest_kid":{"type":["string","null"]},"connector_version":{"type":["string","null"]},"target_epoch":{"type":["integer","null"]},"target_revision":{"type":["integer","null"]},"acked":{"type":"boolean"}}}},"canaries":{"type":"array","items":{"type":"object","required":["service_id","observed"],"properties":{"service_id":{"$ref":"#/components/schemas/ServiceId"},"service_name":{"type":"string"},"observed":{"type":"boolean"},"observed_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}}},"workloads_on_old_issuer":{"type":"array","items":{"type":"object","required":["certificate_id","workload_id","not_after"],"properties":{"certificate_id":{"$ref":"#/components/schemas/CertificateId"},"workload_id":{"$ref":"#/components/schemas/WorkloadId"},"workload_name":{"type":"string"},"grant_id":{"$ref":"#/components/schemas/GrantId"},"consumer_org_id":{"$ref":"#/components/schemas/OrgId"},"consumer_name":{"type":"string"},"serial_hex":{"type":"string"},"not_after":{"$ref":"#/components/schemas/Timestamp"},"renew_after":{"$ref":"#/components/schemas/Timestamp"}}}}}},"RolloverDecision":{"title":"RolloverDecision","type":"object","additionalProperties":false,"required":["reason"],"properties":{"reason":{"type":"string","minLength":3,"maxLength":500,"pattern":"\\S"}}},"RolloverId":{"title":"RolloverId","description":"Opaque identifier with prefix `trl_`.","type":"string","pattern":"^trl_[a-z0-9_]+$","maxLength":64,"examples":["trl_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"RolloverList":{"title":"RolloverList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/RolloverSummary"}}}},"RolloverSummary":{"title":"RolloverSummary","type":"object","required":["id","space_id","kind","state","revision","emergency","created_at"],"properties":{"id":{"$ref":"#/components/schemas/RolloverId"},"tenant_id":{"$ref":"#/components/schemas/OrgId"},"space_id":{"$ref":"#/components/schemas/SpaceId"},"environment":{"$ref":"#/components/schemas/Environment"},"kind":{"type":"string","enum":["issuing_ca","root","manifest_key"]},"state":{"type":"string","enum":["requested","started","staged","issuing","draining","retired","aborted"]},"revision":{"type":"integer","minimum":1,"description":"Compare-and-swap guard: send it as If-Match on every rollover action."},"emergency":{"type":"boolean"},"overlap_seconds":{"type":"integer"},"reason":{"type":["string","null"]},"old_issuer_id":{"anyOf":[{"$ref":"#/components/schemas/IssuerId"},{"type":"null"}]},"new_issuer_id":{"anyOf":[{"$ref":"#/components/schemas/IssuerId"},{"type":"null"}]},"old_root_issuer_id":{"anyOf":[{"$ref":"#/components/schemas/IssuerId"},{"type":"null"}]},"new_root_issuer_id":{"anyOf":[{"$ref":"#/components/schemas/IssuerId"},{"type":"null"}]},"old_key_version_id":{"anyOf":[{"$ref":"#/components/schemas/KeyVersionId"},{"type":"null"}]},"new_key_version_id":{"anyOf":[{"$ref":"#/components/schemas/KeyVersionId"},{"type":"null"}]},"rotation_expires_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"requested_by_type":{"type":"string","enum":["user","staff","system"]},"requested_by":{"type":"string"},"approved_by":{"type":["string","null"]},"pending_approval":{"type":["string","null"],"enum":["start","ack_override","retire",null]},"pending_requested_by":{"type":["string","null"]},"ack_override":{"anyOf":[{"type":"object","required":["by","at","gateways"],"properties":{"by":{"type":"string"},"reason":{"type":["string","null"]},"at":{"$ref":"#/components/schemas/Timestamp"},"gateways":{"type":"array","items":{"type":"string"}}}},{"type":"null"}]},"retire_approved_by":{"type":["string","null"]},"drain_until":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"last_error":{"type":["string","null"]},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"},"started_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"staged_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"issuing_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"draining_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"retired_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"aborted_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]}}},"RouteRule":{"title":"RouteRule","type":"object","additionalProperties":false,"required":["methods","path"],"properties":{"methods":{"type":"array","minItems":1,"maxItems":7,"items":{"type":"string","enum":["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"]},"uniqueItems":true},"path":{"type":"string","pattern":"^/[A-Za-z0-9._~\\-/]*(/\\*)?$","maxLength":200}}},"RouteTemplate":{"title":"RouteTemplate","type":"object","required":["name","methods","path"],"properties":{"name":{"type":"string"},"methods":{"type":"array","items":{"$ref":"#/components/schemas/HttpMethod"}},"path":{"type":"string"},"restricted":{"type":"boolean"}}},"SandboxBootstrap":{"title":"SandboxBootstrap","type":"object","required":["sponsor","partner","space","service"],"properties":{"sponsor":{"$ref":"#/components/schemas/OrganizationCreated"},"partner":{"$ref":"#/components/schemas/OrganizationCreated"},"space":{"$ref":"#/components/schemas/SpaceCreated"},"service":{"$ref":"#/components/schemas/ServiceCreated"}}},"ScheduleOffboarding":{"title":"ScheduleOffboarding","type":"object","additionalProperties":false,"properties":{"notice_days":{"type":"integer","minimum":30,"maximum":365,"description":"Days until termination (default 30)."}}},"ScimConfiguration":{"title":"ScimConfiguration","type":"object","required":["org_id","base_url","tokens","role_mappings","counts"],"properties":{"org_id":{"$ref":"#/components/schemas/OrgId"},"base_url":{"type":"string","description":"SCIM 2.0 base URL to configure in the identity provider."},"tokens":{"type":"array","items":{"type":"object","required":["id","name","prefix","active","created_at"],"properties":{"id":{"$ref":"#/components/schemas/ScimTokenId"},"name":{"type":"string"},"prefix":{"type":"string"},"active":{"type":"boolean"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"last_used_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"revoked_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"rotated_from_id":{"anyOf":[{"$ref":"#/components/schemas/ScimTokenId"},{"type":"null"}]}}}},"role_mappings":{"type":"array","items":{"type":"object","required":["group","roles"],"properties":{"group":{"type":"string"},"roles":{"type":"array","items":{"$ref":"#/components/schemas/CustomerRole"}}}}},"counts":{"type":"object","required":["users","active_users","groups"],"properties":{"users":{"type":"integer"},"active_users":{"type":"integer"},"groups":{"type":"integer"}}}}},"ScimTokenCreated":{"title":"ScimTokenCreated","type":"object","required":["id","name","prefix","token","base_url","created_at"],"properties":{"id":{"$ref":"#/components/schemas/ScimTokenId"},"name":{"type":"string"},"prefix":{"type":"string"},"token":{"type":"string","pattern":"^mtscim_","description":"Shown once; only a hash is stored."},"base_url":{"type":"string"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"rotated_from_id":{"anyOf":[{"$ref":"#/components/schemas/ScimTokenId"},{"type":"null"}]},"note":{"type":"string"}}},"ScimTokenId":{"title":"ScimTokenId","description":"Opaque identifier with prefix `sct_`.","type":"string","pattern":"^sct_[a-z0-9_]+$","maxLength":64,"examples":["sct_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"ScimTokenRevoked":{"title":"ScimTokenRevoked","type":"object","required":["id","active"],"properties":{"id":{"$ref":"#/components/schemas/ScimTokenId"},"active":{"const":false},"revoked_at":{"$ref":"#/components/schemas/Timestamp"}}},"ScopeChange":{"title":"ScopeChange","description":"Preview (preview: true) or the committed change.","anyOf":[{"type":"object","required":["preview","diff","current_revision"],"properties":{"preview":{"const":true},"diff":{"$ref":"#/components/schemas/ScopeDiff"},"current_revision":{"type":"integer"},"step_up_required":{"type":"boolean","description":"Applying this change widens a production grant and needs a recent sign-in."}}},{"type":"object","required":["grant_id","revision","diff","operation_id"],"properties":{"grant_id":{"$ref":"#/components/schemas/GrantId"},"revision":{"type":"integer"},"diff":{"$ref":"#/components/schemas/ScopeDiff"},"operation_id":{"$ref":"#/components/schemas/OperationId"}}}]},"ScopeDiff":{"title":"ScopeDiff","type":"object","required":["added","removed","unchanged"],"properties":{"added":{"type":"array","items":{"type":"string"}},"removed":{"type":"array","items":{"type":"string"}},"unchanged":{"type":"array","items":{"type":"string"}}}},"ServerTlsAttestation":{"title":"ServerTlsAttestation","type":"object","required":["id","service_id","tls_mode","attested_at"],"properties":{"id":{"$ref":"#/components/schemas/ServiceAttestationId"},"service_id":{"$ref":"#/components/schemas/ServiceId"},"tls_mode":{"type":"string"},"certificate_not_after":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"attested_at":{"$ref":"#/components/schemas/Timestamp"}}},"Service":{"title":"Service","type":"object","required":["id","space_id","name","environment"],"properties":{"id":{"$ref":"#/components/schemas/ServiceId"},"tenant_id":{"$ref":"#/components/schemas/OrgId"},"space_id":{"$ref":"#/components/schemas/SpaceId"},"name":{"type":"string"},"environment":{"$ref":"#/components/schemas/Environment"},"contact":{"type":["string","null"]},"owner_user_id":{"anyOf":[{"$ref":"#/components/schemas/UserId"},{"type":"null"}]},"grant_approval":{"$ref":"#/components/schemas/GrantApproval"},"policy_epoch":{"type":"integer"},"created_at":{"type":"string","format":"date-time"},"route_templates":{"type":"array","items":{"$ref":"#/components/schemas/RouteTemplate"}},"space_name":{"type":"string"},"trust_fingerprint":{"type":["string","null"]},"sample_partner_org_id":{"anyOf":[{"$ref":"#/components/schemas/OrgId"},{"type":"null"}]},"current_policy":{"anyOf":[{"$ref":"#/components/schemas/PolicyRevision"},{"type":"null"}]},"gateways":{"type":"array","items":{"$ref":"#/components/schemas/Gateway"}},"readiness":{"type":"array","items":{"$ref":"#/components/schemas/ReadinessStep"},"description":"Sandbox: trust anchor, gateway, policy applied, allow and deny receipts. Production adds organization verification, owner, server TLS, closed origin, partner IdP acceptance and OIDC workload binding."},"first_failing_step":{"type":["string","null"],"description":"The first readiness step that does not pass; null when the service is verified."},"verified":{"type":"boolean","description":"True only when every readiness step passes."}}},"ServiceAttestationId":{"title":"ServiceAttestationId","description":"Opaque identifier with prefix `sat_`.","type":"string","pattern":"^sat_[a-z0-9_]+$","maxLength":64,"examples":["sat_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"ServiceCreated":{"title":"ServiceCreated","type":"object","required":["id","space_id","name","environment"],"properties":{"id":{"$ref":"#/components/schemas/ServiceId"},"space_id":{"$ref":"#/components/schemas/SpaceId"},"name":{"type":"string"},"environment":{"$ref":"#/components/schemas/Environment"},"grant_approval":{"$ref":"#/components/schemas/GrantApproval"}}},"ServiceId":{"title":"ServiceId","description":"Opaque identifier with prefix `svc_`.","type":"string","pattern":"^svc_[a-z0-9_]+$","maxLength":64,"examples":["svc_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"ServiceUpdated":{"title":"ServiceUpdated","type":"object","required":["id","grant_approval"],"properties":{"id":{"$ref":"#/components/schemas/ServiceId"},"grant_approval":{"$ref":"#/components/schemas/GrantApproval"},"contact":{"type":["string","null"]},"owner_user_id":{"anyOf":[{"$ref":"#/components/schemas/UserId"},{"type":"null"}]}}},"SetSsoEnforcement":{"title":"SetSsoEnforcement","type":"object","additionalProperties":false,"required":["enforce_sso"],"properties":{"enforce_sso":{"type":"boolean","description":"Members must sign in through the organization IdP; break-glass owners keep passkeys."}}},"Sha256Hex":{"title":"Sha256Hex","type":"string","pattern":"^[0-9a-f]{64}$"},"SignedBundle":{"title":"SignedBundle","type":"object","required":["format","kind","payload","signature"],"properties":{"format":{"const":"mt.signed_bundle.v1"},"kind":{"type":"string","enum":["personal_data_export","organization_offboarding_export"]},"payload":{"type":"object"},"signature":{"type":"object","required":["alg","kid","payload_sha256","value"],"properties":{"alg":{"const":"EdDSA"},"kid":{"type":"string"},"payload_sha256":{"type":"string","pattern":"^[0-9a-f]{64}$"},"value":{"type":"string","description":"base64url Ed25519 signature over the UTF-8 bytes of canonicalJson({ format, kind, payload })."}}}},"description":"A signed export. Verify with a key from GET /v1/privacy/signing-keys (verifySignedBundle in packages/domain/src/retention.ts)."},"SignedManifest":{"title":"SignedManifest","type":"object","required":["manifest","epoch","revision"],"properties":{"manifest":{"$ref":"#/components/schemas/Jws"},"epoch":{"type":"integer"},"revision":{"type":"integer"},"key_rotation":{"$ref":"#/components/schemas/Jws","description":"During a manifest-key rollover: the key-rotation statement (typ mt.key-rotation.v1+jws) signed by the previously pinned key that introduces the key this manifest is signed with. Gateways accept the new key only through it."}}},"SigningBackendSummary":{"title":"SigningBackendSummary","type":"object","required":["kind","source"],"properties":{"kind":{"type":"string","enum":["simulator","gcp_kms","sectigo_private_ca"]},"source":{"type":"string","enum":["space","platform"],"description":"space: a backend configured for this space by Sectigo staff; platform: the deployment default."},"label":{"type":"string"},"state":{"type":"string","enum":["draft","activation_requested","active","inactive"]},"activated_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"ca_chain":{"anyOf":[{"type":"object","required":["root_fingerprint","intermediate_fingerprint"],"properties":{"root_fingerprint":{"type":"string","pattern":"^[0-9a-f]{64}$"},"intermediate_fingerprint":{"type":"string","pattern":"^[0-9a-f]{64}$"}}},{"type":"null"}],"description":"Pinned private CA chain (SHA-256 of the DER certificates) for an external CA backend."}},"description":"Read-only: how certificates of this space are issued. Configured by Sectigo staff in the staff console."},"Space":{"title":"Space","type":"object","required":["id","name","environment"],"properties":{"id":{"$ref":"#/components/schemas/SpaceId"},"tenant_id":{"$ref":"#/components/schemas/OrgId"},"org_id":{"$ref":"#/components/schemas/OrgId"},"name":{"type":"string"},"environment":{"$ref":"#/components/schemas/Environment"},"trust_fingerprint":{"type":["string","null"]},"issuing_fingerprint":{"type":["string","null"]},"root_issuer_id":{"anyOf":[{"$ref":"#/components/schemas/IssuerId"},{"type":"null"}]},"issuing_issuer_id":{"anyOf":[{"$ref":"#/components/schemas/IssuerId"},{"type":"null"}]},"issuers":{"type":"array","items":{"$ref":"#/components/schemas/Issuer"}},"signing_backend":{"$ref":"#/components/schemas/SigningBackendSummary"},"rollover":{"anyOf":[{"type":"object","required":["id","kind","state","revision"],"properties":{"id":{"$ref":"#/components/schemas/RolloverId"},"kind":{"type":"string","enum":["issuing_ca","root","manifest_key"]},"state":{"type":"string","enum":["requested","started","staged","issuing","draining"]},"revision":{"type":"integer"}}},{"type":"null"}],"description":"The rollover in progress for this space, if any."},"created_at":{"type":"string","format":"date-time"}}},"SpaceCreated":{"title":"SpaceCreated","type":"object","required":["id","org_id","name","environment","trust_fingerprint","issuing_fingerprint"],"properties":{"id":{"$ref":"#/components/schemas/SpaceId"},"org_id":{"$ref":"#/components/schemas/OrgId"},"name":{"type":"string"},"environment":{"$ref":"#/components/schemas/Environment"},"trust_fingerprint":{"type":"string"},"issuing_fingerprint":{"type":"string"}}},"SpaceId":{"title":"SpaceId","description":"Opaque identifier with prefix `spc_`.","type":"string","pattern":"^spc_[a-z0-9_]+$","maxLength":64,"examples":["spc_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"SsoConfiguration":{"title":"SsoConfiguration","type":"object","required":["org_id","configured","redirect_uri","connection","break_glass"],"properties":{"org_id":{"$ref":"#/components/schemas/OrgId"},"configured":{"type":"boolean"},"redirect_uri":{"type":"string","description":"Register this redirect URI with the identity provider."},"connection":{"anyOf":[{"type":"object","required":["id","issuer","client_id","client_secret_set","domains","state","enforce_sso","tested_at","revision"],"properties":{"id":{"$ref":"#/components/schemas/SsoConnectionId"},"issuer":{"type":"string"},"client_id":{"type":"string"},"client_secret_set":{"type":"boolean","description":"A client secret is stored (sealed); it is never returned."},"domains":{"type":"array","items":{"type":"string"}},"state":{"type":"string","enum":["active","disabled"]},"enforce_sso":{"type":"boolean"},"tested_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}],"description":"First successful sign-in through this IdP; SSO-only needs it."},"discovered_at":{"$ref":"#/components/schemas/Timestamp"},"revision":{"type":"integer"},"created_at":{"$ref":"#/components/schemas/Timestamp"},"updated_at":{"$ref":"#/components/schemas/Timestamp"}}},{"type":"null"}]},"break_glass":{"type":"array","items":{"type":"object","required":["user_id","owner"],"properties":{"user_id":{"$ref":"#/components/schemas/UserId"},"display_name":{"type":["string","null"]},"email":{"type":["string","null"]},"created_at":{"$ref":"#/components/schemas/Timestamp"},"owner":{"type":"boolean"}}}}}},"SsoConnectionId":{"title":"SsoConnectionId","description":"Opaque identifier with prefix `sso_`.","type":"string","pattern":"^sso_[a-z0-9_]+$","maxLength":64,"examples":["sso_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"StartMigrationExecution":{"title":"StartMigrationExecution","type":"object","additionalProperties":false,"required":["plan_hash"],"properties":{"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"}}},"StartRollover":{"title":"StartRollover","type":"object","additionalProperties":false,"required":["kind"],"properties":{"kind":{"type":"string","enum":["issuing_ca","root","manifest_key"],"description":"Customers start routine issuing-CA rollovers; root and manifest-key rollovers are run by Sectigo PKI Operations (refused with rollover_requires_staff)."},"overlap_seconds":{"type":"integer","minimum":0,"maximum":2592000,"description":"How long the previous issuer stays trusted after its last live leaf expires (default 86400; the deployment sets the minimum)."},"reason":{"type":"string","minLength":3,"maxLength":500}}},"StepUp":{"title":"StepUp","description":"A passkey assertion (WebAuthn AuthenticationResponseJSON) for the signed-in account.","type":"object","additionalProperties":false,"required":["credential"],"properties":{"credential":{"type":"object","required":["id","rawId","type","response"],"properties":{"id":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,1400}$"},"rawId":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,1400}$"},"type":{"const":"public-key"},"response":{"type":"object","required":["clientDataJSON","authenticatorData","signature"],"properties":{"clientDataJSON":{"type":"string","maxLength":4096},"authenticatorData":{"type":"string","maxLength":4096},"signature":{"type":"string","maxLength":4096},"userHandle":{"type":["string","null"],"maxLength":1400}}}}}}},"StepUpCompleted":{"title":"StepUpCompleted","type":"object","required":["authenticated_at","valid_until"],"properties":{"authenticated_at":{"$ref":"#/components/schemas/Timestamp"},"valid_until":{"$ref":"#/components/schemas/Timestamp"}}},"StepUpOptions":{"title":"StepUpOptions","type":"object","required":["challenge","rpId","userVerification"],"properties":{"challenge":{"type":"string"},"rpId":{"type":"string"},"timeout":{"type":"integer"},"userVerification":{"const":"required"},"allowCredentials":{"type":"array","items":{"type":"object","required":["id","type"],"properties":{"id":{"type":"string"},"type":{"const":"public-key"},"transports":{"type":"array","items":{"type":"string"}}}}}}},"StripeEventReceivedDataV1":{"title":"StripeEventReceivedDataV1","type":"object","required":["inbox_id"],"properties":{"inbox_id":{"type":"string","pattern":"^pin_[a-z0-9_]+$","maxLength":64}}},"SubmitAssessment":{"title":"SubmitAssessment","type":"object","additionalProperties":false,"minProperties":1,"properties":{"evidence":{"type":"array","minItems":1,"maxItems":20,"items":{"title":"MigrationEvidenceV1","description":"Discovery evidence for one endpoint from mt discover, mt-adapt inspect (converted), an upload or a manual answer. Public material only. Confidence: verified (observed on the wire or read from the host), inferred (read from a file or answered by a person), unknown.","type":"object","additionalProperties":false,"required":["source","collected_at","collector","target","tls","client_certs","gateway","findings","redactions_applied"],"properties":{"source":{"type":"string","enum":["mt_discover","mt_adapt_inspect","upload","manual"]},"collected_at":{"type":"string","format":"date-time","maxLength":40},"collector":{"type":"object","additionalProperties":false,"required":["kind","version"],"properties":{"kind":{"type":"string","maxLength":80,"minLength":1},"version":{"type":"string","maxLength":40,"minLength":1}}},"target":{"type":"object","additionalProperties":false,"required":["hostname","port"],"properties":{"hostname":{"type":"string","minLength":1,"maxLength":253,"pattern":"^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$"},"port":{"type":"integer","minimum":1,"maximum":65535},"sni":{"type":"string","minLength":1,"maxLength":253,"pattern":"^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$"}}},"tls":{"type":"object","additionalProperties":false,"required":["server_cert_chain_fingerprints","client_auth_requested","acceptable_ca_dns","tls_versions"],"properties":{"server_cert_chain_fingerprints":{"type":"array","maxItems":10,"items":{"type":"string","pattern":"^(sha256:)?[0-9A-Fa-f:]{40,128}$","maxLength":140}},"client_auth_requested":{"type":["boolean","null"],"description":"null when the collector could not tell."},"acceptable_ca_dns":{"type":"array","maxItems":100,"items":{"type":"string","maxLength":500}},"tls_versions":{"type":"array","maxItems":6,"items":{"type":"string","enum":["TLS1.0","TLS1.1","TLS1.2","TLS1.3"]}}}},"client_certs":{"type":"array","maxItems":50,"items":{"type":"object","additionalProperties":false,"required":["fingerprint","issuer_dn","subject_dn","ekus","not_after","public_ca","key_type"],"properties":{"fingerprint":{"type":"string","pattern":"^(sha256:)?[0-9A-Fa-f:]{40,128}$","maxLength":140},"issuer_dn":{"type":"string","maxLength":500},"subject_dn":{"type":"string","maxLength":500},"ekus":{"type":"array","maxItems":20,"items":{"type":"string","maxLength":80}},"not_after":{"type":"string","format":"date-time","maxLength":40},"public_ca":{"type":"boolean","description":"The issuer chains to a publicly trusted TLS root."},"key_type":{"type":"string","maxLength":40}}}},"gateway":{"type":"object","additionalProperties":false,"required":["confidence"],"properties":{"detected_kind":{"type":"string","maxLength":60},"version":{"type":"string","maxLength":80},"confidence":{"type":"string","enum":["verified","inferred","unknown"]}}},"findings":{"type":"array","maxItems":100,"items":{"type":"object","additionalProperties":false,"required":["code","label","confidence","detail"],"properties":{"code":{"type":"string","maxLength":80,"pattern":"^[a-z0-9_.]+$"},"label":{"type":"string","maxLength":200},"confidence":{"type":"string","enum":["verified","inferred","unknown"]},"detail":{"type":"string","maxLength":2000}}}},"redactions_applied":{"type":"boolean"}}}},"uploads":{"type":"array","minItems":1,"maxItems":10,"items":{"type":"object","additionalProperties":false,"required":["kind","filename","content"],"properties":{"kind":{"type":"string","enum":["nginx_config","java_client_config","other_config"]},"filename":{"type":"string","maxLength":200,"minLength":1,"pattern":"^[^\\u0000-\\u001f/\\\\]+$"},"content":{"type":"string","maxLength":200000}}}},"certificates":{"type":"array","minItems":1,"maxItems":20,"items":{"type":"object","additionalProperties":false,"required":["pem"],"properties":{"pem":{"type":"string","maxLength":20000,"pattern":"^-----BEGIN CERTIFICATE-----"},"public_ca":{"type":"boolean","description":"Issued by a publicly trusted TLS CA (as the uploader states it; recorded as inferred)."}}}},"inspection":{"type":"object","description":"InspectionV1 from mt-adapt inspect (converted to MigrationEvidenceV1 server side)."},"answers":{"type":"object","additionalProperties":false,"properties":{"platform":{"type":"string","enum":["nginx","envoy","haproxy","traefik","aws_api_gateway","azure_apim","cloudflare_api_shield","kong","f5_bigip","other","unknown"]},"client_runtime":{"type":"string","enum":["java","dotnet","openssl","kubernetes","other","unknown"]}}},"visibility":{"type":"string","enum":["owner_only","consumer_only","shared_redacted"]}}},"SubmitExport":{"title":"ExportManifestV1","description":"The export manifest of one rendering (mt-adapt render writes it to export/manifest.json): every rendered file with its SHA-256, the adapter, plan hash, desired-state fingerprint, target and creation time. The control plane signs its canonical SHA-256 in an export statement (ExportStatementV1).","type":"object","required":["typ","adapter_id","adapter_version","plan_hash","desired_state_fingerprint","target","created_at","files"],"properties":{"typ":{"const":"mt.adapter-export-manifest.v1"},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"adapter_version":{"type":"string","pattern":"^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$","maxLength":40,"examples":["1.0.0"]},"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"desired_state_fingerprint":{"type":"string","pattern":"^[0-9a-f]{64}$"},"target":{"title":"TargetRef","description":"What an adapter operation acts on. `endpoint` is the protected endpoint descriptor approvals bind; `locator` holds adapter-specific coordinates (config path, server name, listener). Every member is covered by plan hashes.","type":"object","additionalProperties":false,"required":["tenant_id","integration_id","adapter_id","endpoint"],"properties":{"tenant_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"organization_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"connection_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"endpoint":{"type":"string","maxLength":300,"minLength":1},"locator":{"type":"object","maxProperties":32,"additionalProperties":{"type":"string","maxLength":1000}}},"examples":[{"tenant_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","integration_id":"int_01jq3v8m2k9x4h7c5n6p0r1s2t","adapter_id":"nginx.oss.server","endpoint":"https://api.example.com:443","locator":{"config":"/etc/nginx/nginx.conf","server_name":"api.example.com"}}]},"created_at":{"type":"string","format":"date-time"},"files":{"type":"array","maxItems":200,"items":{"type":"object","additionalProperties":false,"required":["path","sha256","size","role"],"properties":{"path":{"type":"string","maxLength":1000,"description":"Path inside the bundle (files/... or changes.diff).","pattern":"^(?!/)(?!.*\\.\\.)[^\\u0000-\\u001f\\\\]+$"},"target_path":{"type":"string","maxLength":1000,"description":"Destination on the target, when the file is applied."},"sha256":{"type":"string","pattern":"^[0-9a-f]{64}$"},"size":{"type":"integer","minimum":0},"role":{"type":"string","maxLength":40},"mode":{"type":"string","maxLength":8}}}}},"additionalProperties":false},"SubmitLegalEntity":{"title":"SubmitLegalEntity","type":"object","additionalProperties":false,"required":["legal_name","registration_number","jurisdiction"],"properties":{"legal_name":{"type":"string","minLength":2,"maxLength":200,"pattern":"\\S"},"registration_number":{"type":"string","minLength":1,"maxLength":64,"pattern":"^[A-Za-z0-9][A-Za-z0-9 ./-]*$"},"jurisdiction":{"type":"string","pattern":"^[A-Za-z]{2}(-[A-Za-z0-9]{1,3})?$","description":"ISO 3166-1 alpha-2 country, optionally with an ISO 3166-2 subdivision (US-DE)."},"evidence_notes":{"type":"string","maxLength":2000}}},"SubmitPlan":{"title":"SubmitPlan","description":"A PlanV1 from mt-adapt plan, or a RollbackArtifactV1 that needs its own approval.","oneOf":[{"title":"PlanV1","description":"A reviewed, hashable change set. `plan_hash` = SHA-256 of canonical JSON of {adapter_id, adapter_version, target, inspection_fingerprint, desired_state_fingerprint, changes}. `diff` is redacted.","type":"object","required":["adapter_id","adapter_version","target","inspection_fingerprint","desired_state_fingerprint","changes","plan_hash","after_fingerprint","mode","created_at","platform_version","diff","test_vectors","parallel_trust","rollback"],"properties":{"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"adapter_version":{"type":"string","pattern":"^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$","maxLength":40,"examples":["1.0.0"]},"target":{"title":"TargetRef","description":"What an adapter operation acts on. `endpoint` is the protected endpoint descriptor approvals bind; `locator` holds adapter-specific coordinates (config path, server name, listener). Every member is covered by plan hashes.","type":"object","additionalProperties":false,"required":["tenant_id","integration_id","adapter_id","endpoint"],"properties":{"tenant_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"organization_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"connection_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"endpoint":{"type":"string","maxLength":300,"minLength":1},"locator":{"type":"object","maxProperties":32,"additionalProperties":{"type":"string","maxLength":1000}}},"examples":[{"tenant_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","integration_id":"int_01jq3v8m2k9x4h7c5n6p0r1s2t","adapter_id":"nginx.oss.server","endpoint":"https://api.example.com:443","locator":{"config":"/etc/nginx/nginx.conf","server_name":"api.example.com"}}]},"inspection_fingerprint":{"type":"string","pattern":"^([0-9a-f]{64}|absent)?$","maxLength":64},"desired_state_fingerprint":{"type":"string","pattern":"^[0-9a-f]{64}$"},"changes":{"type":"array","maxItems":100,"items":{"title":"Change","description":"One reviewable unit of a plan. Trust-chain acceptance (trust_anchor, client_verification) and per-resource authorization (identity_authorization) are always separate changes; there is no combined \"install CA and allow access\" change.","type":"object","required":["id","kind","action","summary"],"properties":{"id":{"type":"string","maxLength":120,"minLength":1},"kind":{"type":"string","enum":["trust_anchor","client_verification","identity_authorization","guided_step","manual_step","artifact","rollback"]},"action":{"type":"string","maxLength":40,"pattern":"^[a-z][a-z_]*$"},"summary":{"type":"string","maxLength":2000},"settings":{"type":"array","maxItems":200,"items":{"type":"object","required":["name","before","after"],"properties":{"name":{"type":"string","maxLength":200},"scope":{"type":"string","maxLength":500},"before":{"type":"string","maxLength":4000},"after":{"type":"string","maxLength":4000}}}},"files":{"type":"array","maxItems":100,"items":{"type":"object","required":["path","role","before_sha256","after_sha256","mode"],"properties":{"path":{"type":"string","maxLength":1000},"role":{"type":"string","maxLength":40},"before_sha256":{"type":"string","pattern":"^([0-9a-f]{64}|absent)?$","maxLength":64},"after_sha256":{"type":"string","pattern":"^([0-9a-f]{64}|absent)?$","maxLength":64},"mode":{"type":"string","maxLength":8}}}},"params":{"type":"object"}}}},"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"after_fingerprint":{"type":"string","pattern":"^([0-9a-f]{64}|absent)?$","maxLength":64},"mode":{"type":"string","enum":["A","C","G"]},"created_at":{"type":"string","format":"date-time"},"platform_version":{"type":"string","maxLength":80},"diff":{"type":"string","maxLength":262144},"test_vectors":{"type":"array","maxItems":200,"items":{"type":"object","required":["id","category","client","method","path","expect"],"properties":{"id":{"type":"string","maxLength":120},"category":{"type":"integer","minimum":1,"maximum":8},"client":{"type":"string","maxLength":60},"method":{"type":"string","maxLength":10},"path":{"type":"string","maxLength":500},"expect":{"type":"string","enum":["allow","deny"]}}}},"parallel_trust":{"type":"object","required":["supported","detail"],"properties":{"supported":{"type":"boolean"},"detail":{"type":"string","maxLength":4000}}},"rollback":{"type":"object","required":["supported","detail"],"properties":{"supported":{"type":"boolean"},"detail":{"type":"string","maxLength":4000}}},"findings":{"type":"array","maxItems":200,"items":{"type":"object","required":["severity","code","message"],"properties":{"severity":{"type":"string","enum":["info","warning","critical"]},"code":{"type":"string","maxLength":80},"message":{"type":"string","maxLength":2000},"location":{"type":"string","maxLength":500}}}},"limitations":{"type":"array","maxItems":50,"items":{"type":"string","maxLength":1000}},"guided_steps":{"type":"array","maxItems":100,"items":{"type":"string","maxLength":2000}}},"additionalProperties":false},{"title":"RollbackArtifactV1","description":"Restores the state a plan started from. Its plan_hash is computed like a plan hash with from_fingerprint as the inspection fingerprint and restore_fingerprint as the desired one, so a rollback needs its own approval.","type":"object","required":["id","adapter_id","adapter_version","target","forward_plan_hash","from_fingerprint","restore_fingerprint","files","plan_hash","created_at"],"properties":{"id":{"type":"string","maxLength":120},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"adapter_version":{"type":"string","pattern":"^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$","maxLength":40,"examples":["1.0.0"]},"target":{"title":"TargetRef","description":"What an adapter operation acts on. `endpoint` is the protected endpoint descriptor approvals bind; `locator` holds adapter-specific coordinates (config path, server name, listener). Every member is covered by plan hashes.","type":"object","additionalProperties":false,"required":["tenant_id","integration_id","adapter_id","endpoint"],"properties":{"tenant_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"organization_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"connection_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"endpoint":{"type":"string","maxLength":300,"minLength":1},"locator":{"type":"object","maxProperties":32,"additionalProperties":{"type":"string","maxLength":1000}}},"examples":[{"tenant_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","integration_id":"int_01jq3v8m2k9x4h7c5n6p0r1s2t","adapter_id":"nginx.oss.server","endpoint":"https://api.example.com:443","locator":{"config":"/etc/nginx/nginx.conf","server_name":"api.example.com"}}]},"forward_plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"from_fingerprint":{"type":"string","pattern":"^([0-9a-f]{64}|absent)?$","maxLength":64},"restore_fingerprint":{"type":"string","pattern":"^([0-9a-f]{64}|absent)?$","maxLength":64},"files":{"type":"array","maxItems":100,"items":{"type":"object","required":["path","existed","sha256"],"properties":{"path":{"type":"string","maxLength":1000},"existed":{"type":"boolean"},"sha256":{"type":"string","pattern":"^([0-9a-f]{64}|absent)?$","maxLength":64},"mode":{"type":"string","maxLength":8},"stored":{"type":"string","maxLength":1000}}}},"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"created_at":{"type":"string","format":"date-time"},"limitations":{"type":"array","maxItems":50,"items":{"type":"string","maxLength":1000}}},"additionalProperties":false}]},"SubmitStepEvidence":{"title":"SubmitStepEvidence","type":"object","additionalProperties":false,"required":["plan_hash","ordinal","kind"],"properties":{"plan_hash":{"type":"string","pattern":"^[0-9a-f]{64}$"},"ordinal":{"type":"integer","minimum":1,"maximum":50},"kind":{"type":"string","enum":["config_applied","certificate_installed","client_configured","verification","old_trust_retired","config_restored","client_restored","apply_failed"]},"integration_run_id":{"type":"string","pattern":"^irn_[a-z0-9_]+$","maxLength":64},"results":{"type":"array","maxItems":50,"items":{"type":"object","additionalProperties":false,"required":["test_id","outcome"],"properties":{"test_id":{"type":"string","maxLength":80,"pattern":"^[a-z0-9_]+$"},"outcome":{"type":"string","enum":["pass","fail"]},"observed":{"type":"string","maxLength":500},"probe":{"type":"string","enum":["active_probe","observed_traffic"],"description":"An active test request, or production traffic observed by the enforcer."}}}},"fingerprints":{"type":"object","additionalProperties":false,"properties":{"before":{"type":"string","maxLength":140},"after":{"type":"string","maxLength":140}}},"note":{"type":"string","maxLength":1000},"observed_at":{"type":"string","format":"date-time","maxLength":40}}},"SubscriptionId":{"title":"SubscriptionId","description":"Opaque identifier with prefix `sub_`.","type":"string","pattern":"^sub_[a-z0-9_]+$","maxLength":64,"examples":["sub_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"SupportGrant":{"title":"SupportGrant","type":"object","required":["id","staff_email","action","reason_code","expires_at"],"properties":{"id":{"$ref":"#/components/schemas/SupportGrantId"},"staff_email":{"type":"string"},"action":{"type":"string"},"reason_code":{"type":"string"},"expires_at":{"type":"string","format":"date-time"},"created_at":{"type":"string","format":"date-time"},"approved_by":{"type":["string","null"]},"active":{"type":"boolean"}}},"SupportGrantCreated":{"title":"SupportGrantCreated","type":"object","required":["id","staff_email","action","reason_code","expires_at"],"properties":{"id":{"$ref":"#/components/schemas/SupportGrantId"},"staff_email":{"type":"string"},"action":{"type":"string"},"reason_code":{"type":"string"},"expires_at":{"$ref":"#/components/schemas/Timestamp"}}},"SupportGrantId":{"title":"SupportGrantId","description":"Opaque identifier with prefix `sg_`.","type":"string","pattern":"^sg_[a-z0-9_]+$","maxLength":64,"examples":["sg_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"SupportGrantList":{"title":"SupportGrantList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/SupportGrant"}}}},"SupportGrantRevoked":{"title":"SupportGrantRevoked","type":"object","required":["id","active"],"properties":{"id":{"$ref":"#/components/schemas/SupportGrantId"},"expires_at":{"$ref":"#/components/schemas/Timestamp"},"active":{"const":false}}},"TargetRef":{"title":"TargetRef","description":"What an adapter operation acts on. `endpoint` is the protected endpoint descriptor approvals bind; `locator` holds adapter-specific coordinates (config path, server name, listener). Every member is covered by plan hashes.","type":"object","additionalProperties":false,"required":["tenant_id","integration_id","adapter_id","endpoint"],"properties":{"tenant_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"organization_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"connection_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"endpoint":{"type":"string","maxLength":300,"minLength":1},"locator":{"type":"object","maxProperties":32,"additionalProperties":{"type":"string","maxLength":1000}}},"examples":[{"tenant_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","integration_id":"int_01jq3v8m2k9x4h7c5n6p0r1s2t","adapter_id":"nginx.oss.server","endpoint":"https://api.example.com:443","locator":{"config":"/etc/nginx/nginx.conf","server_name":"api.example.com"}}]},"Timestamp":{"title":"Timestamp","description":"RFC 3339 UTC timestamp.","type":"string","format":"date-time","examples":["2026-11-13T15:45:00Z"]},"UpdateApprovalPolicy":{"title":"UpdateApprovalPolicy","description":"Partial ApprovalPolicyV1 for one scope. Omitted fields are unchanged; null clears a field so it inherits again. Values looser than the floor an enclosing staff scope sets are refused.","type":"object","additionalProperties":false,"minProperties":1,"properties":{"min_approver_age_hours":{"type":["integer","null"],"minimum":0,"maximum":720},"require_second_approver":{"type":["boolean","null"]},"require_step_up":{"type":["boolean","null"]},"step_up_max_age_minutes":{"type":["integer","null"],"minimum":1,"maximum":60},"independence":{"type":["string","null"],"enum":["strict","standard",null]}},"examples":[{"min_approver_age_hours":72,"require_second_approver":true}]},"UpdateGrantScope":{"title":"UpdateGrantScope","type":"object","additionalProperties":false,"required":["scope"],"properties":{"scope":{"type":"object","additionalProperties":false,"required":["routes"],"properties":{"v":{"const":1},"routes":{"type":"array","minItems":1,"maxItems":50,"items":{"type":"object","additionalProperties":false,"required":["methods","path"],"properties":{"methods":{"type":"array","minItems":1,"maxItems":7,"items":{"type":"string","enum":["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"]},"uniqueItems":true},"path":{"type":"string","pattern":"^/[A-Za-z0-9._~\\-/]*(/\\*)?$","maxLength":200}}}}}},"preview":{"type":"boolean"},"note":{"type":"string","maxLength":500}}},"UpdateInitiationPolicy":{"title":"UpdateInitiationPolicy","type":"object","additionalProperties":false,"minProperties":1,"properties":{"mode":{"type":["string","null"],"enum":["open","approved_partners","owner_initiated",null]},"partner_exceptions":{"type":["array","null"],"maxItems":100,"uniqueItems":true,"items":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64}},"consumer_cutover_approval":{"type":["boolean","null"]},"self_approval":{"type":["string","null"],"enum":["never","sole_approver",null]}}},"UpdateIntegration":{"title":"UpdateIntegration","type":"object","additionalProperties":false,"minProperties":1,"properties":{"name":{"type":"string","minLength":1,"maxLength":80,"pattern":"^[^\\u0000-\\u001f<>]+$"},"require_second_approver":{"type":"boolean"},"state":{"type":"string","enum":["active","disabled"]},"trust_bundle_mode":{"type":"string","enum":["replace","merge"]}}},"UpdateRetention":{"title":"UpdateRetention","type":"object","additionalProperties":false,"minProperties":1,"properties":{"receipt_days":{"type":["integer","null"],"description":"Decision receipt retention in days (7 to 400; null restores the 30-day default)."},"audit_months":{"type":["integer","null"],"description":"Administrative audit retention in months (12 to 84; null restores the 12-month default)."}},"examples":[{"receipt_days":90},{"audit_months":24,"receipt_days":null}]},"UpdateService":{"title":"UpdateService","type":"object","additionalProperties":false,"minProperties":1,"properties":{"grant_approval":{"type":"string","enum":["automatic","sponsor_review"]},"contact":{"type":["string","null"],"maxLength":200},"owner_user_id":{"type":"string","pattern":"^usr_[a-z0-9_]+$","maxLength":64}}},"UpdateWorkloadBinding":{"title":"UpdateWorkloadBinding","type":"object","additionalProperties":false,"required":["subject_uid"],"properties":{"subject_uid":{"anyOf":[{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"},{"type":"null"}]},"note":{"type":"string","maxLength":500}}},"UserId":{"title":"UserId","description":"Opaque identifier with prefix `usr_`.","type":"string","pattern":"^usr_[a-z0-9_]+$","maxLength":64,"examples":["usr_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"Verdict":{"title":"Verdict","type":"string","enum":["allow","deny"]},"VerificationV1":{"title":"VerificationV1","description":"Result of verify or of the acceptance suite: every case with expected and observed behavior and its duration, aggregated into the eight mandatory acceptance categories, plus the measured revocation enforcement time.","type":"object","required":["adapter_id","adapter_version","target","platform_version","suite","outcome","started_at","finished_at","cases"],"properties":{"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"adapter_version":{"type":"string","pattern":"^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$","maxLength":40,"examples":["1.0.0"]},"target":{"title":"TargetRef","description":"What an adapter operation acts on. `endpoint` is the protected endpoint descriptor approvals bind; `locator` holds adapter-specific coordinates (config path, server name, listener). Every member is covered by plan hashes.","type":"object","additionalProperties":false,"required":["tenant_id","integration_id","adapter_id","endpoint"],"properties":{"tenant_id":{"type":"string","pattern":"^org_[a-z0-9_]+$","maxLength":64},"organization_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"service_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"connection_id":{"type":"string","pattern":"^[a-z]+_[a-z0-9_]+$","maxLength":64},"integration_id":{"type":"string","pattern":"^int_[a-z0-9_]+$","maxLength":64},"adapter_id":{"type":"string","description":"vendor.product.surface: lowercase, dot separated.","pattern":"^[a-z0-9_]+(\\.[a-z0-9_]+){2,3}$","maxLength":100,"examples":["nginx.oss.server"]},"endpoint":{"type":"string","maxLength":300,"minLength":1},"locator":{"type":"object","maxProperties":32,"additionalProperties":{"type":"string","maxLength":1000}}},"examples":[{"tenant_id":"org_01jq3v8m2k9x4h7c5n6p0r1s2t","integration_id":"int_01jq3v8m2k9x4h7c5n6p0r1s2t","adapter_id":"nginx.oss.server","endpoint":"https://api.example.com:443","locator":{"config":"/etc/nginx/nginx.conf","server_name":"api.example.com"}}]},"plan_hash":{"type":"string","pattern":"^([0-9a-f]{64})?$"},"platform_version":{"type":"string","maxLength":80},"suite":{"type":"string","enum":["verify","acceptance"]},"outcome":{"type":"string","enum":["passed","failed"]},"started_at":{"type":"string","format":"date-time"},"finished_at":{"type":"string","format":"date-time"},"categories":{"type":"array","maxItems":8,"items":{"type":"object","required":["category","name","outcome","cases","failed"],"properties":{"category":{"type":"integer","minimum":1,"maximum":8},"name":{"type":"string","maxLength":200},"outcome":{"type":"string","enum":["pass","fail","skip","unsupported"]},"cases":{"type":"integer","minimum":0},"failed":{"type":"integer","minimum":0}}}},"cases":{"type":"array","maxItems":500,"items":{"type":"object","required":["id","category","name","expected","observed","outcome","duration_ms"],"properties":{"id":{"type":"string","maxLength":120},"category":{"type":"integer","minimum":1,"maximum":8},"name":{"type":"string","maxLength":300},"expected":{"type":"string","maxLength":500},"observed":{"type":"string","maxLength":4000},"outcome":{"type":"string","enum":["pass","fail","skip","unsupported"]},"duration_ms":{"type":"number","minimum":0},"detail":{"type":"string","maxLength":4000}}}},"revocation":{"type":"object","required":["mode","enforced_by","measured_seconds","bound_seconds"],"properties":{"mode":{"type":"string","enum":["external_authorizer","native","unsupported"]},"enforced_by":{"type":"string","maxLength":200},"measured_seconds":{"type":"number","minimum":0},"bound_seconds":{"type":"number","minimum":0},"reason":{"type":"string","maxLength":1000}}},"environment":{"type":"object","maxProperties":50,"additionalProperties":{"type":"string","maxLength":500}}}},"WebhookReceived":{"title":"WebhookReceived","type":"object","required":[],"properties":{"received":{"type":"boolean"},"duplicate":{"type":"boolean"},"ignored":{"type":"string"}}},"WorkloadBinding":{"title":"WorkloadBinding","type":"object","required":["workload_id","attestation_subject","attestation_subject_uid"],"properties":{"workload_id":{"$ref":"#/components/schemas/WorkloadId"},"attestation_issuer":{"type":"string"},"attestation_subject":{"type":"string"},"attestation_subject_uid":{"type":["string","null"]},"binding_updated_at":{"anyOf":[{"$ref":"#/components/schemas/Timestamp"},{"type":"null"}]},"previous_subject_uid":{"type":["string","null"]}}},"WorkloadId":{"title":"WorkloadId","description":"Opaque identifier with prefix `wl_`.","type":"string","pattern":"^wl_[a-z0-9_]+$","maxLength":64,"examples":["wl_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"WorkloadIssuer":{"title":"WorkloadIssuer","type":"object","required":["id","issuer_url","jwks_uri","state"],"properties":{"id":{"$ref":"#/components/schemas/WorkloadIssuerId"},"issuer_url":{"type":"string","format":"uri"},"jwks_uri":{"type":"string","format":"uri"},"state":{"type":"string","enum":["approved","disabled"]},"created_at":{"type":"string","format":"date-time"}}},"WorkloadIssuerId":{"title":"WorkloadIssuerId","description":"Opaque identifier with prefix `wli_`.","type":"string","pattern":"^wli_[a-z0-9_]+$","maxLength":64,"examples":["wli_01jq3v8m2k9x4h7c5n6p0r1s2t"]},"WorkloadIssuerList":{"title":"WorkloadIssuerList","type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/WorkloadIssuer"}}}},"WorkloadRef":{"title":"WorkloadRef","type":"object","required":["id","name"],"properties":{"id":{"$ref":"#/components/schemas/WorkloadId"},"name":{"type":"string"},"principal":{"type":"string","pattern":"^urn:mutualtrust:workload:"},"attestation_kind":{"type":"string","enum":["sandbox_token","oidc_jwt"]},"attestation_issuer":{"type":"string"},"attestation_subject":{"type":"string"},"attestation_subject_uid":{"type":["string","null"],"description":"Bound Kubernetes service account UID (kubernetes.io.serviceaccount.uid), if any."},"binding_updated_at":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}}}},"responses":{"Problem401":{"description":"Missing or invalid credential (RFC 9457 problem details; `type` is https://mutualtrust.io/problems/<code>, `code` is from the error catalogue).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Problem403":{"description":"Authenticated but not permitted (RFC 9457 problem details; `type` is https://mutualtrust.io/problems/<code>, `code` is from the error catalogue).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Problem404":{"description":"Not found or not visible to the caller (cross-tenant access is concealed as 404) (RFC 9457 problem details; `type` is https://mutualtrust.io/problems/<code>, `code` is from the error catalogue).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Problem409":{"description":"Conflict with current state (RFC 9457 problem details; `type` is https://mutualtrust.io/problems/<code>, `code` is from the error catalogue).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Problem412":{"description":"If-Match revision is stale (RFC 9457 problem details; `type` is https://mutualtrust.io/problems/<code>, `code` is from the error catalogue).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Problem415":{"description":"Unsupported media type (RFC 9457 problem details; `type` is https://mutualtrust.io/problems/<code>, `code` is from the error catalogue).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Problem422":{"description":"Body does not match the command schema (RFC 9457 problem details; `type` is https://mutualtrust.io/problems/<code>, `code` is from the error catalogue).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Problem428":{"description":"Required precondition header (Idempotency-Key or If-Match) is missing (RFC 9457 problem details; `type` is https://mutualtrust.io/problems/<code>, `code` is from the error catalogue).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Problem429":{"description":"Rate limited (see Retry-After) (RFC 9457 problem details; `type` is https://mutualtrust.io/problems/<code>, `code` is from the error catalogue).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}},"Problem503":{"description":"Dependency unavailable (see Retry-After) (RFC 9457 problem details; `type` is https://mutualtrust.io/problems/<code>, `code` is from the error catalogue).","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/Problem"}}}}},"securitySchemes":{"cookieSession":{"type":"apiKey","in":"cookie","name":"__Host-mt_session","description":"Portal session (host-only cookie on app.mutualtrust.io). State-changing requests also need csrfToken."},"csrfToken":{"type":"apiKey","in":"header","name":"x-csrf-token","description":"CSRF token from GET /v1/me, echoed on every cookie-authenticated POST/PATCH."},"apiCredential":{"type":"http","scheme":"bearer","bearerFormat":"mtk_<secret>","description":"Scoped API credential for one organization (a subset of its creator's roles). No CSRF token needed."},"gatewayCredential":{"type":"http","scheme":"bearer","bearerFormat":"mtgw_<secret>","description":"Gateway credential delivered once at pairing; scoped to one gateway of one service."},"enrollmentChallenge":{"type":"apiKey","in":"header","name":"x-enrollment-challenge","description":"Workload proof: the single-use enrollment challenge (polling a pending issuance)."},"pairingPollSecret":{"type":"apiKey","in":"header","name":"x-poll-secret","description":"Gateway proof: the poll secret returned when the pairing was created."},"stripeSignature":{"type":"apiKey","in":"header","name":"stripe-signature","description":"Stripe webhook signature over the raw body."}}}}