{ "openapi": "3.1.0", "info": { "title": "Caldyr control plane HTTP API", "version": "1.8.722+4a5bc7b71e22", "description": "Generated by scripts/ops/gen-openapi.js from the route registrations (CA-201). Paths are relative to /api (rag-api.js strips /api before dispatch) except where an operation names its own server. Do not edit by hand: run `node scripts/ops/gen-openapi.js --write`." }, "servers": [ { "url": "/api" } ], "tags": [ { "name": "audit/routes-audit", "description": "scripts/lib/audit/routes-audit.js" }, { "name": "audit/siem/routes-secret-bindings", "description": "scripts/lib/audit/siem/routes-secret-bindings.js" }, { "name": "audit/siem/routes-siem", "description": "scripts/lib/audit/siem/routes-siem.js" }, { "name": "auth", "description": "scripts/routes/auth.js" }, { "name": "auth/routes-audit", "description": "scripts/lib/auth/routes-audit.js" }, { "name": "auth/routes-automation-tokens", "description": "scripts/lib/auth/routes-automation-tokens.js" }, { "name": "auth/routes-cli-device", "description": "scripts/lib/auth/routes-cli-device.js" }, { "name": "auth/routes-hosts-token", "description": "scripts/lib/auth/routes-hosts-token.js" }, { "name": "auth/routes-internal-signing-chain", "description": "scripts/lib/auth/routes-internal-signing-chain.js" }, { "name": "auth/routes-internal-totp", "description": "scripts/lib/auth/routes-internal-totp.js" }, { "name": "auth/routes-login", "description": "scripts/lib/auth/routes-login.js" }, { "name": "auth/routes-notes", "description": "scripts/lib/auth/routes-notes.js" }, { "name": "auth/routes-opaque", "description": "scripts/lib/auth/routes-opaque.js" }, { "name": "auth/routes-platform-admin-sudo", "description": "scripts/lib/auth/routes-platform-admin-sudo.js" }, { "name": "auth/routes-qa-totp", "description": "scripts/lib/auth/routes-qa-totp.js" }, { "name": "auth/routes-reauth", "description": "scripts/lib/auth/routes-reauth.js" }, { "name": "auth/routes-team-note-token", "description": "scripts/lib/auth/routes-team-note-token.js" }, { "name": "auth/routes-totp", "description": "scripts/lib/auth/routes-totp.js" }, { "name": "auth/routes-users", "description": "scripts/lib/auth/routes-users.js" }, { "name": "auth/routes-vault", "description": "scripts/lib/auth/routes-vault.js" }, { "name": "auth/webauthn/routes-signin", "description": "scripts/lib/auth/webauthn/routes-signin.js" }, { "name": "billing", "description": "scripts/lib/billing/routes.js" }, { "name": "blob", "description": "scripts/routes/blob.js" }, { "name": "cost/routes-cost-proxy", "description": "scripts/lib/cost/routes-cost-proxy.js" }, { "name": "export/routes-export", "description": "scripts/lib/export/routes-export.js" }, { "name": "fleet-routes", "description": "scripts/lib/fleet-routes.js" }, { "name": "fleet/agent-upgrade", "description": "scripts/lib/fleet/agent-upgrade.js" }, { "name": "fleet/cli-launches", "description": "scripts/lib/fleet/cli-launches.js" }, { "name": "fleet/config-export", "description": "scripts/lib/fleet/config-export.js" }, { "name": "fleet/dev-seats", "description": "scripts/lib/fleet/dev-seats.js" }, { "name": "fleet/dispatch", "description": "scripts/lib/fleet/dispatch.js" }, { "name": "fleet/features", "description": "scripts/lib/fleet/features.js" }, { "name": "fleet/hosts", "description": "scripts/lib/fleet/hosts.js" }, { "name": "fleet/recycle", "description": "scripts/lib/fleet/recycle.js" }, { "name": "fleet/routes-config-proxy", "description": "scripts/lib/fleet/routes-config-proxy.js" }, { "name": "fleet/routes-internal-workflow-spawn", "description": "scripts/lib/fleet/routes-internal-workflow-spawn.js" }, { "name": "fleet/routes-webhooks-proxy", "description": "scripts/lib/fleet/routes-webhooks-proxy.js" }, { "name": "fleet/sessions", "description": "scripts/lib/fleet/sessions.js" }, { "name": "fleet/spawn-memory", "description": "scripts/lib/fleet/spawn-memory.js" }, { "name": "fleet/spawn-memory-security-events", "description": "scripts/lib/fleet/spawn-memory-security-events.js" }, { "name": "fleet/transcripts", "description": "scripts/lib/fleet/transcripts.js" }, { "name": "fleet/workflow-reseal", "description": "scripts/lib/fleet/workflow-reseal.js" }, { "name": "fleet/workflows", "description": "scripts/lib/fleet/workflows.js" }, { "name": "identity-proxy", "description": "scripts/lib/identity/routes-identity-proxy.js" }, { "name": "kb-e2e", "description": "scripts/ops/openapi/sources.js" }, { "name": "knowledge/routes-articles", "description": "scripts/lib/knowledge/routes-articles.js" }, { "name": "knowledge/routes-kb-browser", "description": "scripts/lib/knowledge/routes-kb-browser.js" }, { "name": "knowledge/routes-knowledge", "description": "scripts/lib/knowledge/routes-knowledge.js" }, { "name": "license/routes-internal-entitlements", "description": "scripts/lib/license/routes-internal-entitlements.js" }, { "name": "license/routes-internal-licence-inbox", "description": "scripts/lib/license/routes-internal-licence-inbox.js" }, { "name": "notifications/routes", "description": "scripts/lib/notifications/routes.js" }, { "name": "oauth/routes-oauth", "description": "scripts/lib/oauth/routes-oauth.js" }, { "name": "quotas/routes", "description": "scripts/lib/quotas/routes.js" }, { "name": "rag-api", "description": "scripts/rag-api.js" }, { "name": "replay/routes-replay-proxy", "description": "scripts/lib/replay/routes-replay-proxy.js" }, { "name": "scim", "description": "scripts/ops/openapi/sources.js" }, { "name": "secrets-proxy", "description": "scripts/ops/openapi/sources.js" }, { "name": "secrets/routes-secrets-proxy", "description": "scripts/lib/secrets/routes-secrets-proxy.js" }, { "name": "siem-ref-read", "description": "scripts/lib/audit/siem/routes-siem-ref-read.js" }, { "name": "skills", "description": "scripts/lib/skills/routes.js" }, { "name": "spawn-memory-security-events", "description": "scripts/lib/fleet/spawn-memory-security-events.js" } ], "paths": { "/.well-known/oauth-authorization-server": { "get": { "operationId": "get_well_known_oauth_authorization_server", "tags": [ "rag-api" ], "summary": "RFC 8414 metadata of the authorization server (public, cached 5 minutes)", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthServerMetadata" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/admin/claim": { "get": { "operationId": "get_admin_claim", "tags": [ "auth" ], "summary": "The first-admin claim form of a self-hosted hub (public HTML page; the installer prints its URL)", "description": "Served at /admin/claim without the /api prefix: the Bootstrap URL the installer prints. The page holds the claim token from the query in a hidden field and posts e-mail and company name to POST /admin/claim as a form. Under /api the handler does not answer GET.", "parameters": [ { "name": "token", "in": "query", "required": false, "description": "the claim token the installer issued; put into the form only when it is 32 to 128 lowercase hex digits", "schema": { "type": "string" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/AdminClaimForm" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminClaimUnavailable" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" }, "post": { "operationId": "post_admin_claim", "tags": [ "auth" ], "summary": "Claim a self-hosted hub: issue the owner invitation of its first company (public; the installer's claim token is the proof)", "description": "Single use: a claimed token, or any token once a claimed hub has a user, is 409; a hub with users and no claim, or with no claim file, is 404. The same route at /admin/claim without the /api prefix also takes the form post of GET /admin/claim (application/x-www-form-urlencoded: token, email, company_name) and answers 303 to the completion page, or an HTML page with the refusal.", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminClaimRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminClaimed" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminClaimBadRequest" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminClaimTokenInvalid" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminClaimDisabled" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminClaimAlreadyClaimed" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminClaimTokenExpired" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminClaimRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AdminClaimUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/admin/demo-requests": { "get": { "operationId": "get_admin_demo_requests", "tags": [ "identity-proxy" ], "summary": "The 200 newest demo requests (platform admin)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DemoRequestList" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/admin/demo-requests/{demo_request_id}": { "delete": { "operationId": "delete_admin_demo_requests_demo_request_id", "tags": [ "identity-proxy" ], "summary": "Delete a demo request (platform admin)", "parameters": [ { "name": "demo_request_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/admin/demo-requests/{demo_request_id}/approve": { "post": { "operationId": "post_admin_demo_requests_demo_request_id_approve", "tags": [ "identity-proxy" ], "summary": "Approve a demo request: a sign-up link without a company, or an invite into a team or company (platform admin)", "parameters": [ { "name": "demo_request_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DemoRequestApproveRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DemoRequestApproved" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/admin/scim/health": { "get": { "operationId": "get_admin_scim_health", "tags": [ "auth" ], "summary": "State of the per-IP failure throttle of the SCIM endpoint (this process)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimHealth" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/admin/scim/tokens": { "get": { "operationId": "get_admin_scim_tokens", "tags": [ "auth" ], "summary": "SCIM tokens of the company (revoked ones with include_revoked=1); the token values are never returned", "parameters": [ { "name": "include_revoked", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "1" ] } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimTokenList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "post": { "operationId": "post_admin_scim_tokens", "tags": [ "auth" ], "summary": "Create a SCIM bearer token for the company (company owner or admin, Enterprise); the token is shown once", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAdminScimTokensRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimTokenCreated" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/admin/scim/tokens/{token_id}": { "delete": { "operationId": "delete_admin_scim_tokens_token_id", "tags": [ "auth" ], "summary": "Revoke a SCIM token (answers the revoked row)", "parameters": [ { "name": "token_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimTokenRevoked" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/admin/scim/tokens/{token_id}/history": { "get": { "operationId": "get_admin_scim_tokens_token_id_history", "tags": [ "auth" ], "summary": "Audit rows that reference a SCIM token, newest first", "parameters": [ { "name": "token_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 20 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimTokenHistory" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/admin/scim/tokens/{token_id}/rotate": { "post": { "operationId": "post_admin_scim_tokens_token_id_rotate", "tags": [ "auth" ], "summary": "Replace a SCIM token with a new one of the same name; the old one is revoked in the same transaction", "parameters": [ { "name": "token_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimTokenRotated" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/admin/sso/idp-configs": { "get": { "operationId": "get_admin_sso_idp_configs", "tags": [ "auth" ], "summary": "Identity-provider configurations of the caller's company (active only unless include_disabled=1)", "parameters": [ { "name": "include_disabled", "in": "query", "required": false, "description": "1 lists disabled configurations too", "schema": { "type": "string", "enum": [ "1" ] } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpConfigList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "post": { "operationId": "post_admin_sso_idp_configs", "tags": [ "auth" ], "summary": "Create an OIDC identity-provider configuration; the client secret is a handle minted first", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpConfigCreateRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpConfig" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "oneOf": [ { "title": "EnterpriseGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "enterprise_only (422), license_feature_not_included (402), tier_lookup_failed (500), company_admin_required (403), auth_required (401)" }, "feature": { "type": "string" } } }, { "title": "SsoConfigRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value, unexpected_field, inactive_idp_no_jit, reference_not_found, client_secret_handle_required, secret_handle_unknown, secret_handle_bound, domain_conflict, not_found, jit_lookup_failed, jit_seed_failed" }, "detail": { "type": "string" }, "message": { "type": "string" } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/admin/sso/idp-configs/{idp_config_id}": { "put": { "operationId": "put_admin_sso_idp_configs_idp_config_id", "tags": [ "auth" ], "summary": "Update the non-secret fields of a configuration (the secret goes through rotate-secret, the status through PATCH)", "parameters": [ { "name": "idp_config_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpConfigUpdateRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpConfig" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "oneOf": [ { "title": "EnterpriseGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "enterprise_only (422), license_feature_not_included (402), tier_lookup_failed (500), company_admin_required (403), auth_required (401)" }, "feature": { "type": "string" } } }, { "title": "SsoConfigRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value, unexpected_field, inactive_idp_no_jit, reference_not_found, client_secret_handle_required, secret_handle_unknown, secret_handle_bound, domain_conflict, not_found, jit_lookup_failed, jit_seed_failed" }, "detail": { "type": "string" }, "message": { "type": "string" } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "delete": { "operationId": "delete_admin_sso_idp_configs_idp_config_id", "tags": [ "auth" ], "summary": "Soft-delete a configuration (status becomes disabled; the answer is the row)", "parameters": [ { "name": "idp_config_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpConfig" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "oneOf": [ { "title": "EnterpriseGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "enterprise_only (422), license_feature_not_included (402), tier_lookup_failed (500), company_admin_required (403), auth_required (401)" }, "feature": { "type": "string" } } }, { "title": "SsoConfigRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value, unexpected_field, inactive_idp_no_jit, reference_not_found, client_secret_handle_required, secret_handle_unknown, secret_handle_bound, domain_conflict, not_found, jit_lookup_failed, jit_seed_failed" }, "detail": { "type": "string" }, "message": { "type": "string" } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "patch": { "operationId": "patch_admin_sso_idp_configs_idp_config_id", "tags": [ "auth" ], "summary": "Switch a configuration on or off, enable just-in-time provisioning, or set its SCIM token", "parameters": [ { "name": "idp_config_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpConfigPatchRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpConfig" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "oneOf": [ { "title": "EnterpriseGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "enterprise_only (422), license_feature_not_included (402), tier_lookup_failed (500), company_admin_required (403), auth_required (401)" }, "feature": { "type": "string" } } }, { "title": "SsoConfigRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value, unexpected_field, inactive_idp_no_jit, reference_not_found, client_secret_handle_required, secret_handle_unknown, secret_handle_bound, domain_conflict, not_found, jit_lookup_failed, jit_seed_failed" }, "detail": { "type": "string" }, "message": { "type": "string" } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/admin/sso/idp-configs/{idp_config_id}/probe": { "post": { "operationId": "post_admin_sso_idp_configs_idp_config_id_probe", "tags": [ "auth" ], "summary": "Read the provider's discovery document and key set (SSRF-guarded)", "parameters": [ { "name": "idp_config_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpProbeResult" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "oneOf": [ { "title": "EnterpriseGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "enterprise_only (422), license_feature_not_included (402), tier_lookup_failed (500), company_admin_required (403), auth_required (401)" }, "feature": { "type": "string" } } }, { "title": "IdpProbeRefusal", "type": "object", "required": [ "error" ], "properties": { "ok": { "const": false }, "error": { "type": "string", "description": "invalid_value, invalid_issuer_url, forbidden_protocol, forbidden_private_address, dns_failed, dns_empty, forbidden_jwks_redirect, idp_unavailable" }, "detail": { "type": "string" }, "discovery": { "type": "object", "description": "the provider metadata the probe read", "properties": { "issuer": { "type": "string" }, "authorization_endpoint": { "type": "string" }, "token_endpoint": { "type": "string" }, "userinfo_endpoint": { "type": "string" }, "jwks_uri": { "type": "string" }, "response_types_supported": { "type": "array", "items": { "type": "string" } }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string" } }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string" } }, "scopes_supported": { "type": "array", "items": { "type": "string" } }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string" } } } } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpProbeRefusal" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpProbeResult" } } } } }, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "default" } }, "/admin/sso/idp-configs/{idp_config_id}/rotate-secret": { "post": { "operationId": "post_admin_sso_idp_configs_idp_config_id_rotate_secret", "tags": [ "auth" ], "summary": "Replace the client-secret handle of a configuration; the previous binding is revoked", "parameters": [ { "name": "idp_config_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpRotateSecretRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdpConfig" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoConfigRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "oneOf": [ { "title": "EnterpriseGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "enterprise_only (422), license_feature_not_included (402), tier_lookup_failed (500), company_admin_required (403), auth_required (401)" }, "feature": { "type": "string" } } }, { "title": "SsoConfigRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value, unexpected_field, inactive_idp_no_jit, reference_not_found, client_secret_handle_required, secret_handle_unknown, secret_handle_bound, domain_conflict, not_found, jit_lookup_failed, jit_seed_failed" }, "detail": { "type": "string" }, "message": { "type": "string" } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "default" } }, "/admin/sso/secret-bindings": { "post": { "operationId": "post_admin_sso_secret_bindings", "tags": [ "auth" ], "summary": "Mint an opaque handle for an IdP client secret; the value is stored in one of the caller's own teams and never returned", "description": "Company admin and member of team_id, Enterprise tier (no development bypass). 400 invalid_body, invalid_value, value_required; 403 company_admin_required, team_membership_required; 413 payload_too_large (value over 32 KiB); 500 binding_record_failed; 502 secret_store_failed; 503 db_not_ready, authorization_check_unavailable, membership_check_unavailable.", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoSecretBindingRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoSecretBinding" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnterpriseGateRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/agent-config": { "get": { "operationId": "get_agent_config", "tags": [ "auth" ], "summary": "The composed instruction text for the caller's company and an optional team", "parameters": [ { "name": "team_id", "in": "query", "required": false, "description": "a team the caller belongs to, or any team for a company owner or admin", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigCascade" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/agent-config/company": { "get": { "operationId": "get_agent_config_company", "tags": [ "auth" ], "summary": "The company instruction overlay", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigOverlay" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "put": { "operationId": "put_agent_config_company", "tags": [ "auth" ], "summary": "Replace the company instruction overlay (company owner or admin)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigCompanyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigSaved" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/agent-config/global": { "get": { "operationId": "get_agent_config_global", "tags": [ "auth" ], "summary": "The global instruction layer", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigGlobal" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "put": { "operationId": "put_agent_config_global", "tags": [ "auth" ], "summary": "Replace the global instruction layer (platform admin with a level-A sudo grant)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigGlobalRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigSaved" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigGlobalRefusal" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/agent-config/team/{team_id}": { "get": { "operationId": "get_agent_config_team_team_id", "tags": [ "auth" ], "summary": "The instruction overlay of a team (a member, or a company owner or admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigOverlay" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "put": { "operationId": "put_agent_config_team_team_id", "tags": [ "auth" ], "summary": "Replace the instruction overlay of a team (team or company admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigTeamRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigSaved" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentConfigRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/articles": { "get": { "operationId": "get_articles", "tags": [ "knowledge/routes-articles" ], "summary": "Articles the caller may read (metadata only)", "parameters": [ { "name": "scope", "in": "query", "required": false, "schema": { "enum": [ "all", "company", "global" ], "default": "all" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 50 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleSealed" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleListRefused" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/knowledge/routes-articles.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_articles", "tags": [ "knowledge/routes-articles" ], "summary": "Create a company article (201), or update the one at the same source_path (200)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleCreateRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleUpdatedByPath" } } } }, "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleCreated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ArticleSealed", "type": "object", "required": [ "error", "hint" ], "properties": { "error": { "const": "e2e_sealed" }, "hint": { "const": "kb.local" } } }, { "title": "ArticlePathTaken", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "article_path_taken" }, "detail": { "type": "string" } } } ] } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleRefused" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/knowledge/routes-articles.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/articles/search": { "get": { "operationId": "get_articles_search", "tags": [ "knowledge/routes-articles" ], "summary": "Search articles by keyword or meaning (never reaches team notes)", "parameters": [ { "name": "q", "in": "query", "required": true, "schema": { "type": "string", "maxLength": 2048 } }, { "name": "scope", "in": "query", "required": false, "schema": { "enum": [ "all", "company", "global" ], "default": "all" } }, { "name": "mode", "in": "query", "required": false, "schema": { "enum": [ "keyword", "semantic" ], "default": "keyword" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 50, "default": 20 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleSearchResults" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleSealed" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleSearchRefused" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/knowledge/routes-articles.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/articles/{article_id}": { "get": { "operationId": "get_articles_article_id", "tags": [ "knowledge/routes-articles" ], "summary": "One article with its body", "parameters": [ { "name": "article_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleDetail" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleSealed" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/knowledge/routes-articles.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_articles_article_id", "tags": [ "knowledge/routes-articles" ], "summary": "Delete a company article (author, or company owner or admin)", "parameters": [ { "name": "article_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleDeleted" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleSealed" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/knowledge/routes-articles.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_articles_article_id", "tags": [ "knowledge/routes-articles" ], "summary": "Edit a company article (author, or company owner or admin); source_path stays as it was", "parameters": [ { "name": "article_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleEditRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleEdited" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleSealed" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleRefused" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArticleUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/knowledge/routes-articles.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/audit": { "get": { "operationId": "get_audit", "tags": [ "rag-api" ], "summary": "Operator feed of the secret, vault and workflow audit tables (platform admin session or fleet admin bearer)", "parameters": [ { "name": "table", "in": "query", "required": false, "description": "all, or a comma-separated subset of secret, vault, workflow", "schema": { "type": "string", "default": "all" } }, { "name": "op", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "caller_id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "since", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 200 } }, { "name": "format", "in": "query", "required": false, "description": "csv answers text/csv with content-disposition audit.csv", "schema": { "enum": [ "json", "csv" ], "default": "json" } } ], "security": [ { "session": [] }, { "adminToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditFeed" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditTableMissing" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-vault" } }, "/audit/encrypted": { "post": { "operationId": "post_audit_encrypted", "tags": [ "auth" ], "summary": "Record an audit event whose reason and meta the browser sealed under the team key", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditEncryptedRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditEncryptedDeduplicated" } } } }, "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditEncryptedQueued" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditEncryptedRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/audit/keys/{key_id}": { "get": { "operationId": "get_audit_keys_key_id", "tags": [ "audit/routes-audit" ], "summary": "Audit-signing keys of a company, newest first (company admin; the path id is the company id)", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditKeyList" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/audit/routes-audit.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/audit/keys/{key_id}/disaster-rotate": { "post": { "operationId": "post_audit_keys_key_id_disaster_rotate", "tags": [ "audit/routes-audit" ], "summary": "Disaster rotation of the company audit signing key: a new key, the old one retired (company Owner, confirmation phrase and TOTP step-up, one per company per clock hour)", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuditKeysKeyIdDisasterRotateRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuditKeysKeyIdDisasterRotateResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/audit/routes-audit.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/audit/keys/{key_id}/rotate": { "post": { "operationId": "post_audit_keys_key_id_rotate", "tags": [ "audit/routes-audit" ], "summary": "Rotate the audit-signing key of a company (company admin; the path id is the company id); any body is ignored", "parameters": [ { "name": "key_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditKeyRotated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/audit/routes-audit.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/audit/log": { "get": { "operationId": "get_audit_log", "tags": [ "auth/routes-audit" ], "summary": "Audit journal of the caller's company (own rows for a role without audit.read.all) or of a Solo account", "description": "format=csv answers 200 text/csv (columns ts, action, outcome, user_id, resource_type, resource_id, reason, caller_email, caller_role, caller_kind) with a content-disposition attachment.", "parameters": [ { "name": "action", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "since", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "until", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "user_id", "in": "query", "required": false, "schema": { "type": "string", "format": "uuid" } }, { "name": "outcome", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "team_id", "in": "query", "required": false, "schema": { "type": "string", "format": "uuid" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 1000, "default": 100 } }, { "name": "format", "in": "query", "required": false, "schema": { "enum": [ "json", "csv" ], "default": "json" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditLogPage" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-audit.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/audit/proof/{proof_id}": { "get": { "operationId": "get_audit_proof_proof_id", "tags": [ "audit/routes-audit" ], "summary": "Signature record of one audit_log row (company admin; the path id is the row id)", "parameters": [ { "name": "proof_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditProof" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/audit/routes-audit.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/audit/pubkey/{pubkey_id}": { "get": { "operationId": "get_audit_pubkey_pubkey_id", "tags": [ "audit/routes-audit" ], "summary": "Public audit-signing key of a company (no authentication; the path id is the company id)", "parameters": [ { "name": "pubkey_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "at", "in": "query", "required": false, "description": "the key that was active at this time; default the active key", "schema": { "type": "string", "format": "date-time" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditPubkey" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditKeyMissing" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/audit/routes-audit.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/audit/verify": { "get": { "operationId": "get_audit_verify", "tags": [ "audit/routes-audit" ], "summary": "Verify the signature chain of the company journal over a range (company admin); 207 when anything is wrong", "parameters": [ { "name": "from", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "to", "in": "query", "required": false, "schema": { "type": "string", "format": "date-time" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer" } }, { "name": "batch", "in": "query", "required": false, "description": "page size; turns on paged mode", "schema": { "type": "integer" } }, { "name": "after_id", "in": "query", "required": false, "description": "paged mode cursor (next_after_id of the previous page)", "schema": { "type": "string" } }, { "name": "prev_hash", "in": "query", "required": false, "description": "paged mode: prev_hash_out of the previous page", "schema": { "type": "string" } }, { "name": "company_id", "in": "query", "required": false, "description": "must be the caller's own company", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditVerifyResult" } } } }, "207": { "description": "Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditVerifyResultFailed" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/audit/routes-audit.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/automation/refresh": { "post": { "operationId": "post_auth_automation_refresh", "tags": [ "auth/routes-automation-tokens" ], "summary": "Spend the automation refresh token (bearer) and receive the next pair on the same chain (public)", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AutomationRefreshPair" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AutomationRefreshRefused" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTenantGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTenantGateRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AutomationRefreshInternal" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "oneOf": [ { "title": "CliTenantGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } }, "description": "the tenant gate's refusal (suspended company, licence read-only), as tenant-gate.js wrote it; 503 carries Retry-After" }, { "title": "AutomationRateLimitUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "rate_limit_unavailable" } } } ] } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-automation-tokens.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/cli/approve": { "post": { "operationId": "post_auth_cli_approve", "tags": [ "auth/routes-cli-device" ], "summary": "Approve or deny a CLI sign-in; an approval from another network needs a reauth token of purpose cli_approve", "security": [ { "session": [] }, { "sessionBearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliApproveRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliDecision" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliApproveBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliApproveForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliApproveNotFound" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliApproveDecided" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliApproveExpired" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliPayloadTooLarge4" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliInternal" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRateLimitUnavailable2" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/auth/routes-cli-device.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "rule:cli-person" } }, "/auth/cli/device": { "post": { "operationId": "post_auth_cli_device", "tags": [ "auth/routes-cli-device" ], "summary": "Start a CLI sign-in: a device code for the terminal and a user code for the person (public)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliDeviceStartRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliDeviceStarted" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliDeviceStartRefused" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliPayloadTooLarge" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliInternal" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/auth/routes-cli-device.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/cli/lookup": { "post": { "operationId": "post_auth_cli_lookup", "tags": [ "auth/routes-cli-device" ], "summary": "What a typed user code asks for (signed-in person)", "security": [ { "session": [] }, { "sessionBearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLookupRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLookup" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLookupBadBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliCodeInvalid" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliCodeDecided" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliCodeExpired" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliPayloadTooLarge3" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliInternal" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRateLimitUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/auth/routes-cli-device.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "rule:cli-person" } }, "/auth/cli/refresh": { "post": { "operationId": "post_auth_cli_refresh", "tags": [ "auth/routes-cli-device" ], "summary": "Spend the refresh token (bearer) and receive the next pair on the same chain (public)", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTokenPairRefreshed" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRefreshRefused" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTenantGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTenantGateRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliInternal" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTenantGateRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-cli-device.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/cli/revoke": { "post": { "operationId": "post_auth_cli_revoke", "tags": [ "auth/routes-cli-device" ], "summary": "Sign the terminal out: end the chain of the presented CLI token (public)", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRevoked" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliInternal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-cli-device.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/cli/sessions": { "get": { "operationId": "get_auth_cli_sessions", "tags": [ "auth/routes-cli-device" ], "summary": "The person's live CLI sessions (up to 200)", "security": [ { "session": [] }, { "sessionBearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliSessionList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliForbidden" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliInternal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-cli-device.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "rule:cli-person" } }, "/auth/cli/sessions/{session_id}": { "delete": { "operationId": "delete_auth_cli_sessions_session_id", "tags": [ "auth/routes-cli-device" ], "summary": "Revoke one CLI session by chain id (own, or any of the company for an owner or admin)", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "sessionBearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliSessionRevoked" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliSessionNotFound" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliInternal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-cli-device.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "rule:cli-person" } }, "/auth/cli/token": { "post": { "operationId": "post_auth_cli_token", "tags": [ "auth/routes-cli-device" ], "summary": "The CLI polls with its device code; the answer is the token pair once the person approved (public)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTokenPollRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTokenPair" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTokenPending" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTenantGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTenantGateRefusal" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliPayloadTooLarge2" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliInternal" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliTenantGateRefusal" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/auth/routes-cli-device.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/clients": { "get": { "operationId": "get_auth_clients", "tags": [ "auth" ], "summary": "Device (client) tokens: the caller's own, the whole company with scope=company (owner or admin), or every token for the fleet admin bearer", "parameters": [ { "name": "scope", "in": "query", "required": false, "schema": { "enum": [ "mine", "company" ], "default": "mine" } } ], "security": [ { "apiToken": [] }, { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientTokenList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:legacy-shared-token" }, "post": { "operationId": "post_auth_clients", "tags": [ "auth" ], "summary": "Mint a device token; the value is returned once", "security": [ { "apiToken": [] }, { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientTokenCreateRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientTokenCreated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:legacy-shared-token" } }, "/auth/clients/{rest}": { "delete": { "operationId": "delete_auth_clients_rest", "tags": [ "auth" ], "summary": "Revoke a device token (own, or any of the company for an owner or admin)", "parameters": [ { "name": "rest", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "apiToken": [] }, { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientTokenRevoked" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ClientTokenRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientTokenRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:legacy-shared-token", "x-caldyr-prefix-match": true }, "patch": { "operationId": "patch_auth_clients_rest", "tags": [ "auth" ], "summary": "Replace the policy of a device token", "parameters": [ { "name": "rest", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "apiToken": [] }, { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientTokenPolicyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientTokenUpdated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ClientTokenRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientTokenRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:legacy-shared-token", "x-caldyr-prefix-match": true } }, "/auth/enroll": { "post": { "operationId": "post_auth_enroll", "tags": [ "auth" ], "summary": "Redeem a pairing code for a device token (public)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrollRedeemRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrollRedeemed" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrollCodeInvalid" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrollRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/enrollments": { "post": { "operationId": "post_auth_enrollments", "tags": [ "auth" ], "summary": "Issue a device pairing code (15 minutes) for the caller, or for another user of the company (owner or admin)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrollmentCreateRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrollmentCreated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/logout": { "post": { "operationId": "post_auth_logout", "tags": [ "auth/routes-login" ], "summary": "Sign out the credential that carried the request (session and cookies); 204 with no body", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LogoutNoSession" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LogoutFailed" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-login.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/me": { "delete": { "operationId": "delete_auth_me", "tags": [ "auth" ], "summary": "Erase a Solo account and everything of it (TOTP step-up); a company account is refused", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountEraseRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountErased" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "AccountEraseForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden, company_account (reason), csrf_token mismatch" }, "detail": { "type": "string" }, "reason": { "type": "string" } } }, { "title": "StepUpRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "step_up_required" }, "reason": { "enum": [ "totp_not_enrolled", "too_many_attempts" ], "description": "absent when the code is missing or wrong" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountEraseBlocked" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountEraseUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/me/change-passphrase": { "post": { "operationId": "post_auth_me_change_passphrase", "tags": [ "auth" ], "summary": "Re-wrap the master key and every team wrap under a new passphrase; sessions and tokens are revoked", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangePassphraseRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PassphraseChanged" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangePassphraseBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangePassphraseForbidden" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangePassphraseConflict" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordLoginRemoved4" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangePassphraseRevokeIncomplete" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangePassphraseRewrapFailed" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChangePassphraseUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/me/e2ee-blob": { "get": { "operationId": "get_auth_me_e2ee_blob", "tags": [ "auth" ], "summary": "The caller's end-to-end envelope and membership wraps, for the passphrase change", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eeBlob" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eeBlobMissing" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/opaque/login/finish": { "post": { "operationId": "post_auth_opaque_login_finish", "tags": [ "auth/routes-opaque" ], "summary": "OPAQUE sign-in, final message; opens a session (cookie and token)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthOpaqueLoginFinishRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignInResponse" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-opaque.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/opaque/login/start": { "post": { "operationId": "post_auth_opaque_login_start", "tags": [ "auth/routes-opaque" ], "summary": "OPAQUE sign-in, first message", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthOpaqueLoginStartRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpaqueStartResponse" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-opaque.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/opaque/reauth/finish": { "post": { "operationId": "post_auth_opaque_reauth_finish", "tags": [ "auth/routes-opaque" ], "summary": "OPAQUE re-authentication, final message; mints a single-use reauth token", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthOpaqueReauthFinishRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthOpaqueReauthFinishResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-opaque.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/opaque/reauth/start": { "post": { "operationId": "post_auth_opaque_reauth_start", "tags": [ "auth/routes-opaque" ], "summary": "OPAQUE re-authentication of the signed-in user, first message", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthOpaqueReauthStartRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpaqueStartResponse" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-opaque.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/opaque/register/finish": { "post": { "operationId": "post_auth_opaque_register_finish", "tags": [ "auth/routes-opaque" ], "summary": "OPAQUE registration, final message (session ticket; the other kinds finish in their own flow)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthOpaqueRegisterFinishRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthOpaqueRegisterFinishResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-opaque.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/opaque/register/start": { "post": { "operationId": "post_auth_opaque_register_start", "tags": [ "auth/routes-opaque" ], "summary": "OPAQUE registration, first message, under a ticket (session, recovery, invite or signup)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthOpaqueRegisterStartRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthOpaqueRegisterStartResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-opaque.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/passkey/finish": { "post": { "operationId": "post_auth_passkey_finish", "tags": [ "auth/webauthn/routes-signin" ], "summary": "Sign-in with a passkey, step two: verify the assertion and open a session (cookie and token)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyFinishRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeySignIn" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyFinishBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyNotAccepted" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyWrongSubdomain" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyChallengeGone" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyRateLimited" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/auth/webauthn/routes-signin.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/passkey/options": { "post": { "operationId": "post_auth_passkey_options", "tags": [ "auth/webauthn/routes-signin" ], "summary": "Sign-in with a passkey, step one: a discoverable-credential challenge (public; the answer does not depend on whether the account exists)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyOptionsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyOptions" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyOptionsBadRequest" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyOptionsFailed" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/auth/webauthn/routes-signin.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/auth/password": { "patch": { "operationId": "patch_auth_password", "tags": [ "auth/routes-login" ], "summary": "Replace the sign-in credential of an OPAQUE account after a re-authentication; every session is revoked", "description": "An account that holds end-to-end key material answers 409 password_is_also_vault_key (change the passphrase instead); an account still on a bcrypt hash, or a body with current_password / new_password, answers 410 password_login_removed.", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChangeRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChanged" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChangeBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UnauthorizedBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChangeForbidden" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChangeConflict" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordLoginRemoved" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordChangeRevokeIncomplete" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/auth/routes-login.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/reauth/methods": { "get": { "operationId": "get_auth_reauth_methods", "tags": [ "auth/routes-reauth" ], "summary": "The re-authentication methods the signed-in user can use for one purpose", "description": "Query parameter purpose: one of the reauth purposes. passkey and sso are offered only for cli_approve and oauth_authorize.", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAuthReauthMethodsResponse200" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReauthMethodsBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UnauthorizedBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-reauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/reauth/passkey/finish": { "post": { "operationId": "post_auth_reauth_passkey_finish", "tags": [ "auth/routes-reauth" ], "summary": "Passkey re-authentication: verify the assertion and mint a single-use reauth token", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthReauthPasskeyFinishRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthReauthPasskeyFinishResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-reauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/reauth/passkey/options": { "post": { "operationId": "post_auth_reauth_passkey_options", "tags": [ "auth/routes-reauth" ], "summary": "Passkey re-authentication: WebAuthn request options bound to purpose and session", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthReauthPasskeyOptionsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthReauthPasskeyOptionsResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-reauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/reauth/sso/finish": { "post": { "operationId": "post_auth_reauth_sso_finish", "tags": [ "auth/routes-reauth" ], "summary": "SSO re-authentication: claim a verified challenge and mint a single-use reauth token", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthReauthSsoFinishRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthReauthSsoFinishResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-reauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/reauth/sso/start": { "post": { "operationId": "post_auth_reauth_sso_start", "tags": [ "auth/routes-reauth" ], "summary": "SSO re-authentication: start a fresh sign-in at the company IdP (prompt=login, max_age=0)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthReauthSsoStartRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthReauthSsoStartResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-reauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/recovery-challenge": { "post": { "operationId": "post_auth_recovery_challenge", "tags": [ "auth" ], "summary": "A one-time challenge for the recovery proof, with the account's seed salt (public; the recovery token or code gates it)", "security": [ { "recoveryGate": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryChallengeRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryChallenge" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryChallengeRefused" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:recovery-gate" } }, "/auth/recovery-material": { "post": { "operationId": "post_auth_recovery_material", "tags": [ "auth" ], "summary": "The wrapped recovery material of an account, after the recovery gate and a signed proof (public)", "security": [ { "recoveryGate": [], "recoveryProof": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryMaterialRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryMaterial" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryMaterialMalformed" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryMaterialRefused" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthRateLimited" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:recovery-proof" } }, "/auth/recovery-request": { "post": { "operationId": "post_auth_recovery_request", "tags": [ "auth" ], "summary": "Ask for a recovery token to be mailed; always 202, whether or not the account exists (public)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryRequestBody" } } } }, "responses": { "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryAccepted" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthRateLimited" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/auth/recovery-rotate": { "post": { "operationId": "post_auth_recovery_rotate", "tags": [ "auth" ], "summary": "Replace the account's keys and sign-in credential after a recovery proof; every session and token is revoked (public; the recovery token or code gates it)", "security": [ { "recoveryGate": [], "recoveryProof": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryRotateRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryRotated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryRotateBadRequest" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecoveryRotateRefused" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordLoginRemoved3" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:recovery-proof" } }, "/auth/roaming-auth-pref": { "get": { "operationId": "get_auth_roaming_auth_pref", "tags": [ "auth" ], "summary": "Whether the caller allows roaming security keys", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoamingAuthPref" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyUnauthorized" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "put": { "operationId": "put_auth_roaming_auth_pref", "tags": [ "auth" ], "summary": "Allow or refuse roaming security keys for the caller", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoamingAuthPrefRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoamingAuthPrefSet" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoamingAuthPrefInvalid" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/session": { "post": { "operationId": "post_auth_session", "tags": [ "auth" ], "summary": "Exchange a client token (sct_..., as bearer) for a short-lived device session", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeviceSession" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeviceSessionRefused" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/sessions": { "get": { "operationId": "get_auth_sessions", "tags": [ "auth/routes-login" ], "summary": "The caller's live sessions, the current one marked", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UnauthorizedBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-login.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_auth_sessions", "tags": [ "auth/routes-login" ], "summary": "Sign out everywhere: revoke every session, CLI chain and OAuth grant of the caller", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionsRevoked" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UnauthorizedBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-login.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/sessions/{session_id}": { "delete": { "operationId": "delete_auth_sessions_session_id", "tags": [ "auth/routes-login" ], "summary": "Revoke one session of the caller", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionRevoked" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UnauthorizedBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionNotFound" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-login.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/signing-token": { "post": { "operationId": "post_auth_signing_token", "tags": [ "skills" ], "summary": "Mint a short-lived signing token from an OPAQUE re-authentication of the session user", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthSigningTokenRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SigningToken" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SigningTokenUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SigningTokenForbidden" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordLoginRemoved2" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SigningTokenTotp" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/sso/callback": { "get": { "operationId": "get_auth_sso_callback", "tags": [ "auth" ], "summary": "The provider's redirect back: verifies the answer, links or provisions the user and opens a session (302 to return_to with the session cookie)", "description": "A refusal a person can act on goes to the sign-in page (302 /fleet/login?sso_error=) or, for a TOTP-enrolled first link, to /fleet/sso/link-totp#token=...; any other client reads the JSON refusal.", "parameters": [ { "name": "code", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "state", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "error", "in": "query", "required": false, "description": "set by the provider on a refusal", "schema": { "type": "string" } } ], "security": [], "responses": { "302": { "description": "Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoCallbackRedirect" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoCallbackBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoCallbackTotp" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "oneOf": [ { "title": "SsoGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "enterprise_only (422), license_feature_not_included (402)" }, "feature": { "type": "string" } } }, { "title": "SsoSeatsExhausted", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "license_seats_exhausted" }, "detail": { "type": "string" } } } ] } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoCallbackForbidden" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoGateRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoCallbackFailed" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoCallbackUnavailable" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public", "x-caldyr-prefix-match": true } }, "/auth/sso/finalize-e2ee": { "post": { "operationId": "post_auth_sso_finalize_e2ee", "tags": [ "auth" ], "summary": "Enrol end-to-end encryption after an SSO sign-in: upload the wrapped master and salts", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FinalizeE2eeRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eeEnrolled" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eeAlreadyEnrolled" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eeEnrolRefused" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/sso/link/totp": { "post": { "operationId": "post_auth_sso_link_totp", "tags": [ "auth" ], "summary": "Second factor of a first SSO link for a TOTP-enrolled account (public; the link token proves the provider half)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkTotpRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkTotpDone" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkTotpBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkTotpInvalid" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkTotpForbidden" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkTotpConflict" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoGateRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoRateLimited" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/sso/links/confirm": { "post": { "operationId": "post_auth_sso_links_confirm", "tags": [ "auth" ], "summary": "Confirm a pending first link with a re-authentication (reauth token)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkConfirmRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkConfirmed" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkConfirmBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkConfirmUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkConfirmForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkNotFound" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoLinkConfirmConflict" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasswordLoginRemoved5" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoRateLimited" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/sso/links/pending": { "get": { "operationId": "get_auth_sso_links_pending", "tags": [ "auth" ], "summary": "First links waiting for the caller's confirmation", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoPendingLinks" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/sso/skip-e2ee": { "post": { "operationId": "post_auth_sso_skip_e2ee", "tags": [ "auth" ], "summary": "Opt out of end-to-end encryption after an SSO sign-in (refused when the organisation requires it)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkipE2eeRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eeSkipped" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eeSkipConflict" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eeSkipRefused" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/sso/start": { "get": { "operationId": "get_auth_sso_start", "tags": [ "auth" ], "summary": "Begin an OIDC sign-in: 302 to the identity provider (public); the provider is chosen by config_id, email domain or company slug", "parameters": [ { "name": "config_id", "in": "query", "required": false, "description": "an active identity-provider configuration", "schema": { "type": "string", "format": "uuid" } }, { "name": "email", "in": "query", "required": false, "description": "the provider is found by the email domain", "schema": { "type": "string" } }, { "name": "company", "in": "query", "required": false, "description": "the provider is found by the company slug", "schema": { "type": "string" } }, { "name": "return_to", "in": "query", "required": false, "description": "a same-origin path starting with a single /", "schema": { "type": "string", "maxLength": 256 } } ], "security": [], "responses": { "302": { "description": "Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoStartRedirect" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoGateRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoNoConfig" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "oneOf": [ { "title": "SsoGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "enterprise_only (422), license_feature_not_included (402)" }, "feature": { "type": "string" } } }, { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoStartFailed" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoIdpDiscoveryFailed" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public", "x-caldyr-prefix-match": true } }, "/auth/totp/enroll/start": { "post": { "operationId": "post_auth_totp_enroll_start", "tags": [ "auth/routes-totp" ], "summary": "Start TOTP enrolment (re-enrolment needs a proof of the current factor)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthTotpEnrollStartRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthTotpEnrollStartResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-totp.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/totp/enroll/verify": { "post": { "operationId": "post_auth_totp_enroll_verify", "tags": [ "auth/routes-totp" ], "summary": "Finish TOTP enrolment with a code from the new secret; answers the recovery codes", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthTotpEnrollVerifyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostAuthTotpEnrollVerifyResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-totp.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/auth/webauthn/assert/finish": { "post": { "operationId": "post_auth_webauthn_assert_finish", "tags": [ "auth" ], "summary": "Device unlock, step two: verify the assertion (session required) and return the PRF-wrapped master", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnAssertFinishRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnUnlock" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnAssertBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnAssertRefused" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnAssertForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnUnknownCredential" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnChallengeGone" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyRateLimited" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/webauthn/assert/migrate": { "post": { "operationId": "post_auth_webauthn_assert_migrate", "tags": [ "auth" ], "summary": "Replace the PRF wrap of a legacy credential with one under the fixed salt (single-use token from assert/finish)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnMigrateRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnMigrated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnMigrateBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnAlreadyMigrated" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnMigrationGone" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/webauthn/assert/options": { "post": { "operationId": "post_auth_webauthn_assert_options", "tags": [ "auth" ], "summary": "Device unlock, step one: a challenge. With a session it lists the caller's own credentials; without one the answer is uniform and cannot be finished", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnAssertOptionsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnAssertOptions" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnAssertOptionsBadRequest" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnOptionsFailed2" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/webauthn/credentials": { "get": { "operationId": "get_auth_webauthn_credentials", "tags": [ "auth" ], "summary": "The caller's registered passkeys", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnCredentialList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyUnauthorized" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyRateLimited" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/webauthn/credentials/{credential_id}": { "delete": { "operationId": "delete_auth_webauthn_credentials_credential_id", "tags": [ "auth" ], "summary": "Remove one of the caller's passkeys", "parameters": [ { "name": "credential_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteAuthWebauthnCredentialsCredentialIdResponse200" } } } }, "400": { "description": "Bad Request" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "404": { "description": "Not Found" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OwnerRequiresLocalCredential" } } } }, "422": { "description": "Unprocessable Entity" }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnRemoveRevokeIncomplete" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "patch": { "operationId": "patch_auth_webauthn_credentials_credential_id", "tags": [ "auth" ], "summary": "Rename a passkey", "parameters": [ { "name": "credential_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnRenameRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnRenamed" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnRenameBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnCredentialNotFound" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyRateLimited" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/webauthn/register/finish": { "post": { "operationId": "post_auth_webauthn_register_finish", "tags": [ "auth" ], "summary": "Register a device passkey, step two: verify the attestation and store the PRF-wrapped master; other sessions are revoked", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnRegisterFinishRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnRegistered" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnRegisterBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnAlreadyRegistered" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnNoChallenge" } } } }, "412": { "description": "Precondition Failed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnE2eeNotEnrolled2" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnPrfMissing" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnRegisterRevokeIncomplete" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/auth/webauthn/register/options": { "post": { "operationId": "post_auth_webauthn_register_options", "tags": [ "auth" ], "summary": "Register a device passkey, step one: creation options and the PRF salt (needs an enrolled passphrase)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnRegisterOptionsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnRegisterOptions" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "412": { "description": "Precondition Failed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnE2eeNotEnrolled" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PasskeyRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebauthnOptionsFailed" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/billing/checkout-session": { "post": { "operationId": "post_billing_checkout_session", "tags": [ "billing" ], "summary": "Open a Stripe Checkout session for a subscription (company admin); the redirect targets are fixed server-side", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingCheckoutRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingSession" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingCheckoutRefused" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingStripeFailed" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingNotConfigured" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/billing/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/billing/config": { "get": { "operationId": "get_billing_config", "tags": [ "billing" ], "summary": "Whether self-service payment is available on this install (some tier has a Stripe price configured)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingConfig" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/billing/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/billing/invoices": { "get": { "operationId": "get_billing_invoices", "tags": [ "billing" ], "summary": "The company's Stripe invoices, newest first (company admin)", "parameters": [ { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 10 } }, { "name": "starting_after", "in": "query", "required": false, "description": "the next_cursor of the previous page", "schema": { "type": "string", "pattern": "^in_[A-Za-z0-9]+$" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingInvoiceList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingInvoicesFailed" } } } } }, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "default" } }, "/billing/invoices/{invoice_id}/pdf": { "get": { "operationId": "get_billing_invoices_invoice_id_pdf", "tags": [ "billing" ], "summary": "Stream an invoice PDF of the caller's own Stripe customer (company admin)", "description": "Errors are JSON with a sentence, as the stream helper writes them: 400 invalid invoice id, 401 auth required, 403 invoice does not belong to your company or the admin refusal, 404 no stripe customer linked or invoice not found, 409 invoice has no pdf available, 502 upstream pdf fetch failed.", "parameters": [ { "name": "invoice_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/pdf": { "schema": { "$ref": "#/components/schemas/BillingInvoicePdf" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingPdfBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingPdfForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingPdfNotFound" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingPdfNoFile" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingPdfInternal" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingPdfUpstream" } } } } }, "x-caldyr-source": "scripts/lib/billing/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/billing/portal-session": { "post": { "operationId": "post_billing_portal_session", "tags": [ "billing" ], "summary": "Open the Stripe customer portal (company admin)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingPortalRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingSession" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingPortalRefused" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingNoCustomer" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingPortalFailed" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingBaseUrl" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/billing/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/billing/subscription": { "get": { "operationId": "get_billing_subscription", "tags": [ "billing" ], "summary": "The company's active subscription, or null", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillingSubscription" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/billing/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/billing/webhook": { "post": { "operationId": "post_billing_webhook", "tags": [ "billing" ], "summary": "Stripe webhook receiver (signature-verified); a repeated event id is acknowledged without processing", "description": "The raw request body is the Stripe event; the signature is the Stripe-Signature header, checked against the webhook secret. Errors as written by the handler: 400 missing stripe-signature header, invalid signature or bad request; 413 payload too large (over about 512 KiB); 422 malformed event; 500 internal_error.", "security": [ { "stripeSignature": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StripeWebhookEvent" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StripeWebhookAck" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StripeWebhookBadRequest" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StripeWebhookTooLarge" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StripeWebhookMalformed" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/billing/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:stripe-webhook" } }, "/blob": { "post": { "operationId": "post_blob", "tags": [ "blob" ], "summary": "Store an encrypted blob (team axis, or the caller's own user axis)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BlobCreateRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BlobCreated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/blob.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/blob/lookup": { "post": { "operationId": "post_blob_lookup", "tags": [ "blob" ], "summary": "Find team blobs by one blind-index entry", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BlobLookupRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BlobLookupResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/blob.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/blob/search": { "post": { "operationId": "post_blob_search", "tags": [ "blob" ], "summary": "Find team blobs by up to 32 blind-index entries", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BlobSearchRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BlobSearchResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/blob.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/blob/{blob_id}": { "get": { "operationId": "get_blob_blob_id", "tags": [ "blob" ], "summary": "GET /blob/{blob_id}", "parameters": [ { "name": "blob_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BlobRead" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/blob.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "delete": { "operationId": "delete_blob_blob_id", "tags": [ "blob" ], "summary": "DELETE /blob/{blob_id}", "parameters": [ { "name": "blob_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BlobDeleted" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/blob.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/capabilities": { "get": { "operationId": "get_capabilities", "tags": [ "auth" ], "summary": "What this install speaks (open)", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Capabilities" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:probe" } }, "/cli/launches": { "post": { "operationId": "post_cli_launches", "tags": [ "fleet/cli-launches" ], "summary": "Register a CLI launch on a host (CLI token plus the host token header); mints the launch spawn token", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLaunchRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLaunchCreated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLaunchLimit" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLaunchUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/cli-launches.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/cli/launches/{launche_id}/end": { "post": { "operationId": "post_cli_launches_launche_id_end", "tags": [ "fleet/cli-launches" ], "summary": "Mark a CLI launch exited and drop its tokens", "parameters": [ { "name": "launche_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLaunchEndRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLaunchEnded" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/cli-launches.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/cli/launches/{launche_id}/heartbeat": { "post": { "operationId": "post_cli_launches_launche_id_heartbeat", "tags": [ "fleet/cli-launches" ], "summary": "Keep a CLI launch alive (CLI token plus the host token header); answers killed when the launch must stop", "parameters": [ { "name": "launche_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLaunchHeartbeatRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliLaunchHeartbeat" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/cli-launches.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/cli/policy": { "get": { "operationId": "get_cli_policy", "tags": [ "fleet/cli-launches" ], "summary": "Which agents the CLI may launch for the caller's team (CLI token)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CliPolicy" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentPolicyUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/fleet/cli-launches.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/companies/me": { "get": { "operationId": "get_companies_me", "tags": [ "auth" ], "summary": "The caller's company", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompanyMe" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompanyNotFound" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/companies/register": { "post": { "operationId": "post_companies_register", "tags": [ "auth" ], "summary": "Withdrawn: self-registration of a company was removed in the 2026 redesign; use the sign-up flow", "description": "Open route: answers 410 { error: \"retired\", detail } to everyone and reads no body.", "security": [], "responses": { "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompanyRegisterRetired" } } } } }, "x-caldyr-withdrawn": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/companies/{company_id}/policy/roaming-auth": { "put": { "operationId": "put_companies_company_id_policy_roaming_auth", "tags": [ "auth" ], "summary": "Allow or refuse roaming security keys for the company (owner or admin of it)", "parameters": [ { "name": "company_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoamingPolicyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoamingPolicySet" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoamingPolicyUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoamingPolicyForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoamingPolicyNotFound" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RoamingPolicyInvalid" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/company": { "delete": { "operationId": "delete_company", "tags": [ "auth" ], "summary": "Erase the company and everything of it (owner, TOTP step-up)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompanyEraseRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompanyErased" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "StepUpRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "step_up_required" }, "reason": { "enum": [ "totp_not_enrolled", "too_many_attempts" ], "description": "absent when the code is missing or wrong" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantPurgeBlocked" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantPurgeBlocked" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/company/e2e-mode": { "get": { "operationId": "get_company_e2e_mode", "tags": [ "auth" ], "summary": "Company end-to-end mode: state and preconditions while off, switch-on progress while on (owner or admin)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eModeState" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "post": { "operationId": "post_company_e2e_mode", "tags": [ "auth" ], "summary": "Switch the company to end-to-end mode, one way (owner, TOTP step-up); starts the migration", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eSwitchOnRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eSwitchedOn" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "StepUpRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "step_up_required" }, "reason": { "enum": [ "totp_not_enrolled", "too_many_attempts" ], "description": "absent when the code is missing or wrong" } } } ] } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eSwitchOnRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/company/e2e-mode/consent": { "post": { "operationId": "post_company_e2e_mode_consent", "tags": [ "auth" ], "summary": "Give the late \"unresealed\" consent after the switch (owner, TOTP step-up)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eConsentRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eConsentGiven" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "StepUpRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "step_up_required" }, "reason": { "enum": [ "totp_not_enrolled", "too_many_attempts" ], "description": "absent when the code is missing or wrong" } } } ] } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eSwitchOnRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/company/e2e-mode/migration": { "post": { "operationId": "post_company_e2e_mode_migration", "tags": [ "auth" ], "summary": "Run one migration pass of the switch-on (owner or admin)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eMigrationStep" } } } }, "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eMigrationBusy" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eSwitchOnRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/company/e2e-mode/transcript-reseal": { "get": { "operationId": "get_company_e2e_mode_transcript_reseal", "tags": [ "auth" ], "summary": "Sessions that still hold legacy transcript rows or meta (owner or admin, mode on)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResealList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResealConflict" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "post": { "operationId": "post_company_e2e_mode_transcript_reseal", "tags": [ "auth" ], "summary": "Replace a batch of legacy transcript frames with sealed copies (compare-and-swap; owner or admin, mode on)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResealBatchRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResealBatchResult" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResealRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResealConflict" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/company/e2e-mode/transcript-reseal/meta": { "post": { "operationId": "post_company_e2e_mode_transcript_reseal_meta", "tags": [ "auth" ], "summary": "Replace the legacy meta blob of a session with a sealed copy (owner or admin, mode on)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResealMetaRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResealMetaResult" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResealRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResealConflict" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/company/e2e-sandbox-policy/{e2e_sandbox_policy_id}": { "get": { "operationId": "get_company_e2e_sandbox_policy_e2e_sandbox_policy_id", "tags": [ "auth" ], "summary": "The sealed sandbox floor of a team; the path id is the team id (owner or admin)", "parameters": [ { "name": "e2e_sandbox_policy_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SandboxPolicy" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "put": { "operationId": "put_company_e2e_sandbox_policy_e2e_sandbox_policy_id", "tags": [ "auth" ], "summary": "Store the sealed sandbox floor of a team; the path id is the team id (owner or admin, mode on)", "parameters": [ { "name": "e2e_sandbox_policy_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SandboxPolicyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SandboxPolicy" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/company/sessions/revoke-all": { "post": { "operationId": "post_company_sessions_revoke_all", "tags": [ "auth" ], "summary": "End every session of the company except the caller's own (company Owner, confirmation phrase, one per company per clock hour)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompanySessionsRevoked" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/csp-report": { "post": { "operationId": "post_csp_report", "tags": [ "auth" ], "summary": "Browser Content-Security-Policy violation report (open); always 204, malformed or oversize reports included", "security": [], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CspReport" } } } }, "responses": { "204": { "description": "No Content" } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:probe" } }, "/demo-requests": { "post": { "operationId": "post_demo_requests", "tags": [ "identity-proxy" ], "summary": "Ask for a demo (public); one pending request per address", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DemoRequestCreateRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DemoRequestCreated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:public" } }, "/e2e/approver-key": { "put": { "operationId": "put_e2e_approver_key", "tags": [ "auth" ], "summary": "Publish the caller's workflow approver public key", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eApproverKeyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eApproverKeyPublished" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eWriteRefusal2" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/e2e/approver-keys": { "get": { "operationId": "get_e2e_approver_keys", "tags": [ "auth" ], "summary": "Approver public keys of the active human members of a team", "parameters": [ { "name": "team_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eApproverKeys" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/e2e/holders": { "get": { "operationId": "get_e2e_holders", "tags": [ "auth" ], "summary": "Per key version of a scope: how many users, hosts and tokens hold a wrap, and the pending rotation", "parameters": [ { "name": "scope_kind", "in": "query", "required": true, "schema": { "enum": [ "team", "company" ] } }, { "name": "scope_id", "in": "query", "required": true, "description": "a team of the caller's company, or the company id for scope_kind company", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eHolders" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/e2e/keys": { "get": { "operationId": "get_e2e_keys", "tags": [ "auth" ], "summary": "The caller's own key wraps and the rotations pending on the scopes the caller administers", "description": "A chain token reads its chain's wraps; a token of the legacy slot reads none.", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeysList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "post": { "operationId": "post_e2e_keys", "tags": [ "auth" ], "summary": "Create the next key version of a scope with its first wraps (at least one user wrap)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyCreateRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyCreated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eWriteRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/e2e/keys/wraps": { "post": { "operationId": "post_e2e_keys_wraps", "tags": [ "auth" ], "summary": "Add wraps of existing key versions (a new member or host)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyWrapsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyWrapsAdded" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eWriteRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/e2e/recipients": { "get": { "operationId": "get_e2e_recipients", "tags": [ "auth" ], "summary": "Who should receive a wrap of a new key version of the scope (active members, hosts and token chains with a public key)", "parameters": [ { "name": "scope_kind", "in": "query", "required": true, "schema": { "enum": [ "team", "company" ] } }, { "name": "scope_id", "in": "query", "required": true, "description": "a team of the caller's company, or the company id for scope_kind company", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eRecipients" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eKeyRefusal" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/erasure": { "get": { "operationId": "get_erasure", "tags": [ "auth" ], "summary": "The latest erasure request of the caller's tenant (company Owner or Solo account)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureState" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureForbidden2" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureFailed" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "post": { "operationId": "post_erasure", "tags": [ "auth" ], "summary": "Schedule erasure of the tenant after a grace period (TOTP step-up); locks the tenant", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureRequestBody" } } } }, "responses": { "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureQueued" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErasureForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden, or csrf_token mismatch" }, "detail": { "type": "string" } } }, { "title": "StepUpRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "step_up_required" }, "reason": { "enum": [ "totp_not_enrolled", "too_many_attempts" ], "description": "absent when the code is missing or wrong" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasurePending" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureFailed" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/erasure/cancel": { "post": { "operationId": "post_erasure_cancel", "tags": [ "auth" ], "summary": "Cancel a queued erasure (TOTP step-up); a running, failed or finished one cannot be cancelled", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureCancelBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureCancelled" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErasureForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden, or csrf_token mismatch" }, "detail": { "type": "string" } } }, { "title": "StepUpRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "step_up_required" }, "reason": { "enum": [ "totp_not_enrolled", "too_many_attempts" ], "description": "absent when the code is missing or wrong" } } } ] } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureNotPending" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErasureFailed" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/exports": { "get": { "operationId": "get_exports", "tags": [ "export/routes-export" ], "summary": "The tenant's exports, newest first (up to 50)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ExportForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "owner_required (a company Owner or a Solo account holder), or csrf_token mismatch" }, "detail": { "type": "string" } } }, { "title": "ExportStepUp", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "step_up_required" }, "detail": { "type": "string" }, "reason": { "type": "string" } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportFailed" } } } } }, "x-caldyr-source": "scripts/lib/export/routes-export.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_exports", "tags": [ "export/routes-export" ], "summary": "Request an export of the tenant's data (company Owner or Solo account, TOTP step-up); one active export per owner, three a day", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportRequestBody" } } } }, "responses": { "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportQueued" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ExportForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "owner_required (a company Owner or a Solo account holder), or csrf_token mismatch" }, "detail": { "type": "string" } } }, { "title": "ExportStepUp", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "step_up_required" }, "detail": { "type": "string" }, "reason": { "type": "string" } } } ] } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportInProgress" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportFailed" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/export/routes-export.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/exports/{export_id}/download": { "get": { "operationId": "get_exports_export_id_download", "tags": [ "export/routes-export" ], "summary": "Download a finished export as a zip (the person who requested it)", "parameters": [ { "name": "export_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/zip": { "schema": { "$ref": "#/components/schemas/ExportArchive" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ExportForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "owner_required (a company Owner or a Solo account holder), or csrf_token mismatch" }, "detail": { "type": "string" } } }, { "title": "ExportStepUp", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "step_up_required" }, "detail": { "type": "string" }, "reason": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportNotFound" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportNotReady" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportExpired" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportFailed" } } } } }, "x-caldyr-source": "scripts/lib/export/routes-export.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet": { "get": { "operationId": "get_fleet", "tags": [ "fleet-routes" ], "summary": "Console shell", "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/_design-system": { "get": { "operationId": "get_fleet_design_system", "tags": [ "fleet-routes" ], "summary": "Design-system reference page", "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/agent-roles": { "get": { "operationId": "get_fleet_agent_roles", "tags": [ "fleet/routes-config-proxy" ], "summary": "Read from the fleet-config service", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_fleet_agent_roles", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/agent-roles/{agent_role_id}": { "get": { "operationId": "get_fleet_agent_roles_agent_role_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Read from the fleet-config service", "parameters": [ { "name": "agent_role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_fleet_agent_roles_agent_role_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Deleted through the fleet-config service", "parameters": [ { "name": "agent_role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "204": { "description": "No Content" }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_fleet_agent_roles_agent_role_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "parameters": [ { "name": "agent_role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/agents/catalog": { "get": { "operationId": "get_fleet_agents_catalog", "tags": [ "fleet/hosts" ], "summary": "Agent model catalog, optionally for one host", "description": "The models a spawn may name per agent (besides `auto`). With `host`, the list the host's daemon reported (installed agents, versions, models read from each CLI) or the static catalog when it reported none; POST /fleet/sessions checks a spawn on that host against the same list.", "parameters": [ { "name": "host", "in": "query", "required": false, "description": "a host id; absent: the static catalog", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentCatalog" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "enum": [ "invalid_host" ] } } } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "enum": [ "host_not_found" ] } } } } } } }, "x-caldyr-source": "scripts/lib/fleet/hosts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/auth/whoami": { "get": { "operationId": "get_fleet_auth_whoami", "tags": [ "fleet-routes" ], "summary": "The caller's identity, role, memberships and company modes", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetWhoami" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/fleet/auth/ws-ticket": { "post": { "operationId": "post_fleet_auth_ws_ticket", "tags": [ "fleet-routes" ], "summary": "Mint a single-use WebSocket ticket for a viewer, workflow, metrics or notification stream", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WsTicketRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WsTicket" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WsTicketRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WsTicketUnknownRole" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/fleet/backend-configs": { "get": { "operationId": "get_fleet_backend_configs", "tags": [ "fleet-routes" ], "summary": "Config files per agent backend (what the console offers for editing)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BackendConfigs" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/fleet/company": { "get": { "operationId": "get_fleet_company", "tags": [ "fleet-routes" ], "summary": "Company page", "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/company/{rest}": { "get": { "operationId": "get_fleet_company_rest", "tags": [ "fleet-routes" ], "summary": "Company page sub-route (client-side routing)", "parameters": [ { "name": "rest", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static", "x-caldyr-prefix-match": true } }, "/fleet/config/export": { "get": { "operationId": "get_fleet_config_export", "tags": [ "fleet/config-export" ], "summary": "Configuration bundle of the company (hosts, groups, roles, prices, features, webhooks, workflows); admin bearer", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetConfigExport" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhooksUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/fleet/config-export.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/cost/burnrate": { "get": { "operationId": "get_fleet_cost_burnrate", "tags": [ "quotas/routes" ], "summary": "Hourly cost points and the month-end projection of the company or one team", "parameters": [ { "name": "scope", "in": "query", "required": false, "schema": { "enum": [ "company", "team" ], "default": "company" } }, { "name": "days", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 90, "default": 7 } }, { "name": "scope_ref", "in": "query", "required": false, "description": "the team, for scope=team", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CostBurnrate" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/quotas/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/cost/export": { "get": { "operationId": "get_fleet_cost_export", "tags": [ "cost/routes-cost-proxy" ], "summary": "Cost ledger export (CSV)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "text/csv": { "schema": { "$ref": "#/components/schemas/CostExportCsv" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-cost", "x-caldyr-source": "scripts/lib/cost/routes-cost-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/cost/rollup-timeline": { "get": { "operationId": "get_fleet_cost_rollup_timeline", "tags": [ "cost/routes-cost-proxy" ], "summary": "Rolled-up cost timeline", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrcostAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-cost", "x-caldyr-source": "scripts/lib/cost/routes-cost-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/cost/summary": { "get": { "operationId": "get_fleet_cost_summary", "tags": [ "cost/routes-cost-proxy" ], "summary": "Cost summary of the caller's scope", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrcostAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-cost", "x-caldyr-source": "scripts/lib/cost/routes-cost-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/cost/timeline": { "get": { "operationId": "get_fleet_cost_timeline", "tags": [ "cost/routes-cost-proxy" ], "summary": "Cost timeline", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrcostAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-cost", "x-caldyr-source": "scripts/lib/cost/routes-cost-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/dev-seats": { "get": { "operationId": "get_fleet_dev_seats", "tags": [ "fleet/dev-seats" ], "summary": "List the company's developer seats with the count held and the limit (company owner/admin)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevSeatList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevSeatForbidden" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevSeatListFailed" } } } } }, "x-caldyr-source": "scripts/lib/fleet/dev-seats.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/dev-seats/{dev_seat_id}/restore": { "post": { "operationId": "post_fleet_dev_seats_dev_seat_id_restore", "tags": [ "fleet/dev-seats" ], "summary": "Restore a revoked developer seat; the next launch consumes it (company owner/admin)", "description": "Reads no body. Deletes the revoked seat row; the person's next launch consumes a seat again.", "parameters": [ { "name": "dev_seat_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevSeatRestored" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "DevSeatForbidden", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "no_tenant", "company_admin_required" ] } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ], "description": "no_tenant: the caller has no company (a Solo person)" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevSeatNotRevoked" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevSeatWriteFailed" } } } } }, "x-caldyr-source": "scripts/lib/fleet/dev-seats.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/dev-seats/{dev_seat_id}/revoke": { "post": { "operationId": "post_fleet_dev_seats_dev_seat_id_revoke", "tags": [ "fleet/dev-seats" ], "summary": "Revoke a person's developer seat and end their CLI launches (company owner/admin)", "description": "Reads no body. Ends the person's CLI launches; revoking a revoked seat answers already: true and ends nothing.", "parameters": [ { "name": "dev_seat_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevSeatRevoked" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "DevSeatForbidden", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "no_tenant", "company_admin_required" ] } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ], "description": "no_tenant: the caller has no company (a Solo person)" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevSeatUserNotFound" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DevSeatWriteFailed" } } } } }, "x-caldyr-source": "scripts/lib/fleet/dev-seats.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/dispatch": { "post": { "operationId": "post_fleet_dispatch", "tags": [ "fleet/dispatch" ], "summary": "Spawn a session on a host chosen by tag, group, name or id", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetDispatchRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetDispatchResult" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/dispatch.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/download/{rest}": { "get": { "operationId": "get_fleet_download_rest", "tags": [ "fleet-routes" ], "summary": "Agent bundle, package or checksum from the allowlisted dist directory (no authentication)", "parameters": [ { "name": "rest", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "application/octet-stream": { "schema": { "$ref": "#/components/schemas/FleetDownloadFile" } } } }, "304": { "description": "Not Modified" } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static", "x-caldyr-prefix-match": true } }, "/fleet/exec": { "post": { "operationId": "post_fleet_exec", "tags": [ "fleet/dispatch" ], "summary": "Run a prompt once on a matching online host and wait for the result", "description": "In the end-to-end mode the answer is the sealed exec-result envelope; otherwise the output text.", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetExecRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetExecResult" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostAtCapacity" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/dispatch.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/features": { "get": { "operationId": "get_fleet_features", "tags": [ "fleet/features" ], "summary": "List the platform-wide fleet feature flags", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetFleetFeaturesResponse200" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "detail": { "type": "string" } } } } } } }, "x-caldyr-source": "scripts/lib/fleet/features.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/features/{feature_id}": { "patch": { "operationId": "patch_fleet_features_feature_id", "tags": [ "fleet/features" ], "summary": "Set a platform-wide fleet feature flag (platform admin + sudo, audited)", "parameters": [ { "name": "feature_id", "in": "path", "required": true, "schema": { "type": "string", "pattern": "^[\\w-]{1,64}$" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchFleetFeaturesFeatureIdRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchFleetFeaturesFeatureIdResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "detail": { "type": "string" } } } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "detail": { "type": "string" } } } } } } }, "x-caldyr-source": "scripts/lib/fleet/features.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/groups": { "get": { "operationId": "get_fleet_groups", "tags": [ "fleet/routes-config-proxy" ], "summary": "Read from the fleet-config service", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_fleet_groups", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/groups/{group_id}": { "get": { "operationId": "get_fleet_groups_group_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Read from the fleet-config service", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_fleet_groups_group_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Deleted through the fleet-config service", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "204": { "description": "No Content" }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_fleet_groups_group_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/groups/{group_id}/hosts": { "post": { "operationId": "post_fleet_groups_group_id_hosts", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/groups/{group_id}/hosts/{host_id}": { "delete": { "operationId": "delete_fleet_groups_group_id_hosts_host_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Deleted through the fleet-config service", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "204": { "description": "No Content" }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/groups/{group_id}/restore": { "post": { "operationId": "post_fleet_groups_group_id_restore", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/groups/{group_id}/roles": { "get": { "operationId": "get_fleet_groups_group_id_roles", "tags": [ "fleet/routes-config-proxy" ], "summary": "Read from the fleet-config service", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "put": { "operationId": "put_fleet_groups_group_id_roles", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_fleet_groups_group_id_roles", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/groups/{group_id}/roles/{role_id}": { "delete": { "operationId": "delete_fleet_groups_group_id_roles_role_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Deleted through the fleet-config service", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "204": { "description": "No Content" }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/groups/{group_id}/upgrade": { "post": { "operationId": "post_fleet_groups_group_id_upgrade", "tags": [ "fleet/agent-upgrade" ], "summary": "Upgrade the agents of the hosts of a group, one at a time", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostFleetGroupsGroupIdUpgradeRequest" } } } }, "responses": { "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentUpgradeRunQueued" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/agent-upgrade.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/healthz": { "get": { "operationId": "get_fleet_healthz", "tags": [ "fleet-routes" ], "summary": "Liveness probe of the fleet dispatcher (no authentication)", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHealthz" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:probe" } }, "/fleet/hosts": { "get": { "operationId": "get_fleet_hosts", "tags": [ "fleet/hosts" ], "summary": "List the hosts of the caller's company (all hosts for the fleet admin bearer)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHostList" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/hosts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}": { "get": { "operationId": "get_fleet_hosts_host_id", "tags": [ "fleet/hosts" ], "summary": "Read one host", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHostDetail" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/hosts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_fleet_hosts_host_id", "tags": [ "fleet/hosts" ], "summary": "Delete a host and cascade to its sessions, events, metrics and group memberships", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "confirm", "in": "query", "required": true, "description": "must be 1; any other value answers 400 confirm_required", "schema": { "type": "string", "enum": [ "1" ] } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/hosts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_fleet_hosts_host_id", "tags": [ "fleet/hosts" ], "summary": "Update a host's display name, capabilities or session limit", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchFleetHostsHostIdRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHost" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/hosts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}/clear-mtls-pin": { "post": { "operationId": "post_fleet_hosts_host_id_clear_mtls_pin", "tags": [ "auth/routes-hosts-token" ], "summary": "Clear the pinned client-certificate fingerprint of a host", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHostMtlsPinCleared" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-hosts-token.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}/file": { "get": { "operationId": "get_fleet_hosts_host_id_file", "tags": [ "fleet/hosts" ], "summary": "Read a file on an online host", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "path", "in": "query", "required": true, "description": "absolute POSIX path, no .. segment, no NUL", "schema": { "type": "string", "minLength": 1 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHostFileRead" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/hosts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "put": { "operationId": "put_fleet_hosts_host_id_file", "tags": [ "fleet/hosts" ], "summary": "Write a file on an online host", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutFleetHostsHostIdFileRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHostFileWrite" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/hosts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}/inventory": { "get": { "operationId": "get_fleet_hosts_host_id_inventory", "tags": [ "fleet/hosts" ], "summary": "The inventory the daemon reported (metadata.inventory), {} when none", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHostInventory" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/hosts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}/metrics": { "get": { "operationId": "get_fleet_hosts_host_id_metrics", "tags": [ "fleet/hosts" ], "summary": "Metric samples of a host", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "since", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "15m", "1h", "6h", "24h", "7d" ], "default": "1h" } }, { "name": "downsampled", "in": "query", "required": false, "description": "1 reads the five-minute rollup (bucket, cpu_pct_avg, cpu_pct_max, ram_used_bytes)", "schema": { "type": "string", "enum": [ "1", "0" ] } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHostMetrics" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/hosts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}/revoke-token": { "post": { "operationId": "post_fleet_hosts_host_id_revoke_token", "tags": [ "auth/routes-hosts-token" ], "summary": "Revoke a host and its token", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHostRevoked" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-hosts-token.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}/roles": { "get": { "operationId": "get_fleet_hosts_host_id_roles", "tags": [ "fleet/routes-config-proxy" ], "summary": "Read from the fleet-config service", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_fleet_hosts_host_id_roles", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}/roles/effective": { "get": { "operationId": "get_fleet_hosts_host_id_roles_effective", "tags": [ "fleet/routes-config-proxy" ], "summary": "Read from the fleet-config service", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}/roles/{role_id}": { "delete": { "operationId": "delete_fleet_hosts_host_id_roles_role_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Deleted through the fleet-config service", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "role_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "204": { "description": "No Content" }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}/rotate-token": { "post": { "operationId": "post_fleet_hosts_host_id_rotate_token", "tags": [ "auth/routes-hosts-token" ], "summary": "Rotate the host token and push the new one to the connected daemon", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetHostTokenRotated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-hosts-token.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/hosts/{host_id}/upgrade": { "post": { "operationId": "post_fleet_hosts_host_id_upgrade", "tags": [ "fleet/agent-upgrade" ], "summary": "Upgrade the agent of one host to the published version", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostFleetHostsHostIdUpgradeRequest" } } } }, "responses": { "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentUpgradeSent" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/agent-upgrade.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/install-macos.sh": { "get": { "operationId": "get_fleet_install_macos_sh", "tags": [ "fleet-routes" ], "summary": "Universal installer script, macOS name (no authentication)", "security": [], "responses": { "200": { "description": "OK", "content": { "text/x-shellscript": { "schema": { "$ref": "#/components/schemas/FleetInstallScript" } } } }, "304": { "description": "Not Modified" } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/install-windows.ps1": { "get": { "operationId": "get_fleet_install_windows_ps1", "tags": [ "fleet-routes" ], "summary": "Windows installer script (no authentication); served from the build's download directory when the build ships it, otherwise the request falls through to the authentication gate", "security": [], "responses": { "200": { "description": "OK", "content": { "text/plain": { "schema": { "$ref": "#/components/schemas/FleetInstallScriptWindows" } } } }, "304": { "description": "Not Modified" }, "401": { "description": "Unauthorized" } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/install.sh": { "get": { "operationId": "get_fleet_install_sh", "tags": [ "fleet-routes" ], "summary": "Universal installer script (no authentication)", "security": [], "responses": { "200": { "description": "OK", "content": { "text/x-shellscript": { "schema": { "$ref": "#/components/schemas/FleetInstallScript" } } } }, "304": { "description": "Not Modified" } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/local-sessions": { "post": { "operationId": "post_fleet_local_sessions", "tags": [ "auth" ], "summary": "Mirror a locally started agent session into the fleet (idempotent on local_session_id)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LocalSessionCreate" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LocalSessionCreated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfOrCompanyRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/fleet/local-sessions/{local_session_id}/exit": { "put": { "operationId": "put_fleet_local_sessions_local_session_id_exit", "tags": [ "auth" ], "summary": "Mark a mirrored local session as exited (the path id is the fleet session id)", "parameters": [ { "name": "local_session_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LocalSessionExit" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LocalSessionExited" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfOrCompanyRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/fleet/oauth/consent": { "get": { "operationId": "get_fleet_oauth_consent", "tags": [ "fleet-routes" ], "summary": "OAuth consent page", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/fleet/prices": { "get": { "operationId": "get_fleet_prices", "tags": [ "fleet/routes-config-proxy" ], "summary": "Read from the fleet-config service", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_fleet_prices", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/prices/resolve": { "post": { "operationId": "post_fleet_prices_resolve", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/prices/{price_id}": { "delete": { "operationId": "delete_fleet_prices_price_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Deleted through the fleet-config service", "parameters": [ { "name": "price_id", "in": "path", "required": true, "schema": { "type": "integer", "minimum": 0 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "204": { "description": "No Content" }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_fleet_prices_price_id", "tags": [ "fleet/routes-config-proxy" ], "summary": "Written through the fleet-config service", "parameters": [ { "name": "price_id", "in": "path", "required": true, "schema": { "type": "integer", "minimum": 0 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedfleetconfigAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "fleet-config", "x-caldyr-source": "scripts/lib/fleet/routes-config-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/qa-totp": { "get": { "operationId": "get_fleet_qa_totp", "tags": [ "fleet-routes" ], "summary": "QA TOTP tool page", "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/recovery": { "get": { "operationId": "get_fleet_recovery", "tags": [ "fleet-routes" ], "summary": "Account recovery page", "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/recycle-bin": { "get": { "operationId": "get_fleet_recycle_bin", "tags": [ "fleet/recycle" ], "summary": "Deleted groups and workflows", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecycleBin" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/recycle.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/register": { "get": { "operationId": "get_fleet_register", "tags": [ "fleet-routes" ], "summary": "Registration page", "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/sessions": { "get": { "operationId": "get_fleet_sessions", "tags": [ "fleet/sessions" ], "summary": "List sessions (members see their own; company admins the whole company)", "parameters": [ { "name": "host_id", "in": "query", "required": false, "schema": { "type": "string", "format": "uuid" } }, { "name": "status", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "since", "in": "query", "required": false, "description": "started_at >=", "schema": { "type": "string", "format": "date-time" } }, { "name": "until", "in": "query", "required": false, "description": "started_at <=", "schema": { "type": "string", "format": "date-time" } }, { "name": "q", "in": "query", "required": false, "description": "accepted and ignored; the session label is end-to-end encrypted", "schema": { "type": "string" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 100 } }, { "name": "offset", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "default": 0 } }, { "name": "with_count", "in": "query", "required": false, "description": "1 adds rows, total, limit and offset to the answer", "schema": { "enum": [ "1" ] } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionList" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/sessions.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_fleet_sessions", "tags": [ "fleet/sessions" ], "summary": "Spawn an agent session on a host", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostFleetSessionsRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostFleetSessionsResponse201" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/fleet/sessions.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/by-bucket": { "get": { "operationId": "get_fleet_sessions_by_bucket", "tags": [ "cost/routes-cost-proxy" ], "summary": "Sessions inside one cost bucket", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrcostAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-cost", "x-caldyr-source": "scripts/lib/cost/routes-cost-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/cleanup": { "post": { "operationId": "post_fleet_sessions_cleanup", "tags": [ "fleet/sessions" ], "summary": "Delete closed sessions older than an interval (at most 1000 per call)", "parameters": [ { "name": "older_than", "in": "query", "required": false, "description": "used when the body names none", "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionCleanupRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionCleanupResponse" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionCleanupInvalid" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/sessions.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/cost-batch": { "post": { "operationId": "post_fleet_sessions_cost_batch", "tags": [ "cost/routes-cost-proxy" ], "summary": "Cost of several sessions in one call", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrcostBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrcostAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "caldyr-cost", "x-caldyr-source": "scripts/lib/cost/routes-cost-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/meta-batch": { "post": { "operationId": "post_fleet_sessions_meta_batch", "tags": [ "fleet/sessions" ], "summary": "Sealed metadata of up to 200 sessions", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionMetaBatchRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionMetaBatchResponse" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/sessions.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/search": { "post": { "operationId": "post_fleet_sessions_search", "tags": [ "fleet/sessions" ], "summary": "Find sessions by one blind-index entry of their sealed metadata", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionSearchRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionSearchResponse" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/sessions.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}": { "get": { "operationId": "get_fleet_sessions_session_id", "tags": [ "fleet/sessions" ], "summary": "GET /fleet/sessions/{session_id}", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSession" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/sessions.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_fleet_sessions_session_id", "tags": [ "fleet/sessions" ], "summary": "Set the sealed label and notes of a session", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchFleetSessionsSessionIdRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionPatched" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/sessions.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/bookmarks": { "get": { "operationId": "get_fleet_sessions_session_id_bookmarks", "tags": [ "replay/routes-replay-proxy" ], "summary": "Bookmarks of a session", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrreplayAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-replay", "x-caldyr-source": "scripts/lib/replay/routes-replay-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_fleet_sessions_session_id_bookmarks", "tags": [ "replay/routes-replay-proxy" ], "summary": "Add a bookmark to a session", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrreplayBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrreplayAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "caldyr-replay", "x-caldyr-source": "scripts/lib/replay/routes-replay-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/cost": { "get": { "operationId": "get_fleet_sessions_session_id_cost", "tags": [ "cost/routes-cost-proxy" ], "summary": "Cost of one session", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrcostAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-cost", "x-caldyr-source": "scripts/lib/cost/routes-cost-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/input": { "post": { "operationId": "post_fleet_sessions_session_id_input", "tags": [ "fleet/sessions" ], "summary": "Send input to a running session (plain data, or a sealed claim)", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionInputRequest" } } } }, "responses": { "204": { "description": "No Content" }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionInputSealRequired" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/sessions.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/keyframes": { "post": { "operationId": "post_fleet_sessions_session_id_keyframes", "tags": [ "replay/routes-replay-proxy" ], "summary": "Store a keyframe", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrreplayBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedCaldyrreplayAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptSealedRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "caldyr-replay", "x-caldyr-source": "scripts/lib/replay/routes-replay-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/keyframes/verify": { "get": { "operationId": "get_fleet_sessions_session_id_keyframes_verify", "tags": [ "replay/routes-replay-proxy" ], "summary": "Verify the latest keyframe", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedCaldyrreplayAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptSealedRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-replay", "x-caldyr-source": "scripts/lib/replay/routes-replay-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/keyframes/{keyframe_id}": { "get": { "operationId": "get_fleet_sessions_session_id_keyframes_keyframe_id", "tags": [ "replay/routes-replay-proxy" ], "summary": "Keyframe at a sequence number (the keyframe id is the at_seq)", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "keyframe_id", "in": "path", "required": true, "schema": { "type": "integer", "minimum": 0 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedCaldyrreplayAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptSealedRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-replay", "x-caldyr-source": "scripts/lib/replay/routes-replay-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/keyframes/{keyframe_id}/verify": { "get": { "operationId": "get_fleet_sessions_session_id_keyframes_keyframe_id_verify", "tags": [ "replay/routes-replay-proxy" ], "summary": "Verify the keyframe at a sequence number", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "keyframe_id", "in": "path", "required": true, "schema": { "type": "integer", "minimum": 0 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedCaldyrreplayAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptSealedRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-replay", "x-caldyr-source": "scripts/lib/replay/routes-replay-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/kill": { "post": { "operationId": "post_fleet_sessions_session_id_kill", "tags": [ "fleet/sessions" ], "summary": "Kill a session (signal, default SIGTERM)", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostFleetSessionsSessionIdKillRequest" } } } }, "responses": { "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostFleetSessionsSessionIdKillResponse202" } } } }, "204": { "description": "No Content" }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/fleet/sessions.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/meta": { "get": { "operationId": "get_fleet_sessions_session_id_meta", "tags": [ "fleet/sessions" ], "summary": "The sealed label and notes of a session", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetSessionMeta" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/sessions.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/replay-timeline": { "get": { "operationId": "get_fleet_sessions_session_id_replay_timeline", "tags": [ "replay/routes-replay-proxy" ], "summary": "Replay timeline of a session", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrreplayAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-replay", "x-caldyr-source": "scripts/lib/replay/routes-replay-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/search": { "get": { "operationId": "get_fleet_sessions_session_id_search", "tags": [ "fleet/transcripts" ], "summary": "Search the plaintext transcript of a session", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "q", "in": "query", "required": true, "schema": { "type": "string", "minLength": 2, "maxLength": 256 } }, { "name": "max", "in": "query", "required": false, "description": "capped at the server limit", "schema": { "type": "integer", "minimum": 1 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptSearch" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "SessionForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "forbidden" }, "detail": { "const": "not your session" } }, "additionalProperties": false } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptSealedRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/fleet/transcripts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/security-events": { "get": { "operationId": "get_fleet_sessions_session_id_security_events", "tags": [ "fleet/spawn-memory-security-events" ], "summary": "Memory security events recorded for a session (newest first, at most 200)", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionSecurityEvents" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/spawn-memory-security-events.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/timeline": { "get": { "operationId": "get_fleet_sessions_session_id_timeline", "tags": [ "cost/routes-cost-proxy" ], "summary": "Cost timeline of one session", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedcaldyrcostAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-cost", "x-caldyr-source": "scripts/lib/cost/routes-cost-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/transcript.bin": { "get": { "operationId": "get_fleet_sessions_session_id_transcript_bin", "tags": [ "fleet/transcripts" ], "summary": "Raw terminal output of a session; x-truncated: 1 and x-transcript-next-seq are set when the 10 MiB download cap cut the transcript", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/octet-stream": { "schema": { "$ref": "#/components/schemas/TranscriptBin" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "SessionForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "forbidden" }, "detail": { "const": "not your session" } }, "additionalProperties": false } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptSealedRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/fleet/transcripts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/transcript.legacy": { "get": { "operationId": "get_fleet_sessions_session_id_transcript_legacy", "tags": [ "fleet/transcripts" ], "summary": "Legacy (team key) frames of a session, paged; every read is audited", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "from_seq", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0 } }, { "name": "to_seq", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0 } }, { "name": "max_bytes", "in": "query", "required": false, "description": "default 8 MiB, capped at 32 MiB; maxBytes is read as an alias", "schema": { "type": "integer", "minimum": 0 } }, { "name": "kinds", "in": "query", "required": false, "description": "comma-separated subset of pty_out,agent_event,pty_in", "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptLegacy" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "SessionForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "forbidden" }, "detail": { "const": "not your session" } }, "additionalProperties": false } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptRangeRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/transcripts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/transcript.sealed": { "get": { "operationId": "get_fleet_sessions_session_id_transcript_sealed", "tags": [ "fleet/transcripts" ], "summary": "Sealed (end-to-end) frames of a session, paged by sequence number", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "from_seq", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0 } }, { "name": "to_seq", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0 } }, { "name": "max_bytes", "in": "query", "required": false, "description": "default 8 MiB, capped at 32 MiB; maxBytes is read as an alias", "schema": { "type": "integer", "minimum": 0 } }, { "name": "kinds", "in": "query", "required": false, "description": "comma-separated subset of pty_out,agent_event", "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptSealed" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "SessionForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "forbidden" }, "detail": { "const": "not your session" } }, "additionalProperties": false } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptRangeRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/transcripts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/transcript.txt": { "get": { "operationId": "get_fleet_sessions_session_id_transcript_txt", "tags": [ "fleet/transcripts" ], "summary": "Plaintext transcript (ANSI stripped); x-truncated: 1 and x-transcript-next-seq are set when the 10 MiB download cap cut the transcript", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "text/plain": { "schema": { "$ref": "#/components/schemas/TranscriptText" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "SessionForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "forbidden" }, "detail": { "const": "not your session" } }, "additionalProperties": false } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptSealedRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TranscriptUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/fleet/transcripts.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/sessions/{session_id}/transcript/range": { "get": { "operationId": "get_fleet_sessions_session_id_transcript_range", "tags": [ "replay/routes-replay-proxy" ], "summary": "A byte range of the transcript (the operate rule of transcript.txt applies first)", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/octet-stream": { "schema": { "$ref": "#/components/schemas/TranscriptRangeBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-replay", "x-caldyr-source": "scripts/lib/replay/routes-replay-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/signup": { "get": { "operationId": "get_fleet_signup", "tags": [ "fleet-routes" ], "summary": "Signup request page", "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/stack-status": { "get": { "operationId": "get_fleet_stack_status", "tags": [ "fleet-routes" ], "summary": "Docker stack health written by the host timer", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FleetStackStatus" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/fleet/static/{rest}": { "get": { "operationId": "get_fleet_static_rest", "tags": [ "fleet-routes" ], "summary": "Static asset of the console (the media type follows the file extension)", "parameters": [ { "name": "rest", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "application/octet-stream": { "schema": { "$ref": "#/components/schemas/FleetStaticAsset" } } } }, "304": { "description": "Not Modified" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static", "x-caldyr-prefix-match": true } }, "/fleet/team/{team_id}": { "get": { "operationId": "get_fleet_team_team_id", "tags": [ "fleet-routes" ], "summary": "Team page", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/team/{team_id}/claude-md": { "get": { "operationId": "get_fleet_team_team_id_claude_md", "tags": [ "fleet-routes" ], "summary": "Team CLAUDE.md page", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/team/{team_id}/skills": { "get": { "operationId": "get_fleet_team_team_id_skills", "tags": [ "fleet-routes" ], "summary": "Team skills page", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/upgrades": { "get": { "operationId": "get_fleet_upgrades", "tags": [ "fleet/agent-upgrade" ], "summary": "Upgrade rows of one host or one run (exactly one of host_id, run_id)", "parameters": [ { "name": "host_id", "in": "query", "required": false, "description": "the upgrades of this host", "schema": { "type": "string", "format": "uuid" } }, { "name": "run_id", "in": "query", "required": false, "description": "the rows of this group run", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentUpgradeList" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/agent-upgrade.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/upgrades/runs/{run_id}": { "delete": { "operationId": "delete_fleet_upgrades_runs_run_id", "tags": [ "fleet/agent-upgrade" ], "summary": "Cancel the rows of a group run that have not started", "parameters": [ { "name": "run_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentUpgradeRunCancelled" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/agent-upgrade.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/user": { "get": { "operationId": "get_fleet_user", "tags": [ "fleet-routes" ], "summary": "Account page", "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/user/{rest}": { "get": { "operationId": "get_fleet_user_rest", "tags": [ "fleet-routes" ], "summary": "Account page sub-route (client-side routing)", "parameters": [ { "name": "rest", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static", "x-caldyr-prefix-match": true } }, "/fleet/verify-signup": { "get": { "operationId": "get_fleet_verify_signup", "tags": [ "fleet-routes" ], "summary": "Signup e-mail verification page", "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/FleetSpaShell" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/fleet/webhooks": { "get": { "operationId": "get_fleet_webhooks", "tags": [ "fleet/routes-webhooks-proxy" ], "summary": "List webhook subscriptions (secrets redacted)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "webhooks", "x-caldyr-source": "scripts/lib/fleet/routes-webhooks-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_fleet_webhooks", "tags": [ "fleet/routes-webhooks-proxy" ], "summary": "Create a webhook subscription; the answer is the service's, not redacted", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedwebhooksBody" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedwebhooksAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "webhooks", "x-caldyr-source": "scripts/lib/fleet/routes-webhooks-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/webhooks/{webhook_id}": { "get": { "operationId": "get_fleet_webhooks_webhook_id", "tags": [ "fleet/routes-webhooks-proxy" ], "summary": "GET /fleet/webhooks/{webhook_id}", "parameters": [ { "name": "webhook_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookRow" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "webhooks", "x-caldyr-source": "scripts/lib/fleet/routes-webhooks-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_fleet_webhooks_webhook_id", "tags": [ "fleet/routes-webhooks-proxy" ], "summary": "DELETE /fleet/webhooks/{webhook_id}", "parameters": [ { "name": "webhook_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedwebhooksAnswer" } } } }, "204": { "description": "No Content" }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "webhooks", "x-caldyr-source": "scripts/lib/fleet/routes-webhooks-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_fleet_webhooks_webhook_id", "tags": [ "fleet/routes-webhooks-proxy" ], "summary": "PATCH /fleet/webhooks/{webhook_id}", "parameters": [ { "name": "webhook_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedwebhooksBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookRow" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "webhooks", "x-caldyr-source": "scripts/lib/fleet/routes-webhooks-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/webhooks/{webhook_id}/deliveries": { "get": { "operationId": "get_fleet_webhooks_webhook_id_deliveries", "tags": [ "fleet/routes-webhooks-proxy" ], "summary": "Delivery log of a webhook subscription", "parameters": [ { "name": "webhook_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedwebhooksAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "webhooks", "x-caldyr-source": "scripts/lib/fleet/routes-webhooks-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/webhooks/{webhook_id}/rotate-secret": { "post": { "operationId": "post_fleet_webhooks_webhook_id_rotate_secret", "tags": [ "fleet/routes-webhooks-proxy" ], "summary": "Rotate the signing secret: the hub generates it, stores it through the service and shows it once", "parameters": [ { "name": "webhook_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookSecretRotated" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "webhooks", "x-caldyr-source": "scripts/lib/fleet/routes-webhooks-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/webhooks/{webhook_id}/test": { "post": { "operationId": "post_fleet_webhooks_webhook_id_test", "tags": [ "fleet/routes-webhooks-proxy" ], "summary": "Send a test delivery", "parameters": [ { "name": "webhook_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedwebhooksAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "webhooks", "x-caldyr-source": "scripts/lib/fleet/routes-webhooks-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflow-events": { "post": { "operationId": "post_fleet_workflow_events", "tags": [ "fleet/workflows" ], "summary": "Fire a named event: wakes the wait_for_event nodes of the company's runs", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowEventRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowEventFired" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowUnprocessable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflow-pending-approvals": { "get": { "operationId": "get_fleet_workflow_pending_approvals", "tags": [ "fleet/workflows" ], "summary": "Approvals waiting for a decision", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowPendingApprovals" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflow-runs": { "get": { "operationId": "get_fleet_workflow_runs", "tags": [ "fleet/workflows" ], "summary": "List runs (newest first)", "parameters": [ { "name": "workflow_id", "in": "query", "required": false, "schema": { "type": "string", "format": "uuid" } }, { "name": "status", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 100 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowRunList" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflow-runs/{workflow_run_id}": { "get": { "operationId": "get_fleet_workflow_runs_workflow_run_id", "tags": [ "fleet/workflows" ], "summary": "GET /fleet/workflow-runs/{workflow_run_id}", "parameters": [ { "name": "workflow_run_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowRunDetail" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflow-runs/{workflow_run_id}/approvals/{approval_id}": { "post": { "operationId": "post_fleet_workflow_runs_workflow_run_id_approvals_approval_id", "tags": [ "fleet/workflows" ], "summary": "Decide a pending approval node of a run", "parameters": [ { "name": "workflow_run_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "approval_id", "in": "path", "required": true, "schema": { "type": "string", "pattern": "^[\\w.-]+$" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowApprovalRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostFleetWorkflowRunsWorkflowRunIdApprovalsApprovalIdResponse200" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowConflict" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowUnprocessable" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflow-runs/{workflow_run_id}/cancel": { "post": { "operationId": "post_fleet_workflow_runs_workflow_run_id_cancel", "tags": [ "fleet/workflows" ], "summary": "POST /fleet/workflow-runs/{workflow_run_id}/cancel", "parameters": [ { "name": "workflow_run_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowRunCancelled" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflows": { "get": { "operationId": "get_fleet_workflows", "tags": [ "fleet/workflows" ], "summary": "List the company's workflows with the state of the latest run", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowList" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_fleet_workflows", "tags": [ "fleet/workflows" ], "summary": "Create a workflow", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostFleetWorkflowsRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Workflow" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflows/reseal-aad-v2": { "get": { "operationId": "get_fleet_workflows_reseal_aad_v2", "tags": [ "fleet/workflow-reseal" ], "summary": "Sealed workflow definitions still on AAD v1 (company owner or admin)", "parameters": [ { "name": "after_id", "in": "query", "required": false, "schema": { "type": "string", "format": "uuid" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowResealList" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflow-reseal.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflows/reseal-aad-v2/complete": { "post": { "operationId": "post_fleet_workflows_reseal_aad_v2_complete", "tags": [ "fleet/workflow-reseal" ], "summary": "Close AAD v1 for the company once nothing is pending", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowResealCompleteRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowResealClosed" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowResealPending" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/workflow-reseal.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflows/{workflow_id}": { "get": { "operationId": "get_fleet_workflows_workflow_id", "tags": [ "fleet/workflows" ], "summary": "GET /fleet/workflows/{workflow_id}", "parameters": [ { "name": "workflow_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Workflow" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_fleet_workflows_workflow_id", "tags": [ "fleet/workflows" ], "summary": "Move a workflow to the trash", "parameters": [ { "name": "workflow_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "204": { "description": "No Content" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowConflict" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_fleet_workflows_workflow_id", "tags": [ "fleet/workflows" ], "summary": "Change a workflow (optimistic concurrency with expected_version)", "parameters": [ { "name": "workflow_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchFleetWorkflowsWorkflowIdRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Workflow" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflows/{workflow_id}/reseal-aad-v2": { "post": { "operationId": "post_fleet_workflows_workflow_id_reseal_aad_v2", "tags": [ "fleet/workflow-reseal" ], "summary": "Replace a workflow definition with its AAD v2 re-seal", "parameters": [ { "name": "workflow_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowResealRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowResealed" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/workflow-reseal.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflows/{workflow_id}/restore": { "post": { "operationId": "post_fleet_workflows_workflow_id_restore", "tags": [ "fleet/recycle" ], "summary": "Restore a workflow from the trash", "parameters": [ { "name": "workflow_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Workflow" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/recycle.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflows/{workflow_id}/run": { "post": { "operationId": "post_fleet_workflows_workflow_id_run", "tags": [ "fleet/workflows" ], "summary": "Start a run of a workflow", "parameters": [ { "name": "workflow_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostFleetWorkflowsWorkflowIdRunRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostFleetWorkflowsWorkflowIdRunResponse201" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/fleet/workflows/{workflow_id}/trigger": { "put": { "operationId": "put_fleet_workflows_workflow_id_trigger", "tags": [ "fleet/workflows" ], "summary": "Set or clear the schedule trigger of a workflow (an empty body clears it)", "parameters": [ { "name": "workflow_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowTriggerRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowTriggerSet" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/workflows.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/healthz": { "get": { "operationId": "get_healthz", "tags": [ "rag-api" ], "summary": "Liveness probe (open)", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Healthz" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:probe" }, "head": { "operationId": "head_healthz", "tags": [ "rag-api" ], "summary": "Liveness probe, headers only (open)", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HealthzHead" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:probe" } }, "/healthz/detail": { "get": { "operationId": "get_healthz_detail", "tags": [ "rag-api" ], "summary": "Per-subsystem health (shared operator bearer, fleet admin bearer, or a platform admin session)", "security": [ { "apiToken": [] }, { "adminToken": [] }, { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HealthzDetail" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HealthzDetailUnauthorized" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:operator-or-session", "x-caldyr-prefix-match": true } }, "/hosts/client-cert": { "post": { "operationId": "post_hosts_client_cert", "tags": [ "rag-api" ], "summary": "A daemon exchanges a CSR for an mTLS client leaf certificate (host bearer)", "security": [ { "hostToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientCertRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientCertIssued" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientCertUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:host" } }, "/hosts/enrol": { "post": { "operationId": "post_hosts_enrol", "tags": [ "rag-api" ], "summary": "Enrol a daemon with a one-time code or a reusable team token (public, per-IP limited)", "description": "Public, rate limited per IP. A team enrol token that auto-approves answers status active with host_token and wrapped_team_dek; every other success is a pending host with pending_token.", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostHostsEnrolRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostEnrolled" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrolTokenInvalid" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrolLimitRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/hosts/enrol-codes": { "post": { "operationId": "post_hosts_enrol_codes", "tags": [ "rag-api" ], "summary": "Issue a one-time host enrolment code for a team (team admin)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostHostsEnrolCodesRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostEnrolCode" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/hosts/me": { "get": { "operationId": "get_hosts_me", "tags": [ "rag-api" ], "summary": "A daemon polls its enrolment status and receives its one-time host token (host or pending bearer)", "security": [ { "hostToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostMe" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:host" } }, "/hosts/me/agent-upgrade": { "get": { "operationId": "get_hosts_me_agent_upgrade", "tags": [ "rag-api" ], "summary": "Ask the hub whether a newer agent version is published for this host (host token)", "security": [ { "hostToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostAgentUpgradeCheck" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostAgentUpgradeUnauthorized" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostAgentUpgradeNoBundle" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:host" } }, "/hosts/me/audit-events": { "post": { "operationId": "post_hosts_me_audit_events", "tags": [ "rag-api" ], "summary": "Record an audit event a host reports about itself (host bearer); e2e.pin_cleared only", "description": "The host bearer is resolved before the body is checked. The request schema is declared and run by host-audit-events.js; its refusal is the 400 BodyRefusal (unknown_event for a missing or other event, invalid_body otherwise, also for an `at` that matches the pattern and is no real time). A body that is not JSON is 400 { error: \"invalid_body\" } from rag-api.js before the handler. Cache-Control no-store.", "security": [ { "hostToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostHostsMeAuditEventsRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostAuditEventRecorded" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostAuditEventUnauthorized" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostAuditEventTooLarge" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostAuditEventUnavailable" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:host" } }, "/hosts/me/cli-launches/{cli_launche_id}": { "get": { "operationId": "get_hosts_me_cli_launches_cli_launche_id", "tags": [ "rag-api" ], "summary": "Whether a CLI launch on this host gets the local KB and secret tools (host bearer plus the launch spawn token)", "parameters": [ { "name": "cli_launche_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "purpose", "in": "query", "required": false, "description": "the only value; any other query is 400 invalid_value", "schema": { "enum": [ "e2e_config" ] } } ], "security": [ { "hostToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostCliLaunch" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:host" } }, "/hosts/me/sandbox-policy": { "get": { "operationId": "get_hosts_me_sandbox_policy", "tags": [ "rag-api" ], "summary": "The team-key-sealed sandbox floor of the host's team (host bearer, not cached)", "security": [ { "hostToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostSandboxPolicy" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:host" } }, "/hosts/me/secrets/fetch": { "post": { "operationId": "post_hosts_me_secrets_fetch", "tags": [ "rag-api" ], "summary": "A host daemon fetches the sealed secrets of its team and company scopes (host bearer)", "security": [ { "hostToken": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostSecretsFetchRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostSecretsFetchResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:host" } }, "/hosts/me/secrets/reveal": { "post": { "operationId": "post_hosts_me_secrets_reveal", "tags": [ "rag-api" ], "summary": "A host daemon records the intent of a local secret reveal for the person of a session", "security": [ { "hostToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostSecretsRevealRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostSecretsRevealResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:host" } }, "/hosts/{host_id}/approve": { "post": { "operationId": "post_hosts_host_id_approve", "tags": [ "rag-api" ], "summary": "Approve a pending host (platform admin or team admin of its team)", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostHostsHostIdApproveRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostApproved" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SeatsExhausted" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/internal/entitlements/{entitlement_id}": { "get": { "operationId": "get_internal_entitlements_entitlement_id", "tags": [ "license/routes-internal-entitlements" ], "summary": "Effective entitlements of a company (the path id is the company id), for the identity service", "parameters": [ { "name": "entitlement_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "internalToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EntitlementsDocument" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalGateRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EntitlementsCompanyNotFound" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EntitlementsUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/license/routes-internal-entitlements.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "rule:internal" } }, "/internal/licence/inbox": { "post": { "operationId": "post_internal_licence_inbox", "tags": [ "license/routes-internal-licence-inbox" ], "summary": "Store and apply one event of the licence service, once per event_id (a repeat of a processed event answers duplicate)", "security": [ { "internalToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenceInboxEvent" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenceInboxReceipt" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenceInboxBadBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "oneOf": [ { "title": "InternalGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "internal auth required (401, a sentence), internal_token_required, internal_token_invalid, internal_caller_required, internal_caller_forbidden, internal_caller_subject_mismatch" } } }, { "title": "InternalAuthRequired", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "internal_auth_required" } } } ] } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalGateRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenceInboxEventConflict" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenceInboxTooLarge" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenceInboxInvalidEvent" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenceInboxUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/license/routes-internal-licence-inbox.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "rule:internal" } }, "/internal/totp/verify": { "post": { "operationId": "post_internal_totp_verify", "tags": [ "auth/routes-internal-totp" ], "summary": "Verify a TOTP or recovery code for a user, for the identity service; always 200 { ok } for a well-formed request, held to a minimum duration", "security": [ { "internalToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalTotpVerifyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalTotpVerifyResult" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalTotpBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalGateRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalTotpRateLimited" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/auth/routes-internal-totp.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "rule:internal" } }, "/internal/users/{user_id}/signing-chain": { "post": { "operationId": "post_internal_users_user_id_signing_chain", "tags": [ "auth/routes-internal-signing-chain" ], "summary": "Mint the signing key chain of a user at invite acceptance, for the identity service", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "internalToken": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalSigningChainRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalSigningChainExists" } } } }, "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalSigningChainMinted" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalSigningChainBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "InternalGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "internal auth required (401, a sentence), internal_token_required, internal_token_invalid, internal_caller_required, internal_caller_forbidden, internal_caller_subject_mismatch" } } }, { "title": "InternalCompanyScope", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "company_scope_required" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalUserNotFound" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalSigningChainUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/auth/routes-internal-signing-chain.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "rule:internal" } }, "/internal/workflow-spawn": { "post": { "operationId": "post_internal_workflow_spawn", "tags": [ "fleet/routes-internal-workflow-spawn" ], "summary": "Spawn an agent for a workflow node, or start or cancel a host-run, for the workflow worker; a bounded outcome rides the status field", "security": [ { "internalToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalWorkflowSpawnRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalWorkflowSpawnResult" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalSpawnGateRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalSpawnGateRefusal" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalSpawnGateRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalSpawnGateRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalWorkflowHostRunRefused" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalWorkflowSpawnFailed" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InternalSpawnGateRefusal" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/routes-internal-workflow-spawn.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "rule:internal" } }, "/invite/{invite_id}": { "get": { "operationId": "get_invite_invite_id", "tags": [ "fleet-routes" ], "summary": "The invite acceptance page (public); the SPA reads the token from the path", "parameters": [ { "name": "invite_id", "in": "path", "required": true, "schema": { "type": "string", "pattern": "^[0-9a-f]{64}$" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/InvitePage" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:static" } }, "/invites": { "get": { "operationId": "get_invites", "tags": [ "identity-proxy" ], "summary": "Invites of the caller's company, newest first, up to 500 (company admin); the token is never returned", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InviteList" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_invites", "tags": [ "identity-proxy" ], "summary": "Invite an e-mail address to a team (company owner or admin); the invite mail carries the link", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostInvitesRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InviteCreated" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/invites/accept": { "post": { "operationId": "post_invites_accept", "tags": [ "identity-proxy" ], "summary": "Accept an invite: create the invited account with its key material and an OPAQUE registration (public)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostInvitesAcceptRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InviteAccepted" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InviteSeatsExhausted" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:public" } }, "/invites/lookup": { "post": { "operationId": "post_invites_lookup", "tags": [ "identity-proxy" ], "summary": "Look up the team, company and inviter of an invite token (public)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostInvitesLookupRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InviteLookup" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:public" } }, "/invites/{invite_id}/revoke": { "post": { "operationId": "post_invites_invite_id_revoke", "tags": [ "identity-proxy" ], "summary": "Revoke an invite that is neither accepted nor revoked (company admin)", "parameters": [ { "name": "invite_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InviteRevoked" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/kb/browser/changes": { "get": { "operationId": "get_kb_browser_changes", "tags": [ "knowledge/routes-kb-browser" ], "summary": "Change feed of the sealed notes a person's teams and the company hold (end-to-end companies, person session)", "parameters": [ { "name": "cursor", "in": "query", "required": false, "description": "opaque cursor from the previous page", "schema": { "type": "string", "maxLength": 512 } }, { "name": "limit", "in": "query", "required": false, "description": "capped by the route", "schema": { "type": "integer", "minimum": 1 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbBrowserChanges" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbBrowserBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbBrowserForbidden" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbBrowserModeOff" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbBrowserInvalid" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbBrowserUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/knowledge/routes-kb-browser.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/kb/browser/notes/{note_id}": { "put": { "operationId": "put_kb_browser_notes_note_id", "tags": [ "knowledge/routes-kb-browser" ], "summary": "PUT /kb/browser/notes/{note_id}", "parameters": [ { "name": "note_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbBrowserNotePut" } } } }, "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbBrowserNotePut" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbNoteVersionConflict" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/knowledge/routes-kb-browser.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/kb/e2e/changes": { "get": { "operationId": "get_kb_e2e_changes", "tags": [ "kb-e2e" ], "summary": "Change feed of the sealed notes of the host's team and the company scope (host token)", "parameters": [ { "name": "cursor", "in": "query", "required": false, "description": "opaque base64url cursor from the previous page", "schema": { "type": "string", "maxLength": 512, "pattern": "^[A-Za-z0-9_-]*$" } }, { "name": "limit", "in": "query", "required": false, "description": "capped by the route", "schema": { "type": "integer", "minimum": 1 } }, { "name": "session_id", "in": "query", "required": false, "description": "recorded in the audit row of the read", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "hostToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eChanges" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "405": { "description": "Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:host" } }, "/kb/e2e/legacy": { "get": { "operationId": "get_kb_e2e_legacy", "tags": [ "kb-e2e" ], "summary": "Plaintext team notes still to be sealed by the host (host token)", "parameters": [ { "name": "cursor", "in": "query", "required": false, "description": "opaque base64url cursor from the previous page", "schema": { "type": "string", "maxLength": 512, "pattern": "^[A-Za-z0-9_-]*$" } }, { "name": "limit", "in": "query", "required": false, "description": "capped by the route", "schema": { "type": "integer", "minimum": 1 } }, { "name": "session_id", "in": "query", "required": false, "description": "recorded in the audit row of the read", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "hostToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eLegacy" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "405": { "description": "Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:host" } }, "/kb/e2e/notes/{note_id}": { "get": { "operationId": "get_kb_e2e_notes_note_id", "tags": [ "kb-e2e" ], "summary": "One sealed note (host token)", "parameters": [ { "name": "note_id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "session_id", "in": "query", "required": false, "description": "recorded in the audit row of the read", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "hostToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eNote" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "405": { "description": "Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:host" }, "put": { "operationId": "put_kb_e2e_notes_note_id", "tags": [ "kb-e2e" ], "summary": "Write a sealed team note (host token)", "parameters": [ { "name": "note_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "hostToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutKbE2eNotesNoteIdRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2ePutAnswer" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eWriteForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "405": { "description": "Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eWriteConflict" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eWriteInvalid" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eUnavailable" } } } } }, "x-caldyr-relayed": "knowledge-service", "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:host" } }, "/kb/e2e/notes/{note_id}/chunks": { "put": { "operationId": "put_kb_e2e_notes_note_id_chunks", "tags": [ "kb-e2e" ], "summary": "Write the sealed chunks of a note version (host token)", "parameters": [ { "name": "note_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "hostToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutKbE2eNotesNoteIdChunksRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eChunksAnswer" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eWriteForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "405": { "description": "Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eWriteConflict" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eWriteInvalid" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eUnavailable" } } } } }, "x-caldyr-relayed": "knowledge-service", "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:host" } }, "/kb/e2e/notes/{note_id}/delete": { "post": { "operationId": "post_kb_e2e_notes_note_id_delete", "tags": [ "kb-e2e" ], "summary": "Delete a team note (host token)", "parameters": [ { "name": "note_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "hostToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostKbE2eNotesNoteIdDeleteRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eDeleteAnswer" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eWriteForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "405": { "description": "Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eWriteConflict" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eWriteInvalid" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KbE2eUnavailable" } } } } }, "x-caldyr-relayed": "knowledge-service", "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:host" } }, "/legal/consent": { "get": { "operationId": "get_legal_consent", "tags": [ "auth" ], "summary": "The legal documents state for the banner: current and accepted versions (person session only)", "parameters": [ { "name": "locale", "in": "query", "required": false, "description": "a supported locale tag", "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "sessionBearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalConsentState" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalForbidden" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalFailed" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:legal-person" }, "post": { "operationId": "post_legal_consent", "tags": [ "auth" ], "summary": "Accept the current legal documents for the company or the Solo account (person session only)", "security": [ { "session": [] }, { "sessionBearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalConsentRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalConsentAccepted" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalForbidden" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalVersionNotCurrent" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalFailed" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalTermsUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:legal-person" } }, "/legal/consents": { "get": { "operationId": "get_legal_consents", "tags": [ "auth" ], "summary": "The acceptance history, newest first (company Owner or Solo account holder; person session only)", "security": [ { "session": [] }, { "sessionBearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalConsentHistory" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalForbidden" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LegalFailed" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:legal-person" } }, "/license": { "get": { "operationId": "get_license", "tags": [ "rag-api" ], "summary": "Install license status, shaped by who asks (unauthenticated, authenticated, admin)", "description": "Three tiers (public-view.js licenseView): everyone gets configured and status; an authenticated caller also the coarse health fields; a platform admin or the operator bearer the install-wide detail.", "security": [ { "apiToken": [] }, { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenseView" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:legacy-shared-token" } }, "/mcp": { "get": { "operationId": "get_mcp", "tags": [ "rag-api" ], "summary": "Withdrawn: the MCP endpoint takes POST only; any other method gets 405 before authentication", "description": "Answers 405 { error: \"method_not_allowed\" } with Allow: POST, whatever the credentials.", "security": [], "responses": { "405": { "description": "Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/McpMethodNotAllowed" } } } } }, "x-caldyr-withdrawn": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:hub-mcp" }, "post": { "operationId": "post_mcp", "tags": [ "rag-api" ], "summary": "The hub MCP endpoint (JSON-RPC 2.0 over HTTP): tools for memory, tasks and secrets, as a person, a spawned agent or an OAuth client", "description": "The answer is one JSON-RPC response (200), or an event stream carrying it when the client asks for one; a notification gets 202 with no body. A JSON-RPC failure is a body with an error member, usually with status 200. A modern-protocol request for an unknown method answers 404 with the error body. Refusals before the call: 401 with WWW-Authenticate (auth required, oauth_error), 403 insufficient_scope or origin not allowed, 503 auth_unavailable (Retry-After 30).", "security": [ { "session": [] }, { "bearer": [] }, { "spawnToken": [] }, { "oauthAccessToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/JsonRpcRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/JsonRpcResponse" } } } }, "202": { "description": "Accepted" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/JsonRpcParseError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/McpAuthRequired" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "McpInsufficientScope", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "insufficient_scope, csrf_token mismatch, or the spawn-token allowlist refusal" } } }, { "title": "McpOriginRefused", "type": "object", "required": [ "jsonrpc", "error" ], "properties": { "jsonrpc": { "const": "2.0" }, "error": { "type": "object" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/JsonRpcMethodNotFound" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/McpAuthUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:hub-mcp" }, "delete": { "operationId": "delete_mcp", "tags": [ "rag-api" ], "summary": "Withdrawn: the MCP endpoint takes POST only; any other method gets 405 before authentication", "description": "Answers 405 { error: \"method_not_allowed\" } with Allow: POST, whatever the credentials.", "security": [], "responses": { "405": { "description": "Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/McpMethodNotAllowed" } } } } }, "x-caldyr-withdrawn": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:hub-mcp" } }, "/memory/notes": { "get": { "operationId": "get_memory_notes", "tags": [ "blob" ], "summary": "The caller's own memory notes, newest first (at most 500)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MemoryNoteList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/blob.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/memory/notes/{note_id}/restore": { "post": { "operationId": "post_memory_notes_note_id_restore", "tags": [ "blob" ], "summary": "Restore an older version of a memory note as its new head", "parameters": [ { "name": "note_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MemoryNoteRestoreRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MemoryNoteRestored" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/blob.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/memory/notes/{note_id}/versions": { "get": { "operationId": "get_memory_notes_note_id_versions", "tags": [ "blob" ], "summary": "Versions of one memory note (note_id is the URL-encoded note path), head first", "parameters": [ { "name": "note_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MemoryNoteVersions" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/blob.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/metrics": { "get": { "operationId": "get_metrics", "tags": [ "rag-api" ], "summary": "Prometheus exposition: with CALDYR_METRICS_TOKEN set the bearer must match, otherwise only loopback callers are served", "security": [ { "metricsToken": [] } ], "responses": { "200": { "description": "OK", "content": { "text/plain": { "schema": { "$ref": "#/components/schemas/MetricsExposition" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MetricsForbidden" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:metrics" } }, "/notes": { "get": { "operationId": "get_notes", "tags": [ "auth/routes-notes" ], "summary": "List the team notes the caller can see (metadata)", "parameters": [ { "name": "team_id", "in": "query", "required": false, "description": "one visible team; a team the caller cannot see answers an empty list", "schema": { "type": "string", "format": "uuid" } }, { "name": "tag", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 100 } }, { "name": "offset", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamNoteList" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-notes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_notes", "tags": [ "auth/routes-notes" ], "summary": "Create a note in a team the caller can write (plaintext knowledge base)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostNotesRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamNoteCreated" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eSealedRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-notes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/notes/diff": { "get": { "operationId": "get_notes_diff", "tags": [ "rag-api" ], "summary": "Diff of one vault file, for one commit or between two refs (platform admin)", "parameters": [ { "name": "path", "in": "query", "required": true, "description": "note path in the vault, relative, no .. segment", "schema": { "type": "string" } }, { "name": "sha", "in": "query", "required": false, "description": "one commit; or give from and to", "schema": { "type": "string" } }, { "name": "from", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "to", "in": "query", "required": false, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "adminToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultDiff" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-vault", "x-caldyr-prefix-match": true } }, "/notes/graph": { "get": { "operationId": "get_notes_graph", "tags": [ "rag-api" ], "summary": "Link graph of the platform vault (platform admin)", "parameters": [ { "name": "path", "in": "query", "required": false, "description": "root note; absent = the whole graph", "schema": { "type": "string" } }, { "name": "depth", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 5, "default": 2 } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "maximum": 2000, "default": 500 } } ], "security": [ { "session": [] }, { "adminToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultGraph" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-vault", "x-caldyr-prefix-match": true } }, "/notes/history": { "get": { "operationId": "get_notes_history", "tags": [ "rag-api" ], "summary": "Git history of one vault file (platform admin)", "parameters": [ { "name": "path", "in": "query", "required": true, "description": "note path in the vault, relative, no .. segment", "schema": { "type": "string" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 50 } } ], "security": [ { "session": [] }, { "adminToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultHistory" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-vault", "x-caldyr-prefix-match": true } }, "/notes/index": { "get": { "operationId": "get_notes_index", "tags": [ "rag-api" ], "summary": "Index of every markdown file of the platform vault (platform admin)", "security": [ { "session": [] }, { "adminToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultIndex" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-vault", "x-caldyr-prefix-match": true } }, "/notes/list": { "get": { "operationId": "get_notes_list", "tags": [ "rag-api" ], "summary": "List markdown files of the platform vault (platform admin)", "parameters": [ { "name": "prefix", "in": "query", "required": false, "description": "directory below the vault root; .. is 422", "schema": { "type": "string" } }, { "name": "depth", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "maximum": 5, "default": 2 } } ], "security": [ { "session": [] }, { "adminToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-vault", "x-caldyr-prefix-match": true } }, "/notes/search": { "post": { "operationId": "post_notes_search", "tags": [ "knowledge/routes-knowledge" ], "summary": "Search the notes the caller can see (relayed to the knowledge service)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotesSearchRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotesSearchResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotesSearchBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eSealedRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/knowledge/routes-knowledge.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/notes/show": { "get": { "operationId": "get_notes_show", "tags": [ "rag-api" ], "summary": "A vault file as of a commit (platform admin)", "parameters": [ { "name": "path", "in": "query", "required": true, "description": "note path in the vault, relative, no .. segment", "schema": { "type": "string" } }, { "name": "sha", "in": "query", "required": true, "schema": { "type": "string", "pattern": "^[0-9a-fA-F]{4,64}$" } } ], "security": [ { "session": [] }, { "adminToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultShow" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-vault", "x-caldyr-prefix-match": true } }, "/notes/{note_id}": { "get": { "operationId": "get_notes_note_id", "tags": [ "auth/routes-notes" ], "summary": "GET /notes/{note_id}", "parameters": [ { "name": "note_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamNote" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-notes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_notes_note_id", "tags": [ "auth/routes-notes" ], "summary": "Delete a team note and its search copy", "parameters": [ { "name": "note_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "204": { "description": "No Content" }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-notes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_notes_note_id", "tags": [ "auth/routes-notes" ], "summary": "Update the title, tags or body of a note", "parameters": [ { "name": "note_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchNotesNoteIdRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamNoteUpdated" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/E2eSealedRefusal" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-notes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/notification-preferences": { "get": { "operationId": "get_notification_preferences", "tags": [ "notifications/routes" ], "summary": "The caller's notification preferences (company members)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotificationPreferences" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/notifications/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "put": { "operationId": "put_notification_preferences", "tags": [ "notifications/routes" ], "summary": "Replace the caller's notification preferences (critical severity cannot be switched off)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutNotificationPreferencesRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotificationPreferencesSaved" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/notifications/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/notification-preferences/push-subscribe": { "post": { "operationId": "post_notification_preferences_push_subscribe", "tags": [ "notifications/routes" ], "summary": "Not implemented: browser push subscription is deferred to a later version", "description": "Always answers 501 { error: \"not_implemented\", detail: \"browser push deferred to v2\" } to a signed-in caller.", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "501": { "description": "Not Implemented", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PushNotImplemented" } } } } }, "x-caldyr-withdrawn": true, "x-caldyr-source": "scripts/lib/notifications/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/notifications": { "get": { "operationId": "get_notifications", "tags": [ "notifications/routes" ], "summary": "The caller's notifications, newest first (up to 50)", "parameters": [ { "name": "unread", "in": "query", "required": false, "description": "1 lists unread, undismissed notifications only", "schema": { "type": "string", "enum": [ "1" ] } }, { "name": "since", "in": "query", "required": false, "description": "ISO 8601 timestamp: only rows created strictly later; the boundary row may repeat", "schema": { "type": "string", "maxLength": 40 } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 50, "default": 50 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotificationList" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvalidCursor" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/notifications/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/notifications/count": { "get": { "operationId": "get_notifications_count", "tags": [ "notifications/routes" ], "summary": "Number of unread, undismissed notifications", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotificationCount" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/notifications/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/notifications/{notification_id}/dismiss": { "post": { "operationId": "post_notifications_notification_id_dismiss", "tags": [ "notifications/routes" ], "summary": "Dismiss a notification; dismissing a critical one writes an audit row", "parameters": [ { "name": "notification_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotificationDismissed" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/notifications/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/notifications/{notification_id}/read": { "post": { "operationId": "post_notifications_notification_id_read", "tags": [ "notifications/routes" ], "summary": "Mark an unread notification read (404 when it is not the caller's or already read)", "parameters": [ { "name": "notification_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotificationRead" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/notifications/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/notifications/{notification_id}/snooze": { "post": { "operationId": "post_notifications_notification_id_snooze", "tags": [ "notifications/routes" ], "summary": "Snooze a notification until a time", "parameters": [ { "name": "notification_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotificationSnoozeRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NotificationSnoozed" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/notifications/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/oauth/authorize": { "get": { "operationId": "get_oauth_authorize", "tags": [ "oauth/routes-oauth" ], "summary": "Authorization request: answers a redirect to the client or to the consent page, or a plain HTML page for a request that must not redirect", "description": "The caller is charged per IP (429 with Retry-After). 404 while the OAuth server is off. A request that cannot be trusted (unknown client, bad redirect URI) gets a small HTML page and 400; a failure on our side gets 500 (503 when the limiter is unavailable).", "parameters": [ { "name": "response_type", "in": "query", "required": false, "schema": { "const": "code" } }, { "name": "client_id", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "redirect_uri", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "scope", "in": "query", "required": false, "description": "space-separated scopes within mcp:read mcp:write mcp:secrets mcp:secrets.reveal", "schema": { "type": "string" } }, { "name": "state", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "code_challenge", "in": "query", "required": false, "description": "PKCE, S256 only", "schema": { "type": "string" } }, { "name": "code_challenge_method", "in": "query", "required": false, "schema": { "const": "S256" } }, { "name": "resource", "in": "query", "required": false, "description": "must equal the hub MCP URI", "schema": { "type": "string" } } ], "security": [], "responses": { "302": { "description": "Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthAuthorizeRedirect" } } } }, "400": { "description": "Bad Request", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/OauthAuthorizePage400" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthAuthorizeOff" } } } }, "429": { "description": "Too Many Requests", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/OauthAuthorizePage429" } } } }, "500": { "description": "Internal Server Error", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/OauthAuthorizePage500" } } } }, "503": { "description": "Service Unavailable", "content": { "text/html": { "schema": { "$ref": "#/components/schemas/OauthAuthorizePage503" } } } } }, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/oauth/company/grants": { "get": { "operationId": "get_oauth_company_grants", "tags": [ "oauth/routes-oauth" ], "summary": "Every grant of the company (company owner or admin; at most 500)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthCompanyGrantList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/oauth/company/grants/{grant_id}": { "delete": { "operationId": "delete_oauth_company_grants_grant_id", "tags": [ "oauth/routes-oauth" ], "summary": "Revoke any grant of the company (company owner or admin)", "parameters": [ { "name": "grant_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthGrantRevoked" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/oauth/company/settings": { "get": { "operationId": "get_oauth_company_settings", "tags": [ "oauth/routes-oauth" ], "summary": "The company's switch and allowlist for third-party MCP clients", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthCompanySettings" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "put": { "operationId": "put_oauth_company_settings", "tags": [ "oauth/routes-oauth" ], "summary": "Change the switch and allowlist; grants they no longer admit are revoked", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthCompanySettingsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthCompanySettingsSaved" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/oauth/consent/{consent_id}": { "get": { "operationId": "get_oauth_consent_consent_id", "tags": [ "oauth/routes-oauth" ], "summary": "What the signed-in person is asked to approve (no-store)", "parameters": [ { "name": "consent_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthConsentView" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_oauth_consent_consent_id", "tags": [ "oauth/routes-oauth" ], "summary": "Approve or deny; an approval may need a reauth token (purpose oauth_authorize)", "parameters": [ { "name": "consent_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthConsentDecision" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthConsentDecided" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthConsentRefused" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/oauth/grants": { "get": { "operationId": "get_oauth_grants", "tags": [ "oauth/routes-oauth" ], "summary": "The signed-in person's own grants", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthGrantList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/oauth/grants/{grant_id}": { "delete": { "operationId": "delete_oauth_grants_grant_id", "tags": [ "oauth/routes-oauth" ], "summary": "Revoke one of the person's own grants", "parameters": [ { "name": "grant_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthGrantRevoked" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/oauth/jwks": { "get": { "operationId": "get_oauth_jwks", "tags": [ "oauth/routes-oauth" ], "summary": "Public signing keys (RFC 7517)", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthJwks" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/oauth/register": { "post": { "operationId": "post_oauth_register", "tags": [ "oauth/routes-oauth" ], "summary": "RFC 7591 dynamic client registration (public, limited per client IP)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthRegisterRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthClientRegistered" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthRegisterError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/oauth/revoke": { "post": { "operationId": "post_oauth_revoke", "tags": [ "oauth/routes-oauth" ], "summary": "RFC 7009 revocation of a refresh or access token (the whole grant ends); unknown tokens also answer 200", "security": [], "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/OauthRevokeRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthRevokeResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthNotFound" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthPayloadTooLarge" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenError" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenError" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/oauth/token": { "post": { "operationId": "post_oauth_token", "tags": [ "oauth/routes-oauth" ], "summary": "Exchange an authorization code or rotate a refresh token (public client, PKCE; no-store)", "security": [], "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/OauthTokenRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenError" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthNotFound" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthPayloadTooLarge" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenError" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenError" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/oauth/routes-oauth.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/openapi.json": { "get": { "operationId": "get_openapi_json", "tags": [ "rag-api" ], "summary": "The OpenAPI 3.1 document of this API (public)", "description": "Public, like the in-app documentation: the document lists routes and declared schemas and carries no tenant data.", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenApiDocument" } } } }, "304": { "description": "Not Modified" }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenApiUnavailable" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:openapi-document" }, "head": { "operationId": "head_openapi_json", "tags": [ "rag-api" ], "summary": "The headers of the OpenAPI document (public): ETag, Content-Length, X-Caldyr-Openapi-Sha256", "description": "Public, like the in-app documentation: the document lists routes and declared schemas and carries no tenant data.", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenApiDocumentHead" } } } }, "304": { "description": "Not Modified" }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenApiUnavailable" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:openapi-document" } }, "/plan": { "get": { "operationId": "get_plan", "tags": [ "rag-api" ], "summary": "Plan and usage of the caller's own tenant (company admin, or a Solo user)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanDocument" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanAuthRequired" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/plan/state": { "get": { "operationId": "get_plan_state", "tags": [ "rag-api" ], "summary": "Licence state and suspension of the caller's own tenant, for every member", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TenantState" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/platform-admin/articles": { "get": { "operationId": "get_platform_admin_articles", "tags": [ "fleet-routes" ], "summary": "Global knowledge-base articles", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformArticleList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" }, "post": { "operationId": "post_platform_admin_articles", "tags": [ "fleet-routes" ], "summary": "Create a global article (answers 200 when it already exists)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformArticleRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostPlatformAdminArticlesResponse200" } } } }, "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostPlatformAdminArticlesResponse201" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/articles/{article_id}": { "get": { "operationId": "get_platform_admin_articles_article_id", "tags": [ "fleet-routes" ], "summary": "GET /platform-admin/articles/{article_id}", "parameters": [ { "name": "article_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetPlatformAdminArticlesArticleIdResponse200" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" }, "delete": { "operationId": "delete_platform_admin_articles_article_id", "tags": [ "fleet-routes" ], "summary": "DELETE /platform-admin/articles/{article_id}", "parameters": [ { "name": "article_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformArticleDeleted" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" }, "patch": { "operationId": "patch_platform_admin_articles_article_id", "tags": [ "fleet-routes" ], "summary": "PATCH /platform-admin/articles/{article_id}", "parameters": [ { "name": "article_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformArticlePatch" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchPlatformAdminArticlesArticleIdResponse200" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/companies": { "get": { "operationId": "get_platform_admin_companies", "tags": [ "fleet-routes" ], "summary": "All real companies (synthetic ones are left out), oldest first", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformCompanies" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" }, "post": { "operationId": "post_platform_admin_companies", "tags": [ "fleet-routes" ], "summary": "Withdrawn: a platform admin can no longer create a company; companies come from the sign-up flow", "description": "After the platform-admin gate (401, 403) the route answers 410 { error: \"retired\", message }; it creates nothing.", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformCompanyCreateRetired" } } } } }, "x-caldyr-withdrawn": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/companies/{company_id}": { "delete": { "operationId": "delete_platform_admin_companies_company_id", "tags": [ "fleet-routes" ], "summary": "Delete a company and purge its keys and service data (step-up B; not the bootstrap company)", "parameters": [ { "name": "company_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformCompanyDeleted" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/companies/{company_id}/activation": { "post": { "operationId": "post_platform_admin_companies_company_id_activation", "tags": [ "fleet-routes" ], "summary": "Issue (activate) or revoke (deactivate) a tenant licence (step-up B)", "parameters": [ { "name": "company_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformActivationRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformActivated" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSigningKeyUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/companies/{company_id}/plan": { "get": { "operationId": "get_platform_admin_companies_company_id_plan", "tags": [ "fleet-routes" ], "summary": "GET /platform-admin/companies/{company_id}/plan", "parameters": [ { "name": "company_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanDocument" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/companies/{company_id}/plan-limits": { "get": { "operationId": "get_platform_admin_companies_company_id_plan_limits", "tags": [ "fleet-routes" ], "summary": "GET /platform-admin/companies/{company_id}/plan-limits", "parameters": [ { "name": "company_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanLimitsView" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" }, "post": { "operationId": "post_platform_admin_companies_company_id_plan_limits", "tags": [ "fleet-routes" ], "summary": "Set cap overrides of a company (sudo A); an absent key is unchanged, null clears it", "parameters": [ { "name": "company_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformPlanLimitsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanLimitsSet" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/companies/{company_id}/suspend": { "post": { "operationId": "post_platform_admin_companies_company_id_suspend", "tags": [ "fleet-routes" ], "summary": "Suspend a company and stop its sessions (sudo A; not the bootstrap company)", "parameters": [ { "name": "company_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformCompanyStatus" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/companies/{company_id}/teams": { "get": { "operationId": "get_platform_admin_companies_company_id_teams", "tags": [ "fleet-routes" ], "summary": "GET /platform-admin/companies/{company_id}/teams", "parameters": [ { "name": "company_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformCompanyTeams" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/companies/{company_id}/tier": { "post": { "operationId": "post_platform_admin_companies_company_id_tier", "tags": [ "fleet-routes" ], "summary": "Set the tier of a company (sudo A; not the bootstrap company)", "parameters": [ { "name": "company_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSetTierRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformTierSet" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/companies/{company_id}/unsuspend": { "post": { "operationId": "post_platform_admin_companies_company_id_unsuspend", "tags": [ "fleet-routes" ], "summary": "Lift the suspension of a company (sudo A)", "parameters": [ { "name": "company_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformCompanyStatus" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/demo-tenants": { "post": { "operationId": "post_platform_admin_demo_tenants", "tags": [ "fleet-routes" ], "summary": "Provision or reset the demo tenants (step-up B)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformDemoTenantsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformDemoTenantsReport" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformDemoLicenceRefused" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/health": { "get": { "operationId": "get_platform_admin_health", "tags": [ "rag-api" ], "summary": "Capability and component health of the platform (platform admin session; any other credential is refused with 403)", "parameters": [ { "name": "component", "in": "query", "required": false, "description": "comma-separated component ids from the registry; repeated keys are joined; at most the route's bound", "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformHealthEnvelope" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformHealthBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformHealthUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformHealthForbidden" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformHealthRateLimited" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "oneOf": [ { "title": "PlatformHealthEnvelope", "type": "object", "required": [ "registry_schema_version", "api_contract_version", "generated_at", "cache", "overall", "capabilities", "components" ], "properties": { "registry_schema_version": { "type": [ "integer", "string" ] }, "api_contract_version": { "type": [ "integer", "string" ] }, "generated_at": { "type": "string", "format": "date-time" }, "cache": { "type": "object", "required": [ "hit", "age_ms" ], "properties": { "hit": { "type": "boolean" }, "age_ms": { "type": "integer" } } }, "overall": { "type": "object", "required": [ "mode", "attention_count" ], "properties": { "mode": { "const": "NO_SINGLE" }, "attention_count": { "type": "integer" } } }, "capabilities": { "type": "array", "items": { "type": "object" } }, "components": { "type": "array", "items": { "type": "object" } } }, "description": "always 200 for an authorized request whose collection ran; a degraded subsystem is a status in the body. Cache-Control no-store." }, { "title": "PlatformHealthUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unavailable" }, "detail": { "type": "string" } } } ] } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/licences/expiring": { "get": { "operationId": "get_platform_admin_licences_expiring", "tags": [ "fleet-routes" ], "summary": "GET /platform-admin/licences/expiring", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformExpiringLicences" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/metrics": { "get": { "operationId": "get_platform_admin_metrics", "tags": [ "fleet-routes" ], "summary": "Prometheus exposition of this instance", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "text/plain": { "schema": { "$ref": "#/components/schemas/PlatformMetricsText" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/secrets/commands/{command_id}": { "get": { "operationId": "get_platform_admin_secrets_commands_command_id", "tags": [ "fleet-routes" ], "summary": "GET /platform-admin/secrets/commands/{command_id}", "parameters": [ { "name": "command_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecretCommandStatus" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/secrets/delete": { "post": { "operationId": "post_platform_admin_secrets_delete", "tags": [ "fleet-routes" ], "summary": "Delete a team secret through the durable command service (sudo A)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecretDeleteRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecretCommand" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecretCommandConflict" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/secrets/rotate": { "post": { "operationId": "post_platform_admin_secrets_rotate", "tags": [ "fleet-routes" ], "summary": "Rotate a team secret through the durable command service (sudo A)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecretWriteRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecretCommand" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecretCommandConflict" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/secrets/set": { "post": { "operationId": "post_platform_admin_secrets_set", "tags": [ "fleet-routes" ], "summary": "Set a team secret through the durable command service (sudo A)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecretWriteRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecretCommand" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecretCommandConflict" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/security-flag": { "post": { "operationId": "post_platform_admin_security_flag", "tags": [ "fleet-routes" ], "summary": "Turn a platform security flag on or off (sudo A)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecurityFlagRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSecurityFlagSet" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/settings/qa-totp-allowlist": { "get": { "operationId": "get_platform_admin_settings_qa_totp_allowlist", "tags": [ "fleet-routes" ], "summary": "GET /platform-admin/settings/qa-totp-allowlist", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformQaTotpAllowlist" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" }, "put": { "operationId": "put_platform_admin_settings_qa_totp_allowlist", "tags": [ "fleet-routes" ], "summary": "Replace the QA TOTP allowlist (sudo A); at most 50 e-mails, trimmed, lower-cased, de-duplicated", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformQaTotpAllowlistRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformQaTotpAllowlistSet" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/settings/session-lifetimes": { "get": { "operationId": "get_platform_admin_settings_session_lifetimes", "tags": [ "fleet-routes" ], "summary": "GET /platform-admin/settings/session-lifetimes", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSessionLifetimes" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" }, "put": { "operationId": "put_platform_admin_settings_session_lifetimes", "tags": [ "fleet-routes" ], "summary": "Set session lifetimes (sudo A); absent fields keep their value", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSessionLifetimesRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSessionLifetimesSet" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/signup-requests": { "get": { "operationId": "get_platform_admin_signup_requests", "tags": [ "fleet-routes" ], "summary": "GET /platform-admin/signup-requests", "parameters": [ { "name": "status", "in": "query", "required": false, "schema": { "type": "string", "default": "pending" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSignupRequests" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/signup-requests/invite": { "post": { "operationId": "post_platform_admin_signup_requests_invite", "tags": [ "fleet-routes" ], "summary": "Invite a company owner (sudo A); nothing but these three fields is accepted", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformInviteOwnerRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformOwnerInvited" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformInviteRefused" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformInviteConflict" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/signup-requests/{signup_request_id}": { "get": { "operationId": "get_platform_admin_signup_requests_signup_request_id", "tags": [ "fleet-routes" ], "summary": "GET /platform-admin/signup-requests/{signup_request_id}", "parameters": [ { "name": "signup_request_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSignupRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/signup-requests/{signup_request_id}/approve": { "post": { "operationId": "post_platform_admin_signup_requests_signup_request_id_approve", "tags": [ "fleet-routes" ], "summary": "POST /platform-admin/signup-requests/{signup_request_id}/approve", "parameters": [ { "name": "signup_request_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSignupApproveRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSignupDecision" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSignupDecision" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/signup-requests/{signup_request_id}/reject": { "post": { "operationId": "post_platform_admin_signup_requests_signup_request_id_reject", "tags": [ "fleet-routes" ], "summary": "POST /platform-admin/signup-requests/{signup_request_id}/reject", "parameters": [ { "name": "signup_request_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSignupRejectRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSignupDecision" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSignupBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformSignupDecision" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/sudo": { "post": { "operationId": "post_platform_admin_sudo", "tags": [ "auth/routes-platform-admin-sudo" ], "summary": "Enter a platform-admin sudo window with a fresh TOTP code", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostPlatformAdminSudoRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostPlatformAdminSudoResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-platform-admin-sudo.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/platform-admin/tenants": { "get": { "operationId": "get_platform_admin_tenants", "tags": [ "fleet-routes" ], "summary": "Companies and Solo accounts with their licence state", "parameters": [ { "name": "kind", "in": "query", "required": false, "schema": { "enum": [ "company", "solo" ] } }, { "name": "q", "in": "query", "required": false, "description": "matches company name, owner e-mail and Solo e-mail", "schema": { "type": "string", "maxLength": 200 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformTenants" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/platform-admin/users/{user_id}": { "delete": { "operationId": "delete_platform_admin_users_user_id", "tags": [ "fleet-routes" ], "summary": "Erase a Solo account (step-up B); anything but a Solo account is 404", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformUserDeleted" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlatformUserDeleteRetry" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet-routes.js#dispatchHttp", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:platform-admin" } }, "/plugin/{rest}": { "get": { "operationId": "get_plugin_rest", "tags": [ "auth" ], "summary": "A file of the Obsidian plugin release (self-update and first install); a device session or the shared operator bearer", "parameters": [ { "name": "rest", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "deviceSession": [] }, { "apiToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/octet-stream": { "schema": { "$ref": "#/components/schemas/PluginFile" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PluginFileNotFound" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:plugin-file", "x-caldyr-prefix-match": true } }, "/qa/totp-code": { "post": { "operationId": "post_qa_totp_code", "tags": [ "auth/routes-qa-totp" ], "summary": "Current TOTP code of an allowlisted QA account, for testers (open; the QA password gates it; 404 unless enabled)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QaTotpCodeRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QaTotpCode" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QaTotpBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QaTotpPassword" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QaTotpOff" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QaTotpTooLarge" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QaTotpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QaTotpLimiter" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/auth/routes-qa-totp.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:public" } }, "/quotas": { "get": { "operationId": "get_quotas", "tags": [ "quotas/routes" ], "summary": "Cost quotas of the caller's company, oldest first", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CostQuotaList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QuotaUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/quotas/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_quotas", "tags": [ "quotas/routes" ], "summary": "Create a cost quota, or re-enable the disabled one for the same scope, scope_ref and period (company owner or admin)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostQuotasRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CostQuota" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenceFeatureRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QuotaUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/quotas/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session", "x-caldyr-feature": "budgets" } }, "/quotas/{quota_id}": { "delete": { "operationId": "delete_quotas_quota_id", "tags": [ "quotas/routes" ], "summary": "Disable a cost quota (company owner or admin); the row is kept", "parameters": [ { "name": "quota_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CostQuotaDisabled" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/quotas/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_quotas_quota_id", "tags": [ "quotas/routes" ], "summary": "Update the cap, warn threshold, enabled flag, override role or cap mode of a cost quota (company owner or admin)", "parameters": [ { "name": "quota_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchQuotasQuotaIdRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CostQuota" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenceFeatureRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QuotaUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/quotas/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session", "x-caldyr-feature": "budgets" } }, "/quotas/{quota_id}/override": { "post": { "operationId": "post_quotas_quota_id_override", "tags": [ "quotas/routes" ], "summary": "Grant a temporary cap increase (the role the quota names as override_role: owner, or owner or admin)", "parameters": [ { "name": "quota_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CostQuotaOverrideRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CostQuotaOverride" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LicenceFeatureRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OverrideRoleRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OverrideRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/QuotaUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/quotas/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session", "x-caldyr-feature": "budgets" } }, "/quotas/{quota_id}/override/{override_id}/revoke": { "post": { "operationId": "post_quotas_quota_id_override_override_id_revoke", "tags": [ "quotas/routes" ], "summary": "Revoke a cap increase (owner only)", "parameters": [ { "name": "quota_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "override_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CostQuotaOverrideRevoked" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OwnerRequired" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/quotas/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/quotas/{quota_id}/usage": { "get": { "operationId": "get_quotas_quota_id_usage", "tags": [ "quotas/routes" ], "summary": "Spend of a quota in its current period, with the overrides in force", "parameters": [ { "name": "quota_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CostQuotaUsage" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/quotas/routes.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/readyz": { "get": { "operationId": "get_readyz", "tags": [ "rag-api" ], "summary": "Readiness probe: database, signing verifier and role (open); 503 while a check fails", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Readyz" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReadyzNotReady" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:probe" } }, "/register-company": { "post": { "operationId": "post_register_company", "tags": [ "auth" ], "summary": "Create a company, its owner and first team from an approved sign-up (public; the completion token proves the approval)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegisterCompanyRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompanyRegistered" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupBadRequest" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupRefused" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupEmailExists" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupFailed" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/register-solo": { "post": { "operationId": "post_register_solo", "tags": [ "auth" ], "summary": "Create a Solo account from an approved sign-up (public; the completion token proves the approval)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegisterSoloRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SoloRegistered" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupBadRequest" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupRefused" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupEmailExists" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupFailed" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/scim/v2/Groups": { "get": { "operationId": "get_scim_v2_Groups", "tags": [ "scim" ], "summary": "List groups (teams) of the token's company", "parameters": [ { "name": "filter", "in": "query", "required": false, "description": "SCIM filter; an unsupported one is 400 invalidFilter", "schema": { "type": "string" } }, { "name": "startIndex", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "default": 1 } }, { "name": "count", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "maximum": 200, "default": 100 } } ], "security": [ { "scimToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimGroupList" } } } }, "400": { "description": "Bad Request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "405": { "description": "Response", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" }, "post": { "operationId": "post_scim_v2_Groups", "tags": [ "scim" ], "summary": "Create a group", "security": [ { "scimToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimGroupRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimGroup" } } } }, "400": { "description": "Bad Request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "402": { "description": "Payment Required", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "403": { "description": "Forbidden", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "409": { "description": "Conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "429": { "description": "Too Many Requests", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "503": { "description": "Service Unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "x-caldyr-request-unchecked": true, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" } }, "/scim/v2/Groups/{group_id}": { "get": { "operationId": "get_scim_v2_Groups_group_id", "tags": [ "scim" ], "summary": "GET /scim/v2/Groups/{group_id}", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "scimToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimGroup" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" }, "put": { "operationId": "put_scim_v2_Groups_group_id", "tags": [ "scim" ], "summary": "Replace a group", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "scimToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimGroupRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimGroup" } } } }, "400": { "description": "Bad Request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "402": { "description": "Payment Required", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "403": { "description": "Forbidden", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "409": { "description": "Conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "429": { "description": "Too Many Requests", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "503": { "description": "Service Unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "x-caldyr-request-unchecked": true, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" }, "delete": { "operationId": "delete_scim_v2_Groups_group_id", "tags": [ "scim" ], "summary": "Delete a group", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "scimToken": [] } ], "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad Request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "402": { "description": "Payment Required", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "403": { "description": "Forbidden", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "409": { "description": "Conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "429": { "description": "Too Many Requests", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "503": { "description": "Service Unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" }, "patch": { "operationId": "patch_scim_v2_Groups_group_id", "tags": [ "scim" ], "summary": "Patch a group (RFC 7644 PatchOp)", "parameters": [ { "name": "group_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "scimToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimGroupPatchRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimGroup" } } } }, "400": { "description": "Bad Request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "402": { "description": "Payment Required", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "403": { "description": "Forbidden", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "409": { "description": "Conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "429": { "description": "Too Many Requests", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "503": { "description": "Service Unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "x-caldyr-request-unchecked": true, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" } }, "/scim/v2/ResourceTypes": { "get": { "operationId": "get_scim_v2_ResourceTypes", "tags": [ "scim" ], "summary": "GET /scim/v2/ResourceTypes", "security": [], "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimResourceTypes" } } } }, "405": { "description": "Response", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim-meta" } }, "/scim/v2/ResourceTypes/{resource_type_id}": { "get": { "operationId": "get_scim_v2_ResourceTypes_resource_type_id", "tags": [ "scim" ], "summary": "GET /scim/v2/ResourceTypes/{resource_type_id}", "parameters": [ { "name": "resource_type_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimResourceType" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "405": { "description": "Response", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim-meta" } }, "/scim/v2/Schemas": { "get": { "operationId": "get_scim_v2_Schemas", "tags": [ "scim" ], "summary": "GET /scim/v2/Schemas", "security": [], "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimSchemas" } } } }, "405": { "description": "Response", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim-meta" } }, "/scim/v2/Schemas/{schema_id}": { "get": { "operationId": "get_scim_v2_Schemas_schema_id", "tags": [ "scim" ], "summary": "GET /scim/v2/Schemas/{schema_id}", "parameters": [ { "name": "schema_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimSchema" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "405": { "description": "Response", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim-meta" } }, "/scim/v2/ServiceProviderConfig": { "get": { "operationId": "get_scim_v2_ServiceProviderConfig", "tags": [ "scim" ], "summary": "GET /scim/v2/ServiceProviderConfig", "security": [], "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimServiceProviderConfig" } } } }, "405": { "description": "Response", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim-meta" } }, "/scim/v2/Users": { "get": { "operationId": "get_scim_v2_Users", "tags": [ "scim" ], "summary": "List users of the token's company", "parameters": [ { "name": "filter", "in": "query", "required": false, "description": "SCIM filter; an unsupported one is 400 invalidFilter", "schema": { "type": "string" } }, { "name": "startIndex", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "default": 1 } }, { "name": "count", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "maximum": 200, "default": 100 } } ], "security": [ { "scimToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimUserList" } } } }, "400": { "description": "Bad Request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "405": { "description": "Response", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" }, "post": { "operationId": "post_scim_v2_Users", "tags": [ "scim" ], "summary": "Provision a user", "security": [ { "scimToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimUserRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimUser" } } } }, "400": { "description": "Bad Request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "402": { "description": "Payment Required", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "403": { "description": "Forbidden", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "409": { "description": "Conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "429": { "description": "Too Many Requests", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "503": { "description": "Service Unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "x-caldyr-request-unchecked": true, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" } }, "/scim/v2/Users/{user_id}": { "get": { "operationId": "get_scim_v2_Users_user_id", "tags": [ "scim" ], "summary": "GET /scim/v2/Users/{user_id}", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "scimToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimUser" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" }, "put": { "operationId": "put_scim_v2_Users_user_id", "tags": [ "scim" ], "summary": "Replace a user (active=false deactivates)", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "scimToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimUserRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimUser" } } } }, "400": { "description": "Bad Request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "402": { "description": "Payment Required", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "403": { "description": "Forbidden", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "409": { "description": "Conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "429": { "description": "Too Many Requests", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "503": { "description": "Service Unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "x-caldyr-request-unchecked": true, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" }, "delete": { "operationId": "delete_scim_v2_Users_user_id", "tags": [ "scim" ], "summary": "Deactivate a user", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "scimToken": [] } ], "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad Request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "402": { "description": "Payment Required", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "403": { "description": "Forbidden", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "409": { "description": "Conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "429": { "description": "Too Many Requests", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "503": { "description": "Service Unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" }, "patch": { "operationId": "patch_scim_v2_Users_user_id", "tags": [ "scim" ], "summary": "Patch a user (RFC 7644 PatchOp)", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "scimToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScimUserPatchRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimUser" } } } }, "400": { "description": "Bad Request", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "401": { "description": "Unauthorized", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "402": { "description": "Payment Required", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "403": { "description": "Forbidden", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "404": { "description": "Not Found", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "409": { "description": "Conflict", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "429": { "description": "Too Many Requests", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } }, "503": { "description": "Service Unavailable", "content": { "application/scim+json": { "schema": { "$ref": "#/components/schemas/ScimError" } } } } }, "x-caldyr-request-unchecked": true, "servers": [ { "url": "/" } ], "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:scim" } }, "/secrets/delete": { "post": { "operationId": "post_secrets_delete", "tags": [ "rag-api" ], "summary": "Delete a team secret by name", "description": "Served for a session caller by routes/blob.js (secrets-blob-adapter.js); a platform admin is refused with 410 legacy_secret_mutation_retired. A bearer that is not a session reaches the svc-secrets relay of routes-secrets-proxy.js instead, whose answers come from the secrets service.", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretDeleteRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretDeleteResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-also-matched-in": [ "scripts/lib/secrets/routes-secrets-proxy.js" ], "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default", "x-caldyr-any-method": true } }, "/secrets/get": { "post": { "operationId": "post_secrets_get", "tags": [ "rag-api" ], "summary": "Look up a team secret by the blind index of its name", "description": "Served for a session caller by routes/blob.js (secrets-blob-adapter.js); a platform admin is refused with 410 legacy_secret_mutation_retired. A bearer that is not a session reaches the svc-secrets relay of routes-secrets-proxy.js instead, whose answers come from the secrets service.", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretGetRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretGetResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-also-matched-in": [ "scripts/lib/secrets/routes-secrets-proxy.js" ], "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default", "x-caldyr-any-method": true } }, "/secrets/list": { "post": { "operationId": "post_secrets_list", "tags": [ "rag-api" ], "summary": "List the secrets of a team (names and blind-index hints, never values)", "description": "Served for a session caller by routes/blob.js (secrets-blob-adapter.js); a platform admin is refused with 410 legacy_secret_mutation_retired. A bearer that is not a session reaches the svc-secrets relay of routes-secrets-proxy.js instead, whose answers come from the secrets service.", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretListRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretListResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-also-matched-in": [ "scripts/lib/secrets/routes-secrets-proxy.js" ], "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default", "x-caldyr-any-method": true } }, "/secrets/rotate": { "post": { "operationId": "post_secrets_rotate", "tags": [ "rag-api" ], "summary": "Replace the ciphertext of a team secret", "description": "Served for a session caller by routes/blob.js (secrets-blob-adapter.js); a platform admin is refused with 410 legacy_secret_mutation_retired. A bearer that is not a session reaches the svc-secrets relay of routes-secrets-proxy.js instead, whose answers come from the secrets service.", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretRotateRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretRotateResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-also-matched-in": [ "scripts/lib/secrets/routes-secrets-proxy.js" ], "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default", "x-caldyr-any-method": true } }, "/secrets/sealed": { "get": { "operationId": "get_secrets_sealed", "tags": [ "secrets/routes-secrets-proxy" ], "summary": "List the secrets of a team or company scope (metadata only)", "parameters": [ { "name": "scope_kind", "in": "query", "required": true, "schema": { "enum": [ "team", "company" ] } }, { "name": "scope_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SealedSecretList" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/secrets/routes-secrets-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "put": { "operationId": "put_secrets_sealed", "tags": [ "secrets/routes-secrets-proxy" ], "summary": "Store a secret sealed in the browser under the team or company key", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutSecretsSealedRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutSecretsSealedResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/secrets/routes-secrets-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_secrets_sealed", "tags": [ "secrets/routes-secrets-proxy" ], "summary": "Delete a sealed or custody secret by name", "parameters": [ { "name": "scope_kind", "in": "query", "required": true, "schema": { "enum": [ "team", "company" ] } }, { "name": "scope_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "name", "in": "query", "required": true, "schema": { "type": "string", "minLength": 1 } }, { "name": "storage", "in": "query", "required": true, "description": "custody is accepted for a team scope only", "schema": { "enum": [ "sealed", "custody" ] } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SealedSecretDeleted" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/secrets/routes-secrets-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/secrets/sealed/item": { "get": { "operationId": "get_secrets_sealed_item", "tags": [ "secrets/routes-secrets-proxy" ], "summary": "Read one sealed secret (ciphertext; audited, rate limited, needs the reveal permission)", "parameters": [ { "name": "scope_kind", "in": "query", "required": true, "schema": { "enum": [ "team", "company" ] } }, { "name": "scope_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "name", "in": "query", "required": true, "schema": { "type": "string", "minLength": 1 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SealedSecretItem" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/secrets/routes-secrets-proxy.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/secrets/set": { "post": { "operationId": "post_secrets_set", "tags": [ "rag-api" ], "summary": "Store a client-encrypted secret blob under a team (replaces an existing one of the same name)", "description": "Served for a session caller by routes/blob.js (secrets-blob-adapter.js); a platform admin is refused with 410 legacy_secret_mutation_retired. A bearer that is not a session reaches the svc-secrets relay of routes-secrets-proxy.js instead, whose answers come from the secrets service.", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretSetRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretSetResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-also-matched-in": [ "scripts/lib/secrets/routes-secrets-proxy.js" ], "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default", "x-caldyr-any-method": true } }, "/secrets/verify": { "post": { "operationId": "post_secrets_verify", "tags": [ "rag-api" ], "summary": "Check that a team secret exists, by the blind index of its name", "description": "Served for a session caller by routes/blob.js (secrets-blob-adapter.js); a platform admin is refused with 410 legacy_secret_mutation_retired. A bearer that is not a session reaches the svc-secrets relay of routes-secrets-proxy.js instead, whose answers come from the secrets service.", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretVerifyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SecretVerifyResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-also-matched-in": [ "scripts/lib/secrets/routes-secrets-proxy.js" ], "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default", "x-caldyr-any-method": true } }, "/server-escrow/anchor-pubkey": { "get": { "operationId": "get_server_escrow_anchor_pubkey", "tags": [ "auth" ], "summary": "The server anchor public key the browser wraps a team key to when it turns on server escrow (company admin; from custody)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerEscrowAnchorPubkey" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerEscrowAnchorUnavailable" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/server-escrow/requests": { "get": { "operationId": "get_server_escrow_requests", "tags": [ "auth" ], "summary": "Pending server-escrow requests of the company and the teams that have escrow on (company admin)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerEscrowRequests" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/sessions/{session_id}/token": { "delete": { "operationId": "delete_sessions_session_id_token", "tags": [ "rag-api" ], "summary": "A daemon deletes the session tokens it spawned for a session (host bearer)", "parameters": [ { "name": "session_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionTokenDeleted" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HostTokenRequired" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionTokenNone" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/siem/destinations": { "get": { "operationId": "get_siem_destinations", "tags": [ "audit/siem/routes-siem" ], "summary": "SIEM destinations of the caller's company (company admin, enterprise tier; answered by audit-delivery)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_siem_destinations", "tags": [ "audit/siem/routes-siem" ], "summary": "Create a SIEM destination (licence gate on kind and count, then audit-delivery)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryBody" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemLicenceRefusal" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/siem/destinations/{destination_id}": { "get": { "operationId": "get_siem_destinations_destination_id", "tags": [ "audit/siem/routes-siem" ], "summary": "One SIEM destination", "parameters": [ { "name": "destination_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_siem_destinations_destination_id", "tags": [ "audit/siem/routes-siem" ], "summary": "Delete a SIEM destination", "parameters": [ { "name": "destination_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_siem_destinations_destination_id", "tags": [ "audit/siem/routes-siem" ], "summary": "Update a SIEM destination (licence gate on kind, then audit-delivery)", "parameters": [ { "name": "destination_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemLicenceRefusal" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/siem/destinations/{destination_id}/filter-rules": { "get": { "operationId": "get_siem_destinations_destination_id_filter_rules", "tags": [ "audit/siem/routes-siem" ], "summary": "Filter rules of a destination", "parameters": [ { "name": "destination_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_siem_destinations_destination_id_filter_rules", "tags": [ "audit/siem/routes-siem" ], "summary": "Add a filter rule to a destination", "parameters": [ { "name": "destination_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryBody" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/siem/destinations/{destination_id}/filter-rules/{filter_rule_id}": { "delete": { "operationId": "delete_siem_destinations_destination_id_filter_rules_filter_rule_id", "tags": [ "audit/siem/routes-siem" ], "summary": "Delete a filter rule", "parameters": [ { "name": "destination_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "filter_rule_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_siem_destinations_destination_id_filter_rules_filter_rule_id", "tags": [ "audit/siem/routes-siem" ], "summary": "Update a filter rule", "parameters": [ { "name": "destination_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "filter_rule_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/siem/destinations/{destination_id}/test": { "post": { "operationId": "post_siem_destinations_destination_id_test", "tags": [ "audit/siem/routes-siem" ], "summary": "Send a test event to a destination; the body, if any, is forwarded as sent", "parameters": [ { "name": "destination_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/siem/dlq": { "get": { "operationId": "get_siem_dlq", "tags": [ "audit/siem/routes-siem" ], "summary": "Dead-letter queue of undelivered SIEM events", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/siem/dlq/drain": { "post": { "operationId": "post_siem_dlq_drain", "tags": [ "audit/siem/routes-siem" ], "summary": "Drain the dead-letter queue; the body, if any, is forwarded as sent", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/siem/dlq/{dlq_id}/replay": { "post": { "operationId": "post_siem_dlq_dlq_id_replay", "tags": [ "audit/siem/routes-siem" ], "summary": "Replay one dead-letter entry (numeric id); the body, if any, is forwarded as sent", "parameters": [ { "name": "dlq_id", "in": "path", "required": true, "schema": { "type": "integer", "minimum": 0 } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryBody" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/siem/events": { "get": { "operationId": "get_siem_events", "tags": [ "audit/siem/routes-siem" ], "summary": "Browse delivered SIEM events; a caller who is not a platform admin is always scoped to the own company", "parameters": [ { "name": "company_id", "in": "query", "required": false, "description": "honoured for a platform admin only; any other caller gets the session company", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedauditdeliveryAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "audit-delivery", "x-caldyr-source": "scripts/lib/audit/siem/routes-siem.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/siem/secret-bindings": { "post": { "operationId": "post_siem_secret_bindings", "tags": [ "audit/siem/routes-secret-bindings" ], "summary": "Mint an opaque handle for a SIEM credential value; the value is stored in the caller's own team and never returned", "description": "Enterprise tier with the siem feature, company admin and a member of team_id. Errors: 401 auth_required; 400 invalid_body, invalid_value (team_id, field), value_required; 403 company_admin_required, team_membership_required; 402 / 422 from the tier and licence gate; 413 payload_too_large (value over 32 KiB); 500 binding_record_failed; 502 secret_store_failed; 503 db_not_ready, authorization_check_unavailable, membership_check_unavailable.", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemSecretBindingRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemSecretBinding" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "402": { "description": "Payment Required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/audit/siem/routes-secret-bindings.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/signup-requests": { "post": { "operationId": "post_signup_requests", "tags": [ "auth" ], "summary": "Ask for an account (company, solo or join); a verification e-mail follows", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostSignupRequestsRequest" } } } }, "responses": { "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupAccepted" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/signup-requests/completion-info": { "get": { "operationId": "get_signup_requests_completion_info", "tags": [ "auth" ], "summary": "What a verified sign-up still needs, from its completion token (public)", "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string", "pattern": "^[0-9a-f]{64}$" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupCompletionInfo" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupCompletionUnknown" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicRateLimited" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupCompletionUnavailable" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/signup-requests/legal-terms": { "get": { "operationId": "get_signup_requests_legal_terms", "tags": [ "auth" ], "summary": "The current legal documents the sign-up page asks consent to (public)", "parameters": [ { "name": "locale", "in": "query", "required": false, "schema": { "type": "string", "pattern": "^[a-z]{2}$", "default": "en" } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupLegalTerms" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupLegalUnavailable" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/signup-requests/resend": { "post": { "operationId": "post_signup_requests_resend", "tags": [ "auth" ], "summary": "Send the verification e-mail again (the answer is the same whatever the address)", "security": [], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostSignupRequestsResendRequest" } } } }, "responses": { "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SignupAccepted" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/signup-requests/verify": { "post": { "operationId": "post_signup_requests_verify", "tags": [ "auth" ], "summary": "Confirm the e-mail address of a signup request", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostSignupRequestsVerifyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostSignupRequestsVerifyResponse200" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/skill-assignments": { "get": { "operationId": "get_skill_assignments", "tags": [ "skills" ], "summary": "Skill assignments visible to the caller", "parameters": [ { "name": "scope", "in": "query", "required": false, "schema": { "enum": [ "global", "company", "team", "user" ] } }, { "name": "scope_id", "in": "query", "required": false, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillAssignmentList" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "post": { "operationId": "post_skill_assignments", "tags": [ "skills" ], "summary": "Set the default, allow or deny assignment of an approved skill at a scope", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostSkillAssignmentsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillAssignmentSet" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/skills": { "get": { "operationId": "get_skills", "tags": [ "skills" ], "summary": "Skills visible to the caller, newest first; the filters only narrow", "parameters": [ { "name": "scope", "in": "query", "required": false, "schema": { "enum": [ "global", "company", "team" ] } }, { "name": "scope_id", "in": "query", "required": false, "schema": { "type": "string", "format": "uuid" } }, { "name": "status", "in": "query", "required": false, "description": "pending, approved, rejected or archived", "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillList" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "post": { "operationId": "post_skills", "tags": [ "skills" ], "summary": "Upload a skill version for review (signing token; scope admin, platform admin for global)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostSkillsRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillUploaded" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/skills/{skill_id}": { "get": { "operationId": "get_skills_skill_id", "tags": [ "skills" ], "summary": "One visible skill (a skill the caller cannot see answers 404)", "parameters": [ { "name": "skill_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillDetail" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/skills/{skill_id}/approve": { "post": { "operationId": "post_skills_skill_id_approve", "tags": [ "skills" ], "summary": "Approve a pending skill (scope approver, signing token in the body)", "parameters": [ { "name": "skill_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillSigningRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillApproved" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillNotPending" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/skills/{skill_id}/archive": { "post": { "operationId": "post_skills_skill_id_archive", "tags": [ "skills" ], "summary": "Archive an approved skill (scope admin; a viewer is refused)", "parameters": [ { "name": "skill_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillArchived" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillNotApproved" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/skills/{skill_id}/content": { "get": { "operationId": "get_skills_skill_id_content", "tags": [ "skills" ], "summary": "Bundle content: ciphertext for client-side decryption; a team-escrow caller (agent) receives the decrypted tarball", "description": "A global skill, or a company or team skill read by an agent behind server escrow, answers 200 application/octet-stream with the tarball bytes. Every other reader receives the JSON envelope below.", "parameters": [ { "name": "skill_id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "team_id", "in": "query", "required": false, "description": "the team whose key sealed the copy, for a user reading a team-sealed skill", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillContentEnvelope" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "412": { "description": "Precondition Failed", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillContentPrecondition" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default", "x-caldyr-prefix-match": true } }, "/skills/{skill_id}/diff": { "get": { "operationId": "get_skills_skill_id_diff", "tags": [ "skills" ], "summary": "Diff of a skill against another version", "parameters": [ { "name": "skill_id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "against", "in": "query", "required": false, "description": "latest_approved, a skill id, or sha:<64 hex>", "schema": { "type": "string", "default": "latest_approved" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillDiff" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "501": { "description": "Not Implemented", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillDiffUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/skills/{skill_id}/reject": { "post": { "operationId": "post_skills_skill_id_reject", "tags": [ "skills" ], "summary": "Reject a pending skill (scope approver, signing token in the body)", "parameters": [ { "name": "skill_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillRejectRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SkillRejected" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/solo/hosts": { "get": { "operationId": "get_solo_hosts", "tags": [ "auth" ], "summary": "The Solo account's own hosts, newest first", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SoloHostList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SoloUserRequired" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/solo/hosts/enrol-codes": { "post": { "operationId": "post_solo_hosts_enrol_codes", "tags": [ "auth" ], "summary": "Issue a one-time enrol code for the Solo account's own agent (within the plan's agent cap)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SoloEnrolCode" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "SoloUserRequired", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "solo_user_required, or csrf_token mismatch" }, "detail": { "type": "string" } } }, { "title": "SoloAgentCapReached", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "plan_limit (the agent cap), with kind, limit and current" }, "detail": { "type": "string" }, "kind": { "type": "string" }, "limit": { "type": [ "integer", "null" ] }, "current": { "type": "integer" } } } ] } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SoloPlanLookupFailed" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/solo/hosts/{host_id}/link-note-dek": { "post": { "operationId": "post_solo_hosts_host_id_link_note_dek", "tags": [ "auth" ], "summary": "Approve a pending Solo host: store the note key wrapped to its public key and activate it; the secret key is re-wrapped by custody when it can be", "parameters": [ { "name": "host_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SoloLinkNoteDekRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SoloHostLinked" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CsrfRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SoloHostNotFound" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/solo/keys": { "get": { "operationId": "get_solo_keys", "tags": [ "auth" ], "summary": "The Solo account's wrapped data keys, for cross-device unlock", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SoloKeys" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SoloUserRequired" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/spawn-config": { "get": { "operationId": "get_spawn_config", "tags": [ "skills" ], "summary": "What a host needs to launch an agent for a team: hub MCP URL, tier and session cap, the instruction cascade, skills, MCP servers and the agent credential policy", "description": "A per-spawn token reads only the config of its own session's team (403 otherwise); a session user needs standing in the team; a platform admin or an operator bearer is not restricted. A spawn token of a session that cannot be launched is refused 409 session_not_launchable.", "parameters": [ { "name": "team_id", "in": "query", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "session_id", "in": "query", "required": false, "description": "the session being launched; its config hash is stamped", "schema": { "type": "string", "format": "uuid" } }, { "name": "user_id", "in": "query", "required": false, "description": "platform admin or operator bearer only", "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "spawnToken": [] }, { "session": [] }, { "bearer": [] }, { "apiToken": [] }, { "adminToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnConfig" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnConfigBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnConfigForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnConfigNotFound" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnSessionNotLaunchable" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnConfigFailed" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnRefusal" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:spawn-config" } }, "/spawn-config/mcp-auth/{rest}": { "get": { "operationId": "get_spawn_config_mcp_auth_rest", "tags": [ "skills" ], "summary": "The auth header value of an offered or mandatory MCP server, for the daemon of a launched session (per-spawn token only)", "parameters": [ { "name": "rest", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "spawnToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnMcpAuth" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnSecretRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnNotFound" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnSecretRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnSecretRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnSecretRefusal" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:spawn", "x-caldyr-prefix-match": true } }, "/spawn-config/team-key": { "get": { "operationId": "get_spawn_config_team_key", "tags": [ "skills" ], "summary": "The team provider key the session's agent may use, for the daemon of a CLI-launched session (per-spawn token only)", "security": [ { "spawnToken": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnTeamKey" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnSecretRefusal" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnNotFound" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnSecretRefusal" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnSecretRefusal" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnSecretRefusal" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:spawn" } }, "/spawn-memory": { "get": { "operationId": "get_spawn_memory", "tags": [ "fleet/spawn-memory" ], "summary": "Ciphertext of a Solo user's personal notes, for the host daemon at spawn time (at most 200; the host holds the key)", "security": [ { "spawnToken": [] }, { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnMemory" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnMemoryUnavailable" } } } } }, "x-caldyr-source": "scripts/lib/fleet/spawn-memory.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "rule:spawn-memory" } }, "/spawn-memory/security-events": { "post": { "operationId": "post_spawn_memory_security_events", "tags": [ "spawn-memory-security-events" ], "summary": "Report credential screening findings the daemon made on memory it was about to write (per-spawn token; the identity comes from the token)", "security": [ { "spawnToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnMemorySecurityEventsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnMemorySecurityEventsAccepted" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnEventsInvalid" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnEventsUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnEventsUnscoped" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnEventsRateLimited" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/fleet/spawn-memory-security-events.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:spawn" } }, "/spawn-prefs": { "get": { "operationId": "get_spawn_prefs", "tags": [ "skills" ], "summary": "The caller's skill and MCP server picks for new spawns", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnPrefs" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnPrefsUser" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnPrefsFailed" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "put": { "operationId": "put_spawn_prefs", "tags": [ "skills" ], "summary": "Set the caller's skill and MCP server picks for new spawns (a list that is not sent is kept)", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutSpawnPrefsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnPrefsSaved" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnPrefsCsrf" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnPrefsUser2" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpawnPrefsFailed2" } } } } }, "x-caldyr-source": "scripts/lib/skills/routes.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/sso/discover": { "get": { "operationId": "get_sso_discover", "tags": [ "auth" ], "summary": "The sign-in provider for an e-mail domain (public); 404 with an empty object when the domain has none", "parameters": [ { "name": "email", "in": "query", "required": true, "schema": { "type": "string", "maxLength": 254 } } ], "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoDiscovery" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoDiscoveryNone" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoDiscoveryInvalid" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoDiscoveryRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SsoDiscoveryFailed" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public", "x-caldyr-prefix-match": true } }, "/svc-secrets/delete": { "post": { "operationId": "post_svc_secrets_delete", "tags": [ "secrets-proxy" ], "summary": "An automation token deletes a custody secret of its team", "security": [ { "automationToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvcSecretsDeleteRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvcSecretsDeleteResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:automation" } }, "/svc-secrets/get": { "post": { "operationId": "post_svc_secrets_get", "tags": [ "secrets-proxy" ], "summary": "An automation token reads a custody secret of its team (masked unless reveal is true; reveal is audited and rate limited)", "description": "The team comes from the token, never from the body. The 200 body is relayed from the secrets service.", "security": [ { "automationToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvcSecretsGetRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvcSecretsGetResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:automation" } }, "/svc-secrets/list": { "post": { "operationId": "post_svc_secrets_list", "tags": [ "secrets-proxy" ], "summary": "An automation token lists the custody secret names of its team", "security": [ { "automationToken": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvcSecretsListRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvcSecretsListResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:automation" } }, "/svc-secrets/sealed": { "post": { "operationId": "post_svc_secrets_sealed", "tags": [ "secrets-proxy" ], "summary": "An automation token fetches the sealed secrets of its team (works in every e2e mode)", "security": [ { "automationToken": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvcSecretsSealedRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvcSecretsSealedResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:automation" } }, "/svc-secrets/set": { "post": { "operationId": "post_svc_secrets_set", "tags": [ "secrets-proxy" ], "summary": "An automation token stores a custody secret for its team", "security": [ { "automationToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvcSecretsSetRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SvcSecretsSetResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/ops/openapi/sources.js", "x-caldyr-registration": "declared", "x-caldyr-auth-source": "rule:automation" } }, "/svc-secrets/siem-ref/get": { "post": { "operationId": "post_svc_secrets_siem_ref_get", "tags": [ "siem-ref-read" ], "summary": "The credential value behind a SIEM secret handle, for the audit-delivery service account only (automation token); every other caller gets the same refusal", "security": [ { "automationToken": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemRefGetRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemRefValue" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemRefBadRequest" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemRefForbidden" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemRefNotFound" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemRefRateLimited" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemRefSecrets" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemRefUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/lib/audit/siem/routes-siem-ref-read.js#dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:automation" } }, "/team-memberships": { "post": { "operationId": "post_team_memberships", "tags": [ "identity-proxy" ], "summary": "Grant a company user membership of a team (team admin), with the team DEK and the master key wrapped for them", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostTeamMembershipsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityOk" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/team-memberships/rewrap": { "post": { "operationId": "post_team_memberships_rewrap", "tags": [ "identity-proxy" ], "summary": "Replace the caller's own wrapped team DEKs (recovery); a team the caller is not in matches no row", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostTeamMembershipsRewrapRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MembershipsRewrapped" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/team-memberships/{team_membership_id}/{param}": { "delete": { "operationId": "delete_team_memberships_team_membership_id_param", "tags": [ "identity-proxy" ], "summary": "Remove a member from a team (team admin; path is team id then user id); the team key rotation is requested for the scope", "parameters": [ { "name": "team_membership_id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "param", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityOk" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/teams": { "get": { "operationId": "get_teams", "tags": [ "identity-proxy" ], "summary": "Teams of the caller's company (all for an owner or admin, own memberships for a member)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamList" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_teams", "tags": [ "identity-proxy" ], "summary": "Create a team (company owner or admin); the team DEK arrives wrapped for the company master key and for the caller", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostTeamsRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamCreated" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/teams/{team_id}/agent-policy": { "get": { "operationId": "get_teams_team_id_agent_policy", "tags": [ "fleet/cli-launches" ], "summary": "The agent policy of a team (team member)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentPolicy" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/cli-launches.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "put": { "operationId": "put_teams_team_id_agent_policy", "tags": [ "fleet/cli-launches" ], "summary": "Set a team's allowed agents and per-agent credential policy (team admin or company owner/admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PutTeamsTeamIdAgentPolicyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentPolicy" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/fleet/cli-launches.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/teams/{team_id}/automation-tokens": { "get": { "operationId": "get_teams_team_id_automation_tokens", "tags": [ "auth/routes-automation-tokens" ], "summary": "Automation tokens of a team (company owner or admin); hashes and plaintext are never returned", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AutomationTokenList" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-automation-tokens.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "post": { "operationId": "post_teams_team_id_automation_tokens", "tags": [ "auth/routes-automation-tokens" ], "summary": "Mint an automation token pair for a team (company owner or admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostTeamsTeamIdAutomationTokensRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AutomationTokenPair" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "413": { "description": "Payload Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-automation-tokens.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/teams/{team_id}/automation-tokens/{automation_token_id}": { "delete": { "operationId": "delete_teams_team_id_automation_tokens_automation_token_id", "tags": [ "auth/routes-automation-tokens" ], "summary": "Revoke the chain an automation token belongs to (company owner or admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "automation_token_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AutomationChainRevoked" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-automation-tokens.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/teams/{team_id}/enrol-tokens": { "get": { "operationId": "get_teams_team_id_enrol_tokens", "tags": [ "rag-api" ], "summary": "List the reusable enrol tokens of a team (team admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrolTokenList" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "post": { "operationId": "post_teams_team_id_enrol_tokens", "tags": [ "rag-api" ], "summary": "Mint a reusable enrol token for a team (team admin); the token is shown once", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrolTokenMintRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrolTokenMinted" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/teams/{team_id}/enrol-tokens/{enrol_token_id}": { "delete": { "operationId": "delete_teams_team_id_enrol_tokens_enrol_token_id", "tags": [ "rag-api" ], "summary": "Revoke an enrol token (team admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "enrol_token_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrolTokenRevoked" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnrolTokenNotFound" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/teams/{team_id}/master-escrow": { "post": { "operationId": "post_teams_team_id_master_escrow", "tags": [ "rag-api" ], "summary": "Store the team key wrapped for the company master key, once (team admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MasterEscrowRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OkTrue" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthRequiredLegacy" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/teams/{team_id}/mcp-servers": { "get": { "operationId": "get_teams_team_id_mcp_servers", "tags": [ "auth" ], "summary": "MCP servers of a team (company admin, or a member of the team)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamMcpServerList" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "post": { "operationId": "post_teams_team_id_mcp_servers", "tags": [ "auth" ], "summary": "Add an MCP server to a team (company owner or admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostTeamsTeamIdMcpServersRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamMcpServer" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/teams/{team_id}/mcp-servers/{mcp_server_id}": { "delete": { "operationId": "delete_teams_team_id_mcp_servers_mcp_server_id", "tags": [ "auth" ], "summary": "Remove an MCP server from a team (company owner or admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "mcp_server_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OkTrue" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "patch": { "operationId": "patch_teams_team_id_mcp_servers_mcp_server_id", "tags": [ "auth" ], "summary": "Change a team MCP server's transport, endpoint, auth_ref or flags (company owner or admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "mcp_server_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchTeamsTeamIdMcpServersMcpServerIdRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamMcpServer" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/teams/{team_id}/members": { "get": { "operationId": "get_teams_team_id_members", "tags": [ "identity-proxy" ], "summary": "Members of a team (system users excluded)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamMembers" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/teams/{team_id}/membership-self": { "get": { "operationId": "get_teams_team_id_membership_self", "tags": [ "identity-proxy" ], "summary": "The caller's own membership of a team, with the wrapped team key", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamMembershipSelf" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/teams/{team_id}/memberships/finalize": { "post": { "operationId": "post_teams_team_id_memberships_finalize", "tags": [ "identity-proxy" ], "summary": "Turn a pending membership into a team membership with the wrapped team key (team admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FinalizeMembershipRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FinalizeMembershipAnswer" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/teams/{team_id}/memberships/pending": { "get": { "operationId": "get_teams_team_id_memberships_pending", "tags": [ "identity-proxy" ], "summary": "Pending (SCIM or admin sourced) membership requests of a team (team admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamPendingMemberships" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/teams/{team_id}/note-token": { "post": { "operationId": "post_teams_team_id_note_token", "tags": [ "auth/routes-team-note-token" ], "summary": "Deprecated: mint an automation token pair (company owner or admin); use the automation-tokens route", "description": "Answers Deprecation: true and a Link to the successor route.", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NoteTokenPair" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-team-note-token.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/teams/{team_id}/pending-approvals": { "get": { "operationId": "get_teams_team_id_pending_approvals", "tags": [ "identity-proxy" ], "summary": "Invited users who accepted but hold no team key yet (company owner or admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TeamPendingApprovals" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/teams/{team_id}/server-escrow": { "post": { "operationId": "post_teams_team_id_server_escrow", "tags": [ "auth" ], "summary": "Request server-side escrow of a team key (company owner or admin, TOTP step-up); a second admin approves, a single admin waits out a delay", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerEscrowRequest" } } } }, "responses": { "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerEscrowRequested" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "StepUpRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "step_up_required" }, "reason": { "enum": [ "totp_not_enrolled", "too_many_attempts" ], "description": "absent when the code is missing or wrong" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "EscrowRequestPending", "type": "object", "required": [ "error", "request_id" ], "properties": { "error": { "const": "escrow_request_pending" }, "request_id": { "type": "string", "format": "uuid" } } } ] } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" }, "delete": { "operationId": "delete_teams_team_id_server_escrow", "tags": [ "auth" ], "summary": "Turn server-side escrow off for a team and cancel its pending request (company owner or admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OkTrue" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/teams/{team_id}/server-escrow/requests/{request_id}/approve": { "post": { "operationId": "post_teams_team_id_server_escrow_requests_request_id_approve", "tags": [ "auth" ], "summary": "Second admin approves a pending escrow request (TOTP step-up)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "request_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EscrowApproveRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OkTrue" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "StepUpRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "step_up_required" }, "reason": { "enum": [ "totp_not_enrolled", "too_many_attempts" ], "description": "absent when the code is missing or wrong" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EscrowRequestNotPending" } } } }, "410": { "description": "Gone", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IpRateLimited" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/teams/{team_id}/server-escrow/requests/{request_id}/cancel": { "post": { "operationId": "post_teams_team_id_server_escrow_requests_request_id_cancel", "tags": [ "auth" ], "summary": "Cancel a pending escrow request (company owner or admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "request_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OkTrue" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EscrowCancelRefused" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/teams/{team_id}/service-user-dek": { "post": { "operationId": "post_teams_team_id_service_user_dek", "tags": [ "rag-api" ], "summary": "Repair the company service user's wrap of the team DEK (platform admin or team admin)", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostTeamsTeamIdServiceUserDekRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServiceUserDekRepaired" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/teams/{team_id}/service-user-pubkey": { "get": { "operationId": "get_teams_team_id_service_user_pubkey", "tags": [ "rag-api" ], "summary": "Public key of the company service user, for wrapping the team DEK at approval", "parameters": [ { "name": "team_id", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServiceUserPubkey" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "default" } }, "/users": { "get": { "operationId": "get_users", "tags": [ "auth/routes-users" ], "summary": "Users of the caller's company (up to 500; synthetic users excluded)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserList" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-users.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/users/{user_id}": { "get": { "operationId": "get_users_user_id", "tags": [ "auth/routes-users" ], "summary": "One user of the caller's company", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserDetail" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-users.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "delete": { "operationId": "delete_users_user_id", "tags": [ "auth/routes-users" ], "summary": "Erase a member of the company (owner only)", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "204": { "description": "No Content" }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserPurgeBlocked" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-users.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" }, "patch": { "operationId": "patch_users_user_id", "tags": [ "auth/routes-users" ], "summary": "Change a user of the caller's company (display name, status, role)", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchUsersUserIdRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/User" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "enum": [ "last_owner_protected", "owner_requires_local_credential" ] }, "code": { "type": "string" }, "detail": { "type": "string" } } } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-users.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/users/{user_id}/passkeys-reset": { "post": { "operationId": "post_users_user_id_passkeys_reset", "tags": [ "auth/routes-users" ], "summary": "Remove every passkey of a user of the caller's company", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostUsersUserIdPasskeysResetResponse200" } } } }, "403": { "description": "Forbidden" }, "404": { "description": "Not Found" }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OwnerRequiresLocalCredential" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "PasskeysResetIncomplete", "type": "object", "required": [ "error", "revoke_failed" ], "properties": { "error": { "const": "credential_changed_revoke_incomplete" }, "revoke_failed": { "type": "array", "items": { "type": "string" } }, "detail": { "type": "string" }, "passkeys_removed": { "type": "integer" } }, "description": "the credential was cleared but not every session or token could be revoked; repeat the call" } ] } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-users.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/users/{user_id}/pubkey": { "get": { "operationId": "get_users_user_id_pubkey", "tags": [ "identity-proxy" ], "summary": "Public key of a user of the same company", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UserPubkey" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/users/{user_id}/sso/unlink": { "post": { "operationId": "post_users_user_id_sso_unlink", "tags": [ "auth/routes-users" ], "summary": "Remove the SSO identity link of a user of the caller's company (owner or admin)", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/User" } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-users.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/users/{user_id}/totp-reset": { "post": { "operationId": "post_users_user_id_totp_reset", "tags": [ "auth/routes-users" ], "summary": "Clear a user's TOTP and revoke all their sessions and device tokens", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TotpResetResult" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "UserRankRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "enum": [ "forbidden" ] }, "detail": { "type": "string" }, "code": { "const": "target_role_not_lower" } }, "description": "forbidden: the caller's role is not above the target's" } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "TotpResetIncomplete", "type": "object", "required": [ "error", "revoke_failed" ], "properties": { "error": { "const": "credential_changed_revoke_incomplete" }, "revoke_failed": { "type": "array", "items": { "type": "string" } }, "detail": { "type": "string" }, "totp_cleared": { "const": true } }, "description": "the credential was cleared but not every session or token could be revoked; repeat the call" } ] } } } } }, "x-caldyr-source": "scripts/lib/auth/routes-users.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/users/{user_id}/wrapped-master": { "post": { "operationId": "post_users_user_id_wrapped_master", "tags": [ "identity-proxy" ], "summary": "Store the master key wrapped for a company member who has none (company owner or admin)", "parameters": [ { "name": "user_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PostUsersUserIdWrappedMasterRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WrappedMasterSet" } } } }, "400": { "description": "The body does not match the request schema (scripts/lib/request-schema.js)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BodyRefusal" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "oneOf": [ { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } ] } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IdentityError" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } } }, "x-caldyr-relayed": "caldyr-identity", "x-caldyr-source": "scripts/lib/identity/routes-identity-proxy.js#ROUTES", "x-caldyr-registration": "table", "x-caldyr-auth-source": "route:session" } }, "/vault/classify": { "post": { "operationId": "post_vault_classify", "tags": [ "auth/routes-vault" ], "summary": "Move a secret to another namespace (needs vault.classify); the answer is the secrets server's", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultClassifyRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedsecretsserverAnswer" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultForbidden" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultClassifyInvalid" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnavailable" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "secrets-server", "x-caldyr-source": "scripts/lib/auth/routes-vault.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/vault/migrate-dryrun": { "post": { "operationId": "post_vault_migrate_dryrun", "tags": [ "auth/routes-vault" ], "summary": "Dry run of the vault migration (needs vault.migrate); the answer carries key_count (relayed)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultMigrateDryRun" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultForbidden" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnavailable" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnavailable" } } } } }, "x-caldyr-relayed": "secrets-server", "x-caldyr-source": "scripts/lib/auth/routes-vault.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/vault/restore": { "post": { "operationId": "post_vault_restore", "tags": [ "auth/routes-vault" ], "summary": "Restore the vault from a backup file (needs vault.restore); the answer is the secrets server's", "security": [ { "session": [] }, { "bearer": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultRestoreRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedsecretsserverAnswer" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultForbidden" } } } }, "422": { "description": "Unprocessable Entity", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultRestoreInvalid" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnavailable" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnavailable" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-relayed": "secrets-server", "x-caldyr-source": "scripts/lib/auth/routes-vault.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/vault/seeded": { "get": { "operationId": "get_vault_seeded", "tags": [ "auth/routes-vault" ], "summary": "Whether the secrets server has been seeded (relayed)", "security": [ { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RelayedsecretsserverAnswer" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnauthorized" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultForbidden" } } } }, "502": { "description": "Bad Gateway", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnavailable" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VaultUnavailable" } } } } }, "x-caldyr-relayed": "secrets-server", "x-caldyr-source": "scripts/lib/auth/routes-vault.js", "x-caldyr-registration": "subroutes", "x-caldyr-auth-source": "route:session" } }, "/verify-email/config": { "get": { "operationId": "get_verify_email_config", "tags": [ "auth" ], "summary": "Whether e-mail verification is required before sign-up (public)", "security": [], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyEmailConfig" } } } } }, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/verify-email/confirm": { "post": { "operationId": "post_verify_email_confirm", "tags": [ "auth" ], "summary": "Exchange the mailed code for a verification token (public)", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyEmailConfirmRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyEmailConfirmed" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyEmailInvalidCode" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyEmailOff2" } } } }, "429": { "description": "Too Many Requests", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicRateLimited" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/verify-email/send": { "post": { "operationId": "post_verify_email_send", "tags": [ "auth" ], "summary": "Mail a six-digit code to an address (public); the answer is the same for a free and a taken address", "security": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyEmailSendRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyEmailSent" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyEmailBadRequest" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyEmailOff" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VerifyEmailMail" } } } } }, "x-caldyr-request-unchecked": true, "x-caldyr-source": "scripts/routes/auth.js#_dispatch", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:public" } }, "/workflows/templates": { "get": { "operationId": "get_workflows_templates", "tags": [ "rag-api" ], "summary": "The workflow template index (any signed-in caller, the shared operator bearer or the fleet admin bearer)", "security": [ { "apiToken": [] }, { "adminToken": [] }, { "session": [] }, { "bearer": [] } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowTemplateIndex" } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowTemplatesUnauthorized" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorBody" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowTemplatesMissing" } } } } }, "x-caldyr-source": "scripts/rag-api.js#_rawRequestHandler", "x-caldyr-registration": "inline", "x-caldyr-auth-source": "rule:operator-or-session" } } }, "components": { "schemas": { "AccountEraseBlocked": { "title": "AccountEraseBlocked", "type": "object", "required": [ "error", "retry_after_s" ], "properties": { "error": { "type": "string" }, "retry_after_s": { "type": "integer" } }, "description": "Retry-After is set; 409 when the purge refused, 503 when a service was unreachable" }, "AccountEraseRequest": { "title": "AccountEraseRequest", "type": "object", "properties": { "totp_code": { "type": "string", "description": "step-up: the current TOTP code" }, "recovery_code": { "type": "string", "description": "step-up: a recovery code instead of totp_code" } }, "description": "the step-up proof" }, "AccountEraseUnavailable": { "title": "AccountEraseUnavailable", "type": "object", "required": [ "error", "retry_after_s" ], "properties": { "error": { "type": "string" }, "retry_after_s": { "type": "integer" } } }, "AccountErased": { "title": "AccountErased", "type": "object", "required": [ "ok", "deleted" ], "properties": { "ok": { "const": true }, "deleted": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "format": "uuid" } } }, "counts": { "type": "object", "description": "what the erasure removed" } } }, "AdminClaimAlreadyClaimed": { "title": "AdminClaimAlreadyClaimed", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "already_claimed" ] } } }, "AdminClaimBadRequest": { "title": "AdminClaimBadRequest", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "invalid_body", "invalid_email", "invalid_company_name" ] } } }, "AdminClaimDisabled": { "title": "AdminClaimDisabled", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "claim_disabled" ] } } }, "AdminClaimForm": { "title": "AdminClaimForm", "type": "string", "description": "Cache-Control no-store, Referrer-Policy no-referrer" }, "AdminClaimRateLimited": { "title": "AdminClaimRateLimited", "type": "object", "required": [ "error", "retry_after_ms" ], "additionalProperties": false, "properties": { "error": { "type": "string" }, "retry_after_ms": { "type": "integer" } }, "description": "the per-IP pre-auth limit (pre-auth-ip-limit.js ADMIN_CLAIM_ZONE); Retry-After is set" }, "AdminClaimRequest": { "title": "AdminClaimRequest", "type": "object", "required": [ "token", "email" ], "properties": { "token": { "type": "string", "description": "the claim token from the installer (compared in constant time; a wrong or missing one is 403 claim_token_invalid)" }, "email": { "type": "string", "maxLength": 254, "description": "the first administrator; trimmed and lowercased" }, "company_name": { "type": "string", "maxLength": 100, "description": "no control characters; empty or absent takes CALDYR_INSTALL_COMPANY_NAME, else Self-hosted" }, "locale": { "type": "string", "description": "en, ru, es, et or fi; any other value is en" } } }, "AdminClaimTokenExpired": { "title": "AdminClaimTokenExpired", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "claim_token_expired" ] } } }, "AdminClaimTokenInvalid": { "title": "AdminClaimTokenInvalid", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "claim_token_invalid" ] } } }, "AdminClaimUnavailable": { "title": "AdminClaimUnavailable", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "claim_unavailable" ] } } }, "AdminClaimed": { "title": "AdminClaimed", "type": "object", "required": [ "status", "signup_request_id", "completion_url", "completion_expires_at" ], "additionalProperties": false, "properties": { "status": { "const": "claimed" }, "signup_request_id": { "type": "string", "format": "uuid" }, "completion_url": { "type": "string", "description": "/fleet/register?completion=&lang=: the page that makes the company, its Owner and the Owner's keys" }, "completion_expires_at": { "type": "string", "format": "date-time" } } }, "AgentCatalog": { "title": "AgentCatalog", "type": "object", "properties": { "auto": { "type": "string" }, "digest": { "type": "string", "description": "sha256 of the static catalog (pinned in agent-core and here)" }, "source": { "type": "string", "enum": [ "catalog", "host" ] }, "host_id": { "type": [ "string", "null" ] }, "reported_at": { "type": [ "string", "null" ], "description": "when the daemon built the record (source host)" }, "agents": { "type": "object", "additionalProperties": { "type": "object", "properties": { "default": { "type": "string" }, "auto": { "type": "string" }, "arg_flags": { "type": "array", "items": { "type": "string" } }, "models": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "label": { "type": "string" } } } }, "source": { "type": "string", "enum": [ "cli", "catalog", "static" ], "description": "source host only: cli = read from the CLI on the host, catalog = the CLI keeps no list (static catalog), static = the daemon did not report this agent" }, "installed": { "type": [ "boolean", "null" ] }, "version": { "type": [ "string", "null" ] }, "configured": { "type": [ "string", "null" ], "description": "the model the CLI's own config selects on the host" } } } } } }, "AgentConfigCascade": { "title": "AgentConfigCascade", "type": "object", "required": [ "claude_md", "version_hash", "components", "config_size_bytes" ], "properties": { "claude_md": { "type": "string" }, "version_hash": { "type": "string", "description": "first 32 hex characters of sha256" }, "components": { "type": "object", "required": [ "global", "company", "team" ], "additionalProperties": false, "properties": { "global": { "type": "object", "required": [ "version", "size_bytes" ], "additionalProperties": false, "properties": { "version": { "type": "integer" }, "size_bytes": { "type": "integer" }, "sealed": { "type": "boolean", "description": "global layer is sealed; only in end-to-end mode" } } }, "company": { "type": "object", "required": [ "version", "size_bytes" ], "additionalProperties": false, "properties": { "version": { "type": "integer" }, "size_bytes": { "type": "integer" }, "sealed": { "type": "boolean", "description": "company layer is sealed; only in end-to-end mode" } } }, "team": { "type": "object", "required": [ "version", "size_bytes" ], "additionalProperties": false, "properties": { "version": { "type": "integer" }, "size_bytes": { "type": "integer" }, "sealed": { "type": "boolean", "description": "team layer is sealed; only in end-to-end mode" } } } } }, "config_size_bytes": { "type": "integer" }, "e2e_instructions": { "type": "object", "description": "only when a layer is sealed: what the host needs to compose the cascade itself", "properties": { "v": { "const": 1 }, "company_id": { "type": [ "string", "null" ], "format": "uuid" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "global_md": { "type": "string" }, "frozen_sections": { "type": "array", "items": { "type": "string" } }, "company": { "type": "object", "description": "{ sealed: } or { text }" }, "team": { "type": "object", "description": "{ sealed: } or { text }" } } } } }, "AgentConfigCompanyRequest": { "title": "AgentConfigCompanyRequest", "type": "object", "properties": { "claude_md": { "type": "string", "description": "the overlay text; a non-string is stored as an empty string" } } }, "AgentConfigGlobal": { "title": "AgentConfigGlobal", "type": "object", "required": [ "claude_md", "frozen_sections", "version" ], "properties": { "claude_md": { "type": "string" }, "frozen_sections": { "type": "array", "items": { "type": "string" } }, "version": { "type": "integer" }, "updated_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "AgentConfigGlobalRefusal": { "title": "AgentConfigGlobalRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "level": { "type": "string", "description": "sudo_required: the step-up level the route needs" } } }, "AgentConfigGlobalRequest": { "title": "AgentConfigGlobalRequest", "type": "object", "properties": { "claude_md": { "type": "string", "description": "the overlay text; a non-string is stored as an empty string" }, "frozen_sections": { "type": "array", "items": { "type": "string" }, "description": "names of sections tenants cannot override; a non-array is read as none" } } }, "AgentConfigOverlay": { "title": "AgentConfigOverlay", "type": "object", "required": [ "claude_md", "version" ], "properties": { "claude_md": { "type": "string" }, "version": { "type": "integer" }, "updated_at": { "type": [ "string", "null" ], "format": "date-time" } }, "description": "claude_md \"\" and version 0 when no overlay exists; a company in end-to-end mode serves the sealed text the knowledge base holds" }, "AgentConfigRefusal": { "title": "AgentConfigRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "detail": { "type": "string", "maxLength": 200 } }, "description": "frozen-section, canonicalisation (400) or size (413) refusal from the config module" }, "AgentConfigSaved": { "title": "AgentConfigSaved", "type": "object", "required": [ "version" ], "additionalProperties": false, "properties": { "version": { "type": "integer" } } }, "AgentConfigTeamRequest": { "title": "AgentConfigTeamRequest", "type": "object", "properties": { "claude_md": { "type": "string", "description": "the overlay text; a non-string is stored as an empty string" } } }, "AgentPolicy": { "title": "AgentPolicy", "type": "object", "additionalProperties": false, "required": [ "team_id", "agents", "known_agents", "auth_sources", "allowed_agents", "agent_auth_policy" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "agents": { "type": "array", "items": { "type": "string" } }, "known_agents": { "type": "array", "items": { "type": "string" } }, "auth_sources": { "type": "array", "items": { "type": "string" } }, "allowed_agents": { "type": [ "array", "null" ], "items": { "type": "string" } }, "agent_auth_policy": { "type": [ "object", "null" ] } } }, "AgentPolicyUnavailable": { "title": "AgentPolicyUnavailable", "type": "object", "required": [ "error", "detail" ], "properties": { "error": { "const": "agent_policy_unavailable" }, "detail": { "type": "string" } } }, "AgentUpgradeList": { "title": "AgentUpgradeList", "type": "object", "required": [ "upgrades" ], "additionalProperties": false, "properties": { "upgrades": { "type": "array", "items": { "title": "AgentUpgradeRow", "type": "object", "additionalProperties": false, "required": [ "id", "host_id", "run_id", "group_id", "origin", "from", "to", "status", "reason", "rolled_back", "allow_busy", "not_before", "sent_at", "started_at", "finished_at", "created_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "host_id": { "type": "string", "format": "uuid" }, "run_id": { "type": [ "string", "null" ], "format": "uuid" }, "group_id": { "type": [ "string", "null" ], "format": "uuid" }, "origin": { "type": "string" }, "from": { "type": [ "string", "null" ] }, "to": { "type": "string" }, "status": { "type": "string" }, "reason": { "type": [ "string", "null" ] }, "rolled_back": { "type": [ "boolean", "null" ] }, "allow_busy": { "type": "boolean" }, "not_before": { "type": [ "string", "null" ], "format": "date-time" }, "sent_at": { "type": [ "string", "null" ], "format": "date-time" }, "started_at": { "type": [ "string", "null" ], "format": "date-time" }, "finished_at": { "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "type": [ "string", "null" ], "format": "date-time" } } } } } }, "AgentUpgradeRunCancelled": { "title": "AgentUpgradeRunCancelled", "type": "object", "required": [ "run_id", "cancelled" ], "additionalProperties": false, "properties": { "run_id": { "type": "string", "format": "uuid" }, "cancelled": { "type": "integer" } } }, "AgentUpgradeRunQueued": { "title": "AgentUpgradeRunQueued", "type": "object", "required": [ "run_id", "queued", "skipped", "stagger_s" ], "additionalProperties": false, "properties": { "run_id": { "type": [ "string", "null" ], "format": "uuid", "description": "null when no host was queued" }, "queued": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "skipped": { "type": "array", "items": { "type": "object", "required": [ "host_id", "reason" ], "additionalProperties": false, "properties": { "host_id": { "type": "string", "format": "uuid" }, "reason": { "type": "string" } } } }, "stagger_s": { "type": "integer" } } }, "AgentUpgradeSent": { "title": "AgentUpgradeSent", "type": "object", "required": [ "upgrade_id", "from", "to" ], "additionalProperties": false, "properties": { "upgrade_id": { "type": "string", "format": "uuid" }, "from": { "type": [ "string", "null" ] }, "to": { "type": "string" } } }, "ArticleCreateRequest": { "title": "ArticleCreateRequest", "type": "object", "required": [ "title", "body" ], "properties": { "title": { "type": "string", "minLength": 1, "maxLength": 500, "description": "trimmed" }, "body": { "type": "string", "description": "at most 256 KiB" }, "tags": { "type": "array", "maxItems": 64, "items": { "type": "string", "maxLength": 128 } }, "source_path": { "type": [ "string", "null" ], "minLength": 1, "maxLength": 1024, "description": "an existing article at this path is updated and the answer is 200" } } }, "ArticleCreated": { "title": "ArticleCreated", "type": "object", "required": [ "id", "scope", "title", "tags", "created_at", "updated_at", "can_edit" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "scope": { "enum": [ "company", "global" ] }, "source_path": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "can_edit": { "type": "boolean", "description": "the caller may edit and delete this article" } } }, "ArticleDeleted": { "title": "ArticleDeleted", "type": "object", "required": [ "deleted", "id" ], "additionalProperties": false, "properties": { "deleted": { "const": true }, "id": { "type": "string", "format": "uuid" } } }, "ArticleDetail": { "title": "ArticleDetail", "type": "object", "required": [ "id", "scope", "title", "tags", "created_at", "updated_at", "can_edit", "body" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "scope": { "enum": [ "company", "global" ] }, "source_path": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "can_edit": { "type": "boolean", "description": "the caller may edit and delete this article" }, "body": { "type": "string" } } }, "ArticleEditRequest": { "title": "ArticleEditRequest", "type": "object", "required": [], "properties": { "title": { "type": "string", "minLength": 1, "maxLength": 500, "description": "trimmed" }, "body": { "type": "string", "description": "at most 256 KiB" }, "tags": { "type": "array", "maxItems": 64, "items": { "type": "string", "maxLength": 128 } } } }, "ArticleEdited": { "title": "ArticleEdited", "type": "object", "required": [ "id", "scope", "title", "tags", "created_at", "updated_at", "can_edit" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "scope": { "enum": [ "company", "global" ] }, "source_path": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "can_edit": { "type": "boolean", "description": "the caller may edit and delete this article" } } }, "ArticleForbidden": { "title": "ArticleForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "no_tenant, forbidden (an automation token, a non-author, a global article), or csrf_token mismatch" }, "detail": { "type": "string" } } }, "ArticleList": { "title": "ArticleList", "type": "object", "required": [ "articles" ], "additionalProperties": false, "properties": { "articles": { "type": "array", "items": { "title": "ArticleSummary", "type": "object", "required": [ "id", "scope", "title", "tags", "created_at", "updated_at", "can_edit" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "scope": { "enum": [ "company", "global" ] }, "source_path": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "can_edit": { "type": "boolean", "description": "the caller may edit and delete this article" } } } } } }, "ArticleListRefused": { "title": "ArticleListRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value" }, "detail": { "type": "string" } } }, "ArticleRefused": { "title": "ArticleRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value, payload_too_large, article_policy_blocked (a credential was found; detail names the detector)" }, "detail": { "type": "string" } } }, "ArticleSealed": { "title": "ArticleSealed", "type": "object", "required": [ "error", "hint" ], "properties": { "error": { "const": "e2e_sealed" }, "hint": { "const": "kb.local" } } }, "ArticleSearchRefused": { "title": "ArticleSearchRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value" }, "detail": { "type": "string" } } }, "ArticleSearchResults": { "title": "ArticleSearchResults", "type": "object", "required": [ "results" ], "additionalProperties": false, "properties": { "results": { "type": "array", "items": { "type": "object", "description": "a hit as the knowledge service returns it; scope is company or global" } } } }, "ArticleUnavailable": { "title": "ArticleUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unavailable" }, "detail": { "type": "string" } } }, "ArticleUpdatedByPath": { "title": "ArticleUpdatedByPath", "type": "object", "required": [ "id", "scope", "title", "tags", "created_at", "updated_at", "can_edit" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "scope": { "enum": [ "company", "global" ] }, "source_path": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "can_edit": { "type": "boolean", "description": "the caller may edit and delete this article" } } }, "AuditEncryptedDeduplicated": { "title": "AuditEncryptedDeduplicated", "type": "object", "required": [ "id", "deduplicated" ], "additionalProperties": false, "properties": { "id": { "type": [ "string", "null" ] }, "deduplicated": { "const": true } } }, "AuditEncryptedQueued": { "title": "AuditEncryptedQueued", "type": "object", "required": [ "id", "queued" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "queued": { "const": true } } }, "AuditEncryptedRefusal": { "title": "AuditEncryptedRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "detail": { "type": "string" } }, "description": "invalid_value with a detail, or the blob field error as the error text" }, "AuditEncryptedRequest": { "title": "AuditEncryptedRequest", "type": "object", "required": [ "action", "outcome", "team_id" ], "properties": { "action": { "type": "string", "minLength": 1 }, "outcome": { "enum": [ "success", "denied", "error", "ok" ], "description": "ok is stored as success" }, "team_id": { "type": "string", "format": "uuid" }, "resource_type": { "type": [ "string", "null" ] }, "resource_id": { "type": [ "string", "null" ] }, "request_id": { "type": "string", "description": "a repeat with the same action and request_id within 60 seconds answers the first record" }, "reason_blob": { "type": "object", "required": [ "ciphertext", "nonce" ], "properties": { "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]{48}$", "description": "24 bytes as hex" } } }, "meta_blob": { "type": "object", "required": [ "ciphertext", "nonce" ], "properties": { "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]{48}$", "description": "24 bytes as hex" } } } } }, "AuditFeed": { "title": "AuditFeed", "type": "object", "required": [ "rows" ], "additionalProperties": false, "properties": { "rows": { "type": "array", "items": { "type": "object", "required": [ "source", "ts", "op" ], "additionalProperties": false, "properties": { "source": { "enum": [ "secret", "vault", "workflow" ] }, "ts": { "type": "string", "format": "date-time" }, "op": { "type": "string" }, "subject": { "type": [ "string", "null" ] }, "caller_id": { "type": [ "string", "null" ] }, "via": { "type": [ "string", "null" ] }, "outcome": { "type": [ "string", "null" ] }, "extra": { "type": [ "string", "null" ] } } } } } }, "AuditKeyList": { "title": "AuditKeyList", "type": "object", "required": [ "keys" ], "additionalProperties": false, "properties": { "keys": { "type": "array", "items": { "type": "object", "required": [ "id", "pubkey_hex", "fingerprint", "algorithm", "created_at" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "pubkey_hex": { "type": "string", "pattern": "^[0-9a-f]+$" }, "fingerprint": { "type": "string", "pattern": "^[0-9a-f]+$" }, "prev_fingerprint": { "type": [ "string", "null" ], "pattern": "^[0-9a-f]+$" }, "algorithm": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "retired_at": { "type": [ "string", "null" ], "format": "date-time" }, "created_by": { "type": [ "string", "null" ] } } } } } }, "AuditKeyMissing": { "title": "AuditKeyMissing", "type": "object", "required": [ "error" ], "properties": { "error": { "enum": [ "no_active_key", "signing_not_enabled" ] }, "company_id": { "type": "string", "format": "uuid" } } }, "AuditKeyRotated": { "title": "AuditKeyRotated", "type": "object", "required": [ "old_key_id", "new_key_id", "new_pubkey_hex", "new_fingerprint" ], "additionalProperties": false, "properties": { "old_key_id": { "type": [ "string", "null" ], "format": "uuid" }, "new_key_id": { "type": "string", "format": "uuid" }, "new_pubkey_hex": { "type": "string", "pattern": "^[0-9a-f]+$" }, "new_fingerprint": { "type": "string", "pattern": "^[0-9a-f]+$" } } }, "AuditLogPage": { "title": "AuditLogPage", "type": "object", "required": [ "entries", "count" ], "additionalProperties": false, "properties": { "entries": { "type": "array", "items": { "type": "object", "required": [ "id", "ts", "action" ], "properties": { "id": { "type": "string" }, "ts": { "type": "string", "format": "date-time" }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "action": { "type": "string" }, "scope": { "type": [ "string", "null" ] }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "resource_type": { "type": [ "string", "null" ] }, "resource_id": { "type": [ "string", "null" ] }, "outcome": { "type": [ "string", "null" ] }, "reason": { "type": [ "string", "null" ] }, "meta": { "type": [ "object", "null" ] }, "caller_email": { "type": [ "string", "null" ] }, "caller_role": { "type": [ "string", "null" ] }, "caller_kind": { "type": [ "string", "null" ] } } } }, "count": { "type": "integer" } } }, "AuditProof": { "title": "AuditProof", "type": "object", "required": [ "audit_log_id", "company_id", "ts", "action", "signed" ], "additionalProperties": false, "properties": { "audit_log_id": { "type": "string" }, "company_id": { "type": "string", "format": "uuid" }, "ts": { "type": "string", "format": "date-time" }, "action": { "type": "string" }, "resource": { "type": [ "string", "null" ] }, "outcome": { "type": [ "string", "null" ] }, "signed": { "type": "boolean" }, "signature": { "type": [ "string", "null" ], "pattern": "^[0-9a-f]+$" }, "payload_hash": { "type": [ "string", "null" ], "pattern": "^[0-9a-f]+$" }, "prev_hash": { "type": [ "string", "null" ], "pattern": "^[0-9a-f]+$" }, "key_id": { "type": [ "string", "null" ], "format": "uuid" }, "signed_at": { "type": [ "string", "null" ], "format": "date-time" }, "blob_missing": { "type": "boolean" } } }, "AuditPubkey": { "title": "AuditPubkey", "type": "object", "required": [ "company_id", "key_id", "pubkey_hex", "fingerprint", "prev_fingerprint", "active_from", "active_to", "algorithm", "note" ], "additionalProperties": false, "properties": { "company_id": { "type": "string", "format": "uuid" }, "key_id": { "type": "string", "format": "uuid" }, "pubkey_hex": { "type": "string", "pattern": "^[0-9a-f]+$" }, "fingerprint": { "type": "string", "pattern": "^[0-9a-f]+$" }, "prev_fingerprint": { "type": [ "string", "null" ], "pattern": "^[0-9a-f]+$" }, "active_from": { "type": "string", "format": "date-time" }, "active_to": { "type": [ "string", "null" ], "format": "date-time" }, "algorithm": { "const": "ed25519" }, "note": { "type": "string" } } }, "AuditTableMissing": { "title": "AuditTableMissing", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "audit_table_missing" }, "detail": { "type": "string" } } }, "AuditVerifyResult": { "type": "object", "required": [ "range", "total_rows", "verified", "ok", "reasons" ], "properties": { "range": { "type": "object", "additionalProperties": false, "properties": { "from": { "type": [ "string", "null" ], "format": "date-time" }, "to": { "type": [ "string", "null" ], "format": "date-time" }, "limit": { "type": [ "integer", "null" ] } } }, "company_id": { "type": [ "string", "null" ], "format": "uuid" }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "total_rows": { "type": "integer" }, "verified": { "type": "integer" }, "pending": { "type": "integer" }, "gaps": { "type": "array", "items": {} }, "tampered_ids": { "type": "array", "items": {} }, "key_rotations": { "type": "array", "items": { "type": "object", "properties": { "at_id": {}, "kind": { "enum": [ "scheduled", "disaster" ] }, "old_key_id": { "type": [ "string", "null" ] }, "new_key_id": { "type": [ "string", "null" ] }, "bridge_status": { "type": "string" } } } }, "unattested_retired_key_ids": { "type": "array", "items": {} }, "truncated": { "type": "boolean" }, "seq_contiguity": { "type": "string", "description": "none, deferred, ok, gaps or unchecked" }, "seq_window": {}, "seq_holes": { "type": "array", "items": {} }, "seq_holes_total": { "type": "integer" }, "seq_holes_deleted": { "type": "integer" }, "seq_holes_tenant_deleted": { "type": "integer" }, "seq_holes_unexplained": { "type": "integer" }, "seq_purged_prefix": { "type": [ "integer", "null" ] }, "seq_cursor_missing": {}, "horizon_stored": {}, "horizon_derived": {}, "horizon_source": {}, "horizon_mismatch": { "type": "boolean" }, "legacy_envelope_rows": { "type": "integer" }, "legacy_envelope_after_cutover_ids": { "type": "array", "items": {} }, "last_hash": { "type": [ "string", "null" ] }, "reasons": { "type": "array", "items": { "type": "string", "description": "tampered, unsigned_rows, truncated, legacy_envelope_after_cutover, seq_unchecked, cursor_row_missing or missing_rows" } }, "warnings": { "type": "array", "items": {} }, "ok": { "type": "boolean" }, "paged": { "const": true }, "batch": { "type": "integer" }, "after_id": { "type": [ "string", "null" ] }, "next_after_id": { "type": [ "string", "null" ] }, "has_more": { "type": "boolean" }, "prev_hash_out": { "type": [ "string", "null" ] } }, "title": "AuditVerifyResult" }, "AuditVerifyResultFailed": { "type": "object", "required": [ "range", "total_rows", "verified", "ok", "reasons" ], "properties": { "range": { "type": "object", "additionalProperties": false, "properties": { "from": { "type": [ "string", "null" ], "format": "date-time" }, "to": { "type": [ "string", "null" ], "format": "date-time" }, "limit": { "type": [ "integer", "null" ] } } }, "company_id": { "type": [ "string", "null" ], "format": "uuid" }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "total_rows": { "type": "integer" }, "verified": { "type": "integer" }, "pending": { "type": "integer" }, "gaps": { "type": "array", "items": {} }, "tampered_ids": { "type": "array", "items": {} }, "key_rotations": { "type": "array", "items": { "type": "object", "properties": { "at_id": {}, "kind": { "enum": [ "scheduled", "disaster" ] }, "old_key_id": { "type": [ "string", "null" ] }, "new_key_id": { "type": [ "string", "null" ] }, "bridge_status": { "type": "string" } } } }, "unattested_retired_key_ids": { "type": "array", "items": {} }, "truncated": { "type": "boolean" }, "seq_contiguity": { "type": "string", "description": "none, deferred, ok, gaps or unchecked" }, "seq_window": {}, "seq_holes": { "type": "array", "items": {} }, "seq_holes_total": { "type": "integer" }, "seq_holes_deleted": { "type": "integer" }, "seq_holes_tenant_deleted": { "type": "integer" }, "seq_holes_unexplained": { "type": "integer" }, "seq_purged_prefix": { "type": [ "integer", "null" ] }, "seq_cursor_missing": {}, "horizon_stored": {}, "horizon_derived": {}, "horizon_source": {}, "horizon_mismatch": { "type": "boolean" }, "legacy_envelope_rows": { "type": "integer" }, "legacy_envelope_after_cutover_ids": { "type": "array", "items": {} }, "last_hash": { "type": [ "string", "null" ] }, "reasons": { "type": "array", "items": { "type": "string", "description": "tampered, unsigned_rows, truncated, legacy_envelope_after_cutover, seq_unchecked, cursor_row_missing or missing_rows" } }, "warnings": { "type": "array", "items": {} }, "ok": { "type": "boolean" }, "paged": { "const": true }, "batch": { "type": "integer" }, "after_id": { "type": [ "string", "null" ] }, "next_after_id": { "type": [ "string", "null" ] }, "has_more": { "type": "boolean" }, "prev_hash_out": { "type": [ "string", "null" ] } }, "title": "AuditVerifyResultFailed", "description": "same shape as 200 with ok false and reasons naming the problems" }, "AuthRateLimited": { "title": "AuthRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "rate-limited; try again later, or rate_limited" }, "retry_after_ms": { "type": "integer" }, "retry_after_seconds": { "type": "integer" }, "kind": { "type": "string" } }, "description": "Retry-After is set" }, "AuthRequiredLegacy": { "title": "AuthRequiredLegacy", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "AuthUnavailable": { "title": "AuthUnavailable", "type": "object", "description": "membership lookup failed; Retry-After is set (scripts/lib/auth/auth-unavailable.js)" }, "AutomationChainRevoked": { "title": "AutomationChainRevoked", "type": "object", "required": [ "team_id", "token_id", "chain_id", "revoked" ], "additionalProperties": false, "properties": { "team_id": { "type": "string", "format": "uuid" }, "token_id": { "type": "string", "format": "uuid" }, "chain_id": { "type": "string", "format": "uuid" }, "revoked": { "type": "integer", "description": "rows revoked" } } }, "AutomationRefreshInternal": { "title": "AutomationRefreshInternal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "internal_error, audit_write_failed" } } }, "AutomationRefreshPair": { "title": "AutomationRefreshPair", "type": "object", "required": [ "token_type", "access_token", "access_token_id", "access_expires_at", "refresh_token", "refresh_expires_at", "chain_id", "refresh" ], "additionalProperties": false, "properties": { "token_type": { "const": "Bearer" }, "access_token": { "type": "string" }, "access_token_id": { "type": "string", "format": "uuid" }, "access_expires_at": { "type": "string", "format": "date-time" }, "refresh_token": { "type": "string" }, "refresh_expires_at": { "type": "string", "format": "date-time" }, "chain_id": { "type": "string", "format": "uuid" }, "refresh": { "const": "POST /api/auth/automation/refresh" } }, "description": "secret and shown once; answered with Cache-Control no-store" }, "AutomationRefreshRefused": { "title": "AutomationRefreshRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_refresh_token, automation_refresh_already_used, automation_token_revoked, automation_token_expired" }, "limit": { "enum": [ "chain_absolute", "refresh_idle" ] }, "reuse_detected": { "type": "boolean" } } }, "AutomationTokenList": { "title": "AutomationTokenList", "type": "object", "required": [ "tokens" ], "additionalProperties": false, "properties": { "tokens": { "type": "array", "maxItems": 500, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "kind": { "enum": [ "access", "refresh" ] }, "chain_id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time" }, "last_used_at": { "type": [ "string", "null" ], "format": "date-time" }, "used_at": { "type": [ "string", "null" ], "format": "date-time" }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" }, "e2e_pubkey": { "type": [ "string", "null" ], "description": "hex" } } } } } }, "AutomationTokenPair": { "title": "AutomationTokenPair", "type": "object", "required": [ "team_id", "token_type", "access_token", "access_token_id", "access_expires_at", "refresh_token", "refresh_expires_at", "chain_id", "refresh", "note", "e2e_pubkey" ], "additionalProperties": false, "description": "Cache-Control: no-store", "properties": { "team_id": { "type": "string", "format": "uuid" }, "token_type": { "const": "Bearer" }, "access_token": { "type": "string" }, "access_token_id": { "type": "string", "format": "uuid" }, "access_expires_at": { "type": "string", "format": "date-time" }, "refresh_token": { "type": "string" }, "refresh_expires_at": { "type": "string", "format": "date-time" }, "chain_id": { "type": "string", "format": "uuid" }, "refresh": { "const": "POST /api/auth/automation/refresh" }, "note": { "type": "string" }, "e2e_pubkey": { "type": [ "string", "null" ] } } }, "BackendConfigs": { "title": "BackendConfigs", "type": "object", "description": "backend name -> files; an empty array for backends without an editable file (hermes, openclaw, nanoclaw)", "additionalProperties": { "type": "array", "items": { "type": "object", "required": [ "name", "rel", "label" ], "additionalProperties": false, "properties": { "name": { "type": "string" }, "rel": { "type": "string", "description": "path relative to the home directory" }, "label": { "type": "string" } } } } }, "BillingBaseUrl": { "title": "BillingBaseUrl", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "base_url_misconfigured" }, "detail": { "type": "string" } } }, "BillingCheckoutRefused": { "title": "BillingCheckoutRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_tier, invalid_period, invalid_quantity, team_minimum_seats (minimum, requested)" }, "detail": { "type": "string" }, "minimum": { "type": "integer" }, "requested": { "type": "integer" } } }, "BillingCheckoutRequest": { "title": "BillingCheckoutRequest", "type": "object", "required": [ "target_tier" ], "properties": { "target_tier": { "enum": [ "team", "enterprise" ] }, "billing_period": { "enum": [ "month", "year" ], "default": "month" }, "quantity": { "type": "integer", "minimum": 1, "description": "seats; absent means the tier minimum (2 for team); team needs at least 2" } } }, "BillingConfig": { "title": "BillingConfig", "type": "object", "required": [ "self_service" ], "additionalProperties": false, "properties": { "self_service": { "type": "boolean" } } }, "BillingInvoiceList": { "title": "BillingInvoiceList", "type": "object", "required": [ "invoices", "has_more", "next_cursor" ], "additionalProperties": false, "properties": { "invoices": { "type": "array", "items": { "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": [ "string", "null" ] }, "number": { "type": [ "string", "null" ] }, "status": { "type": [ "string", "null" ] }, "amount_due": { "type": [ "integer", "null" ], "description": "minor currency units" }, "amount_paid": { "type": [ "integer", "null" ] }, "currency": { "type": [ "string", "null" ] }, "created": { "type": [ "integer", "null" ], "description": "unix seconds" }, "period_start": { "type": [ "integer", "null" ] }, "period_end": { "type": [ "integer", "null" ] }, "hosted_invoice_url": { "type": [ "string", "null" ] }, "invoice_pdf": { "type": [ "string", "null" ] } }, "description": "a whitelist of the Stripe invoice; no customer email or billing details" } }, "has_more": { "type": "boolean" }, "next_cursor": { "type": [ "string", "null" ] } } }, "BillingInvoicePdf": { "title": "BillingInvoicePdf", "type": "string", "format": "binary", "description": "Content-Disposition attachment; Cache-Control private, no-store" }, "BillingInvoicesFailed": { "title": "BillingInvoicesFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "stripe_invoices_failed" }, "detail": { "type": "string" } } }, "BillingNoCustomer": { "title": "BillingNoCustomer", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "no_billing_customer" }, "detail": { "type": "string" } } }, "BillingNotConfigured": { "title": "BillingNotConfigured", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "price_not_configured, base_url_misconfigured" }, "detail": { "type": "string" } } }, "BillingPdfBadRequest": { "title": "BillingPdfBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "BillingPdfForbidden": { "title": "BillingPdfForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "BillingPdfInternal": { "title": "BillingPdfInternal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "BillingPdfNoFile": { "title": "BillingPdfNoFile", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "BillingPdfNotFound": { "title": "BillingPdfNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "BillingPdfUpstream": { "title": "BillingPdfUpstream", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "BillingPortalFailed": { "title": "BillingPortalFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "stripe_portal_failed" }, "detail": { "type": "string" } } }, "BillingPortalRefused": { "title": "BillingPortalRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value" }, "detail": { "type": "string" } } }, "BillingPortalRequest": { "title": "BillingPortalRequest", "type": "object", "properties": { "return_url": { "type": [ "string", "null" ], "maxLength": 2048, "description": "same origin as the public base URL; defaults to /fleet/company/billing" } } }, "BillingSession": { "title": "BillingSession", "type": "object", "required": [ "url", "session_id" ], "additionalProperties": false, "properties": { "url": { "type": "string", "description": "the Stripe-hosted page to send the browser to" }, "session_id": { "type": "string" } } }, "BillingStripeFailed": { "title": "BillingStripeFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "stripe_customer_failed, stripe_checkout_failed" }, "detail": { "type": "string" } } }, "BillingSubscription": { "title": "BillingSubscription", "type": "object", "required": [ "subscription" ], "additionalProperties": false, "properties": { "subscription": { "type": [ "object", "null" ], "additionalProperties": false, "properties": { "stripe_subscription_id": { "type": "string" }, "stripe_price_id": { "type": [ "string", "null" ] }, "tier": { "type": [ "string", "null" ] }, "status": { "type": "string" }, "current_period_start": { "type": [ "string", "null" ], "format": "date-time" }, "current_period_end": { "type": [ "string", "null" ], "format": "date-time" }, "cancel_at_period_end": { "type": "boolean" }, "updated_at": { "type": "string", "format": "date-time" } } } } }, "BlobCreateRequest": { "title": "BlobCreateRequest", "type": "object", "required": [ "kind", "ref_id", "ciphertext", "nonce" ], "properties": { "team_id": { "type": "string", "format": "uuid", "description": "team axis: required; the caller must be a member" }, "kind": { "type": "string" }, "ref_id": { "type": "string" }, "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]{48}$", "description": "24 bytes, hex" }, "aad_version": { "type": "integer", "default": 1 }, "blind_index_entries": { "type": "array", "maxItems": 32, "items": { "type": "object", "required": [ "field", "index_value" ], "properties": { "field": { "type": "string" }, "index_value": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$", "description": "32-byte blind index, hex" } } } } } }, "BlobCreated": { "title": "BlobCreated", "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" } } }, "BlobDeleted": { "title": "BlobDeleted", "type": "object", "required": [ "deleted" ], "additionalProperties": false, "properties": { "deleted": { "type": "string", "format": "uuid" } } }, "BlobLookupRequest": { "title": "BlobLookupRequest", "type": "object", "required": [ "team_id", "field", "index_value" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "field": { "type": "string" }, "index_value": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$", "description": "32-byte blind index, hex" } } }, "BlobLookupResponse": { "title": "BlobLookupResponse", "type": "object", "required": [ "results" ], "additionalProperties": false, "properties": { "results": { "type": "array", "items": { "type": "object", "required": [ "id", "ciphertext", "nonce", "kind", "aad_version" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "kind": { "type": "string" }, "aad_version": { "type": "integer" } } } } } }, "BlobRead": { "title": "BlobRead", "type": "object", "required": [ "id", "ciphertext", "nonce", "kind", "aad_version", "team_id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "kind": { "type": "string" }, "aad_version": { "type": "integer" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "BlobSearchRequest": { "title": "BlobSearchRequest", "type": "object", "required": [ "team_id", "queries" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "queries": { "type": "array", "minItems": 1, "maxItems": 32, "items": { "type": "object", "required": [ "field", "index_value" ], "properties": { "field": { "type": "string" }, "index_value": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$", "description": "32-byte blind index, hex" } } } } } }, "BlobSearchResponse": { "title": "BlobSearchResponse", "type": "object", "required": [ "results" ], "additionalProperties": false, "properties": { "results": { "type": "array", "items": { "type": "object", "required": [ "id", "ciphertext", "nonce", "kind", "aad_version" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "kind": { "type": "string" }, "aad_version": { "type": "integer" } } } } } }, "BodyRefusal": { "title": "BodyRefusal", "type": "object", "required": [ "error", "field", "rule", "detail" ], "properties": { "error": { "type": "string", "description": "invalid_body, or the code the route answers for that field" }, "field": { "type": "string", "description": "where the body failed: name, ticket.kind, chunks[3].ct; (body) for the body itself" }, "rule": { "type": "string", "description": "the JSON Schema keyword that failed: type, required, additionalProperties, enum, maxLength, ..." }, "detail": { "type": "string" } } }, "Capabilities": { "title": "Capabilities", "type": "object", "required": [ "profile", "crypto", "api_version", "opaque_login", "endpoints" ], "additionalProperties": false, "properties": { "profile": { "const": "synaptyx" }, "crypto": { "const": "e2ee_byok" }, "api_version": { "const": 1 }, "opaque_login": { "type": "boolean", "description": "the OPAQUE routes can answer" }, "endpoints": { "type": "object", "additionalProperties": { "type": "string" }, "description": "notes_put, notes_get, notes_search, secrets_get, auth_session paths for the plugin" } } }, "ChangePassphraseBadRequest": { "title": "ChangePassphraseBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value, new_pubkey_required, bad_request, rewrap_memberships_not_a_member (team_ids)" }, "detail": { "type": "string" }, "team_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "ChangePassphraseConflict": { "title": "ChangePassphraseConflict", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "not_enrolled, conflict, membership_wrap_stale" }, "detail": { "type": "string" }, "has_kdf_salt": { "type": "boolean" }, "account": { "enum": [ "company", "solo" ] } } }, "ChangePassphraseForbidden": { "title": "ChangePassphraseForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "reauth_required, opaque_ticket_invalid, account_unavailable, old_passphrase_mismatch, or csrf_token mismatch" }, "detail": { "type": "string" } } }, "ChangePassphraseRequest": { "title": "ChangePassphraseRequest", "type": "object", "required": [ "old_kdf_salt", "old_wrapped_master", "new_kdf_salt", "new_wrapped_master", "new_pubkey" ], "properties": { "old_kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "16 bytes as hex" }, "old_wrapped_master": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "new_kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "16 bytes as hex" }, "new_wrapped_master": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "new_pubkey": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "32 bytes as hex" }, "rewrap_memberships": { "type": "array", "items": { "type": "object", "required": [ "team_id", "wrapped_team_dek", "old_wrapped_team_dek" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "wrapped_team_dek": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "old_wrapped_team_dek": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" } } } }, "reauth_token": { "type": "string", "description": "from POST /auth/opaque/reauth/finish for this session and purpose" }, "credential_id": { "type": "string", "format": "uuid", "description": "from POST /auth/opaque/register/start under a session ticket" }, "record": { "type": "string", "description": "the OPAQUE registration record, 192 bytes base64url" } } }, "ChangePassphraseRevokeIncomplete": { "title": "ChangePassphraseRevokeIncomplete", "type": "object", "required": [ "error", "password_changed", "revoke_failed" ], "properties": { "error": { "const": "credential_changed_revoke_incomplete" }, "password_changed": { "const": true }, "revoke_failed": { "type": "array", "items": { "type": "string" } }, "detail": { "type": "string" }, "password_rotated": { "type": "boolean" }, "memberships_rewrapped": { "type": "integer" } }, "description": "the credential change is committed but not every session or token could be revoked; repeat the change" }, "ChangePassphraseRewrapFailed": { "title": "ChangePassphraseRewrapFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "membership_rewrap_partial (team_ids), membership_rewrap_failed" }, "detail": { "type": "string" }, "team_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "ChangePassphraseUnavailable": { "title": "ChangePassphraseUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "opaque_unavailable" }, "detail": { "type": "string" } } }, "CliApproveBadRequest": { "title": "CliApproveBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value (field), cli_team_required, invalid_body" }, "field": { "type": "string" } } }, "CliApproveDecided": { "title": "CliApproveDecided", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "cli_code_already_decided" } } }, "CliApproveExpired": { "title": "CliApproveExpired", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "cli_code_expired" } } }, "CliApproveForbidden": { "title": "CliApproveForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "team_membership_required, cli_step_up_required, cli_step_up_invalid, cli_tenant_required, or csrf_token mismatch" }, "same_network": { "const": false } } }, "CliApproveNotFound": { "title": "CliApproveNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "cli_code_invalid, team_not_found" } } }, "CliApproveRequest": { "title": "CliApproveRequest", "type": "object", "required": [ "user_code", "decision" ], "properties": { "user_code": { "type": "string" }, "decision": { "enum": [ "approve", "deny" ] }, "team_id": { "type": "string", "format": "uuid", "description": "required for a company member, absent for a Solo account" }, "reauth_token": { "type": "string" } } }, "CliCodeDecided": { "title": "CliCodeDecided", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "cli_code_already_decided" } } }, "CliCodeExpired": { "title": "CliCodeExpired", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "cli_code_expired" } } }, "CliCodeInvalid": { "title": "CliCodeInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "cli_code_invalid" } } }, "CliDecision": { "title": "CliDecision", "type": "object", "required": [ "decision" ], "additionalProperties": false, "properties": { "decision": { "enum": [ "approved", "denied" ] } } }, "CliDeviceStartRefused": { "title": "CliDeviceStartRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value, invalid_body" }, "field": { "type": "string" } } }, "CliDeviceStartRequest": { "title": "CliDeviceStartRequest", "type": "object", "properties": { "client_name": { "type": "string" }, "host_label": { "type": "string" } } }, "CliDeviceStarted": { "title": "CliDeviceStarted", "type": "object", "required": [ "device_code", "user_code", "expires_in", "interval", "verification_uri_path" ], "properties": { "device_code": { "type": "string" }, "user_code": { "type": "string", "description": "formatted for typing" }, "expires_in": { "type": "integer" }, "interval": { "type": "integer", "description": "seconds between polls" }, "verification_uri_path": { "const": "/fleet/user/cli" }, "verification_uri": { "type": "string" }, "verification_uri_complete": { "type": "string" } } }, "CliForbidden": { "title": "CliForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "cli_tenant_required, or csrf_token mismatch" } } }, "CliInternal": { "title": "CliInternal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "internal_error, audit_write_failed" } } }, "CliLaunchCreated": { "title": "CliLaunchCreated", "type": "object", "additionalProperties": false, "required": [ "session_id", "team_id", "user_id", "host_id", "agent", "mcp_url", "spawn_token", "spawn_token_expires_at", "heartbeat_interval_sec", "agent_auth_policy", "e2e_mode" ], "properties": { "session_id": { "type": "string", "format": "uuid" }, "team_id": { "type": "string", "format": "uuid" }, "user_id": { "type": "string", "format": "uuid" }, "host_id": { "type": "string", "format": "uuid" }, "agent": { "type": "string" }, "mcp_url": { "type": "string" }, "spawn_token": { "type": "string", "description": "secret" }, "spawn_token_expires_at": {}, "heartbeat_interval_sec": { "type": "integer" }, "agent_auth_policy": { "description": "the policy entry for this agent" }, "e2e_mode": { "type": [ "boolean", "null" ] } } }, "CliLaunchEndRequest": { "title": "CliLaunchEndRequest", "type": "object", "properties": { "exit_code": { "type": [ "integer", "null" ], "minimum": -1, "maximum": 255 } } }, "CliLaunchEnded": { "title": "CliLaunchEnded", "type": "object", "required": [ "session_id", "status", "ended" ], "additionalProperties": false, "properties": { "session_id": { "type": "string", "format": "uuid" }, "status": { "const": "exited" }, "ended": { "type": "boolean" } } }, "CliLaunchHeartbeat": { "title": "CliLaunchHeartbeat", "type": "object", "required": [ "state", "session_id" ], "oneOf": [ { "type": "object", "required": [ "state", "session_id", "expires_at", "heartbeat_interval_sec" ], "properties": { "state": { "const": "running" }, "session_id": { "type": "string", "format": "uuid" }, "expires_at": {}, "heartbeat_interval_sec": { "type": "integer" } } }, { "type": "object", "required": [ "state", "session_id", "reason" ], "properties": { "state": { "const": "killed" }, "session_id": { "type": "string", "format": "uuid" }, "reason": { "type": "string", "description": "for example token_expired, host_not_enrolled, host_team_changed, chain_revoked, team_membership_lost, tenant_blocked" } } } ] }, "CliLaunchHeartbeatRequest": { "title": "CliLaunchHeartbeatRequest", "type": "object" }, "CliLaunchLimit": { "title": "CliLaunchLimit", "type": "object", "required": [ "error", "limit", "max" ], "properties": { "error": { "const": "cli_launch_limit" }, "limit": { "const": "hourly" }, "max": { "type": "integer" } } }, "CliLaunchRequest": { "title": "CliLaunchRequest", "type": "object", "required": [ "agent" ], "properties": { "agent": { "type": "string", "description": "one of the launchable agents; anything else is 400 unknown_agent" }, "host_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "CliLaunchUnavailable": { "title": "CliLaunchUnavailable", "type": "object", "properties": { "error": { "type": "string" }, "detail": { "type": "string" } }, "description": "agent_policy_unavailable or rate_limit_unavailable" }, "CliLookup": { "title": "CliLookup", "type": "object", "required": [ "client_name", "host_label", "created_at", "expires_at", "solo", "same_network" ], "properties": { "client_name": { "type": [ "string", "null" ] }, "host_label": { "type": [ "string", "null" ] }, "request_ip": { "type": [ "string", "null" ] }, "user_agent": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time" }, "solo": { "type": "boolean" }, "same_network": { "type": "boolean", "description": "false: approving needs a re-authentication" } } }, "CliLookupBadBody": { "title": "CliLookupBadBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_body" } } }, "CliLookupRequest": { "title": "CliLookupRequest", "type": "object", "required": [ "user_code" ], "properties": { "user_code": { "type": "string" } } }, "CliPayloadTooLarge": { "title": "CliPayloadTooLarge", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "payload_too_large" } } }, "CliPayloadTooLarge2": { "title": "CliPayloadTooLarge2", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "payload_too_large" } } }, "CliPayloadTooLarge3": { "title": "CliPayloadTooLarge3", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "payload_too_large" } } }, "CliPayloadTooLarge4": { "title": "CliPayloadTooLarge4", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "payload_too_large" } } }, "CliPolicy": { "title": "CliPolicy", "type": "object", "additionalProperties": false, "required": [ "team_id", "agents", "allowed_agents", "forbidden_by", "company_allowed_agents", "team_allowed_agents", "agent_auth_policy" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "agents": { "type": "array", "items": { "type": "string" } }, "allowed_agents": { "type": "array", "items": { "type": "string" } }, "forbidden_by": { "type": "object", "additionalProperties": { "enum": [ "company", "team" ] }, "description": "agent -> the level whose policy forbids it" }, "company_allowed_agents": { "type": [ "array", "null" ], "items": { "type": "string" } }, "team_allowed_agents": { "type": [ "array", "null" ], "items": { "type": "string" } }, "agent_auth_policy": { "type": "object" } } }, "CliRateLimitUnavailable": { "title": "CliRateLimitUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "rate_limit_unavailable" } } }, "CliRateLimitUnavailable2": { "title": "CliRateLimitUnavailable2", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "rate_limit_unavailable" } } }, "CliRateLimited": { "title": "CliRateLimited", "type": "object", "required": [ "error", "retry_after_ms" ], "properties": { "error": { "type": "string" }, "retry_after_ms": { "type": "integer" } }, "description": "Retry-After is set" }, "CliRefreshRefused": { "title": "CliRefreshRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_cli_refresh_token, cli_refresh_already_used, cli_token_expired, cli_token_revoked" }, "limit": { "enum": [ "chain_absolute", "refresh_idle" ] }, "reuse_detected": { "type": "boolean" } } }, "CliRevoked": { "title": "CliRevoked", "type": "object", "required": [ "revoked" ], "additionalProperties": false, "properties": { "revoked": { "type": "boolean", "description": "false when the token was unknown or already ended" } } }, "CliSessionList": { "title": "CliSessionList", "type": "object", "required": [ "sessions" ], "additionalProperties": false, "properties": { "sessions": { "type": "array", "maxItems": 200, "items": { "type": "object", "required": [ "chain_id", "created_at" ], "properties": { "chain_id": { "type": "string", "format": "uuid" }, "client_name": { "type": [ "string", "null" ] }, "host_label": { "type": [ "string", "null" ] }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "last_used_at": { "type": [ "string", "null" ], "format": "date-time" }, "expires_at": { "type": [ "string", "null" ], "format": "date-time" } } } } } }, "CliSessionNotFound": { "title": "CliSessionNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "cli_session_not_found" } } }, "CliSessionRevoked": { "title": "CliSessionRevoked", "type": "object", "required": [ "chain_id", "revoked" ], "additionalProperties": false, "properties": { "chain_id": { "type": "string", "format": "uuid" }, "revoked": { "type": "integer", "description": "tokens ended" } } }, "CliTenantGateRefusal": { "title": "CliTenantGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } }, "description": "the tenant gate's refusal (suspended company, licence read-only), as tenant-gate.js wrote it; 503 carries Retry-After" }, "CliTokenPair": { "title": "CliTokenPair", "type": "object", "required": [ "token_type", "access_token", "access_expires_at", "expires_in", "refresh_token", "refresh_expires_at" ], "additionalProperties": false, "properties": { "token_type": { "const": "Bearer" }, "access_token": { "type": "string" }, "access_expires_at": { "type": "string", "format": "date-time" }, "expires_in": { "type": "integer", "description": "seconds" }, "refresh_token": { "type": "string" }, "refresh_expires_at": { "type": "string", "format": "date-time" } }, "description": "the credentials are secret and shown once; answered with Cache-Control no-store" }, "CliTokenPairRefreshed": { "title": "CliTokenPairRefreshed", "type": "object", "required": [ "token_type", "access_token", "access_expires_at", "expires_in", "refresh_token", "refresh_expires_at" ], "additionalProperties": false, "properties": { "token_type": { "const": "Bearer" }, "access_token": { "type": "string" }, "access_expires_at": { "type": "string", "format": "date-time" }, "expires_in": { "type": "integer", "description": "seconds" }, "refresh_token": { "type": "string" }, "refresh_expires_at": { "type": "string", "format": "date-time" } }, "description": "the credentials are secret and shown once; answered with Cache-Control no-store" }, "CliTokenPending": { "title": "CliTokenPending", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "authorization_pending, slow_down, access_denied, expired_token, invalid_device_code, invalid_body" }, "interval": { "type": "integer" } } }, "CliTokenPollRequest": { "title": "CliTokenPollRequest", "type": "object", "required": [ "device_code" ], "properties": { "device_code": { "type": "string" } } }, "CliUnauthorized": { "title": "CliUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized" } } }, "ClientCertIssued": { "title": "ClientCertIssued", "type": "object", "required": [ "cert", "ca", "fingerprint" ], "additionalProperties": false, "properties": { "cert": { "type": "string", "description": "PEM leaf" }, "ca": { "type": "string", "description": "PEM CA" }, "fingerprint": { "type": "string" } } }, "ClientCertRequest": { "title": "ClientCertRequest", "type": "object", "required": [ "csr" ], "properties": { "csr": { "type": "string", "description": "PEM certificate request" } } }, "ClientCertUnauthorized": { "title": "ClientCertUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "ClientTokenCreateRequest": { "title": "ClientTokenCreateRequest", "type": "object", "properties": { "label": { "type": "string" }, "policy": { "title": "ClientTokenPolicy", "type": "object", "additionalProperties": false, "description": "what a device token may do; every field defaults to allowed, {} allows all five", "properties": { "vault": { "type": "object", "additionalProperties": false, "properties": { "read": { "type": "boolean" }, "write": { "type": "boolean" } } }, "secrets": { "type": "object", "additionalProperties": false, "properties": { "read": { "type": "boolean" }, "write": { "type": "boolean" }, "delete": { "type": "boolean" } } } } }, "user_id": { "type": "string", "format": "uuid", "description": "a user of the company, owner or admin only; the fleet admin bearer names company_id and user_id" }, "company_id": { "type": "string", "format": "uuid", "description": "fleet admin bearer only" } } }, "ClientTokenCreated": { "title": "ClientTokenCreated", "type": "object", "required": [ "id", "client_token" ], "additionalProperties": false, "properties": { "id": { "type": "string", "pattern": "^cli_[0-9a-f]{24}$" }, "client_token": { "type": "string", "description": "sct_..., shown once" } } }, "ClientTokenList": { "title": "ClientTokenList", "type": "object", "required": [ "clients" ], "additionalProperties": false, "properties": { "clients": { "type": "array", "items": { "type": "object", "required": [ "id", "company_id", "user_id", "policy", "created_at" ], "properties": { "id": { "type": "string", "pattern": "^cli_[0-9a-f]{24}$" }, "company_id": { "type": [ "string", "null" ], "format": "uuid" }, "user_id": { "type": "string", "format": "uuid" }, "label": { "type": [ "string", "null" ] }, "policy": { "type": "object" }, "created_at": { "type": "string", "format": "date-time" }, "last_used": { "type": [ "string", "null" ], "format": "date-time" }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" } } } } } }, "ClientTokenPolicyRequest": { "title": "ClientTokenPolicyRequest", "type": "object", "properties": { "policy": { "title": "ClientTokenPolicy", "type": "object", "additionalProperties": false, "description": "what a device token may do; every field defaults to allowed, {} allows all five", "properties": { "vault": { "type": "object", "additionalProperties": false, "properties": { "read": { "type": "boolean" }, "write": { "type": "boolean" } } }, "secrets": { "type": "object", "additionalProperties": false, "properties": { "read": { "type": "boolean" }, "write": { "type": "boolean" }, "delete": { "type": "boolean" } } } } } } }, "ClientTokenRefusal": { "title": "ClientTokenRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "ClientTokenRevoked": { "title": "ClientTokenRevoked", "type": "object", "required": [ "revoked" ], "additionalProperties": false, "properties": { "revoked": { "type": "string", "description": "the token id" } } }, "ClientTokenUpdated": { "title": "ClientTokenUpdated", "type": "object", "required": [ "updated" ], "additionalProperties": false, "properties": { "updated": { "type": "string", "description": "the token id" } } }, "CompanyEraseRequest": { "title": "CompanyEraseRequest", "type": "object", "properties": { "totp_code": { "type": "string", "description": "step-up: the current TOTP code" }, "recovery_code": { "type": "string", "description": "step-up: a recovery code instead of totp_code" } }, "description": "the step-up proof" }, "CompanyErased": { "title": "CompanyErased", "type": "object", "required": [ "ok", "deleted" ], "properties": { "ok": { "const": true }, "deleted": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "slug": { "type": "string" } } }, "keys_purged": { "description": "what the key purge removed (counts)" }, "services_purged": { "description": "what the service purges removed" } } }, "CompanyMe": { "title": "CompanyMe", "type": "object", "required": [ "id", "name", "status", "e2e_mode" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "slug": { "type": "string" }, "tier": { "type": [ "string", "null" ] }, "status": { "type": "string" }, "master_pubkey": { "type": "null", "description": "always null; kept for old clients" }, "master_kdf_salt": { "type": "null" }, "created_at": { "type": "string", "format": "date-time" }, "e2e_mode": { "enum": [ "on", "off" ] } } }, "CompanyNotFound": { "title": "CompanyNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "company_not_found" }, "detail": { "type": "string" } } }, "CompanyRegisterRetired": { "title": "CompanyRegisterRetired", "type": "object", "required": [ "error", "detail" ], "properties": { "error": { "const": "retired" }, "detail": { "type": "string" } } }, "CompanyRegistered": { "title": "CompanyRegistered", "type": "object", "required": [ "company_id", "user_id", "team_id", "plan", "status" ], "additionalProperties": false, "properties": { "company_id": { "type": "string", "format": "uuid" }, "user_id": { "type": "string", "format": "uuid" }, "team_id": { "type": "string", "format": "uuid" }, "plan": { "type": "string" }, "status": { "const": "active" } } }, "CompanySessionsRevoked": { "title": "CompanySessionsRevoked", "type": "object", "required": [ "company_id", "trigger", "users", "revoked", "kept_session_id", "other_replicas_within_s", "audit_recorded", "caller_session_kept", "detail" ], "properties": { "company_id": { "type": "string", "format": "uuid" }, "trigger": { "type": "string" }, "users": { "type": "integer", "description": "people of the company whose sessions were ended" }, "revoked": { "type": "object", "required": [ "sessions", "signing_tokens", "client_tokens", "cli_tokens", "oauth_grants" ], "properties": { "sessions": { "type": "integer" }, "signing_tokens": { "type": "integer" }, "client_tokens": { "type": "integer" }, "cli_tokens": { "type": "integer" }, "oauth_grants": { "type": "integer" } } }, "kept_session_id": { "type": [ "string", "null" ], "format": "uuid", "description": "the session that made the request, kept" }, "other_replicas_within_s": { "type": "integer", "description": "other api replicas drop their cached sessions within this many seconds" }, "audit_recorded": { "const": true }, "caller_session_kept": { "type": "boolean" }, "detail": { "type": "string" } } }, "CostBurnrate": { "title": "CostBurnrate", "type": "object", "required": [ "scope", "days", "points", "totals", "projection" ], "additionalProperties": false, "properties": { "scope": { "type": "string" }, "days": { "type": "integer" }, "points": { "type": "array", "items": { "type": "object", "required": [ "bucket", "usd", "msgs" ], "additionalProperties": false, "properties": { "bucket": { "type": "string", "format": "date-time" }, "usd": { "type": "number" }, "msgs": { "type": "integer" } } } }, "totals": { "type": "object", "required": [ "month", "projected_month" ], "additionalProperties": false, "properties": { "month": { "type": "number" }, "projected_month": { "type": [ "number", "null" ] } } }, "projection": { "type": "object", "required": [ "window_days", "days_elapsed_in_window", "days_remaining", "month_to_date" ], "additionalProperties": false, "properties": { "window_days": { "type": "integer" }, "days_elapsed_in_window": { "type": "integer" }, "days_remaining": { "type": "integer" }, "month_to_date": { "type": "number" } } } } }, "CostExportCsv": { "title": "CostExportCsv", "type": "string", "description": "CSV produced by caldyr-cost; its content-disposition and x-* headers are passed through" }, "CostQuota": { "title": "CostQuota", "type": "object", "additionalProperties": false, "required": [ "id", "company_id", "scope", "period", "cap_usd", "warn_pct", "enabled", "override_role", "cap_mode", "created_by", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid" }, "scope": { "enum": [ "company", "team", "user", "repo" ] }, "scope_ref": { "type": [ "string", "null" ] }, "period": { "enum": [ "daily", "weekly", "monthly", "billing_cycle" ] }, "cap_usd": { "type": [ "string", "number" ], "description": "NUMERIC: a decimal string from the database" }, "warn_pct": { "type": "integer" }, "enabled": { "type": "boolean" }, "override_role": { "enum": [ "owner", "admin" ] }, "cap_mode": { "enum": [ "enforce", "warn", "notify" ] }, "created_by": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } } }, "CostQuotaDisabled": { "title": "CostQuotaDisabled", "type": "object", "required": [ "id", "disabled" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "disabled": { "const": true } } }, "CostQuotaList": { "title": "CostQuotaList", "type": "object", "required": [ "quotas" ], "additionalProperties": false, "properties": { "quotas": { "type": "array", "items": { "title": "CostQuota", "type": "object", "additionalProperties": false, "required": [ "id", "company_id", "scope", "period", "cap_usd", "warn_pct", "enabled", "override_role", "cap_mode", "created_by", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid" }, "scope": { "enum": [ "company", "team", "user", "repo" ] }, "scope_ref": { "type": [ "string", "null" ] }, "period": { "enum": [ "daily", "weekly", "monthly", "billing_cycle" ] }, "cap_usd": { "type": [ "string", "number" ], "description": "NUMERIC: a decimal string from the database" }, "warn_pct": { "type": "integer" }, "enabled": { "type": "boolean" }, "override_role": { "enum": [ "owner", "admin" ] }, "cap_mode": { "enum": [ "enforce", "warn", "notify" ] }, "created_by": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } } } } } }, "CostQuotaOverride": { "title": "CostQuotaOverride", "type": "object", "additionalProperties": false, "required": [ "id", "quota_id", "company_id", "bump_usd", "reason", "granted_by", "granted_at", "expires_at", "revoked_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "quota_id": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid" }, "bump_usd": { "type": [ "string", "number" ], "description": "NUMERIC: a decimal string from the database" }, "reason": { "type": "string" }, "granted_by": { "type": "string", "format": "uuid" }, "granted_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time" }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "CostQuotaOverrideRequest": { "title": "CostQuotaOverrideRequest", "type": "object", "required": [ "bump_usd", "expires_at", "reason" ], "properties": { "bump_usd": { "type": [ "number", "string" ], "description": "more than 0 and at most 100000; read with parseFloat" }, "expires_at": { "type": "string", "format": "date-time", "description": "in the future" }, "reason": { "type": "string", "minLength": 3, "description": "at least 3 characters after trimming" } } }, "CostQuotaOverrideRevoked": { "title": "CostQuotaOverrideRevoked", "type": "object", "required": [ "revoked", "id" ], "additionalProperties": false, "properties": { "revoked": { "const": true }, "id": { "type": "string", "format": "uuid" } } }, "CostQuotaUsage": { "title": "CostQuotaUsage", "type": "object", "required": [ "quota", "enabled", "applied", "used_usd", "override_bump_usd", "effective_cap_usd", "period_start" ], "additionalProperties": false, "properties": { "quota": { "title": "CostQuota", "type": "object", "additionalProperties": false, "required": [ "id", "company_id", "scope", "period", "cap_usd", "warn_pct", "enabled", "override_role", "cap_mode", "created_by", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid" }, "scope": { "enum": [ "company", "team", "user", "repo" ] }, "scope_ref": { "type": [ "string", "null" ] }, "period": { "enum": [ "daily", "weekly", "monthly", "billing_cycle" ] }, "cap_usd": { "type": [ "string", "number" ], "description": "NUMERIC: a decimal string from the database" }, "warn_pct": { "type": "integer" }, "enabled": { "type": "boolean" }, "override_role": { "enum": [ "owner", "admin" ] }, "cap_mode": { "enum": [ "enforce", "warn", "notify" ] }, "created_by": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } } }, "enabled": { "type": "boolean" }, "applied": { "type": "boolean", "description": "same as enabled" }, "used_usd": { "type": "number" }, "override_bump_usd": { "type": "number" }, "effective_cap_usd": { "type": "number" }, "period_start": { "type": "string", "format": "date-time" } } }, "CspReport": { "title": "CspReport", "type": [ "object", "array" ], "description": "report-uri { \"csp-report\": {...} } or report-to [{ body: {...} }]; up to 64 KiB, read leniently" }, "CsrfOrCompanyRefusal": { "title": "CsrfOrCompanyRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "CsrfRefusal": { "title": "CsrfRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "DeleteAuthWebauthnCredentialsCredentialIdResponse200": { "type": "object", "required": [ "ok" ], "properties": { "ok": { "type": "boolean" }, "sessions_revoked": { "type": [ "integer", "null" ] } } }, "DemoRequestApproveRequest": { "title": "DemoRequestApproveRequest", "type": "object", "required": [], "properties": { "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "company_id": { "type": [ "string", "null" ], "format": "uuid" }, "role_in_team": { "enum": [ "admin", "member", "viewer" ], "default": "member" } } }, "DemoRequestApproved": { "title": "DemoRequestApproved", "type": "object", "required": [ "mode", "delivery" ], "properties": { "mode": { "enum": [ "signup", "invite" ] }, "signup_url": { "type": "string" }, "invite_url": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" }, "delivery": { "type": "object", "required": [ "status" ], "properties": { "status": { "enum": [ "queued", "failed" ] }, "outbox_id": { "type": [ "string", "null" ], "format": "uuid" }, "locale": { "type": "string" }, "error": { "enum": [ "enqueue_failed", "duplicate", "invalid_address" ] } } } } }, "DemoRequestCreateRequest": { "title": "DemoRequestCreateRequest", "type": "object", "required": [ "email" ], "properties": { "email": { "type": "string", "description": "one mailbox" }, "company_name": { "type": "string" }, "notes": { "type": "string" }, "tier": { "enum": [ "solo", "team", "enterprise" ] }, "locale": { "type": "string" } } }, "DemoRequestCreated": { "title": "DemoRequestCreated", "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" } } }, "DemoRequestList": { "title": "DemoRequestList", "type": "object", "required": [ "requests" ], "additionalProperties": false, "properties": { "requests": { "type": "array", "items": { "type": "object", "required": [ "id", "email", "status", "created_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "email": { "type": "string" }, "company_name": { "type": [ "string", "null" ] }, "notes": { "type": [ "string", "null" ] }, "tier": { "type": [ "string", "null" ] }, "status": { "enum": [ "pending", "approved", "rejected" ] }, "created_at": { "type": "string", "format": "date-time" }, "reviewed_at": { "type": [ "string", "null" ], "format": "date-time" } } } } } }, "DevSeatForbidden": { "title": "DevSeatForbidden", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "no_tenant", "company_admin_required" ] } } }, "DevSeatList": { "title": "DevSeatList", "type": "object", "required": [ "dev_seats", "used", "limit", "hard_cap", "window_days" ], "additionalProperties": false, "properties": { "dev_seats": { "type": "array", "items": { "type": "object", "required": [ "user_id", "email", "consumed_at", "last_launch_at", "revoked_at", "revoked_by", "held" ], "additionalProperties": false, "properties": { "user_id": { "type": "string", "format": "uuid" }, "email": { "type": [ "string", "null" ], "description": "null when the users row is gone" }, "consumed_at": { "type": "string", "format": "date-time" }, "last_launch_at": { "type": "string", "format": "date-time" }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" }, "revoked_by": { "type": [ "string", "null" ], "format": "uuid" }, "held": { "type": "boolean", "description": "not revoked and launched within window_days" } } }, "description": "the company's seat rows, latest launch first" }, "used": { "type": "integer", "description": "seats held now" }, "limit": { "type": [ "integer", "null" ], "description": "the entitlements document's dev_seats; null = unlimited" }, "hard_cap": { "type": [ "integer", "null" ], "description": "limit plus the tier's overage; null = unlimited" }, "window_days": { "type": "integer", "description": "a seat lapses after this many days without a launch" } } }, "DevSeatListFailed": { "title": "DevSeatListFailed", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "internal_error" ] } } }, "DevSeatNotRevoked": { "title": "DevSeatNotRevoked", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "dev_seat_not_revoked" ] } }, "description": "no revoked seat of that person in the caller's company" }, "DevSeatRestored": { "title": "DevSeatRestored", "type": "object", "required": [ "user_id", "restored" ], "additionalProperties": false, "properties": { "user_id": { "type": "string", "format": "uuid" }, "restored": { "const": true } } }, "DevSeatRevoked": { "title": "DevSeatRevoked", "type": "object", "required": [ "user_id", "revoked", "already", "revoked_at", "ended_launches" ], "additionalProperties": false, "properties": { "user_id": { "type": "string", "format": "uuid" }, "revoked": { "const": true }, "already": { "type": "boolean" }, "revoked_at": { "type": "string", "format": "date-time" }, "ended_launches": { "type": "integer" } } }, "DevSeatUserNotFound": { "title": "DevSeatUserNotFound", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "user_not_found" ] } }, "description": "not a person of the caller's company" }, "DevSeatWriteFailed": { "title": "DevSeatWriteFailed", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "internal_error", "audit_write_failed" ] } } }, "DeviceSession": { "title": "DeviceSession", "type": "object", "required": [ "session_token", "expires_at", "ttl", "policy" ], "additionalProperties": false, "properties": { "session_token": { "type": "string", "description": "sst_..., stateless and signed" }, "expires_at": { "type": "string", "format": "date-time" }, "ttl": { "type": "integer", "description": "seconds" }, "policy": { "type": "object" } } }, "DeviceSessionRefused": { "title": "DeviceSessionRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized" } } }, "E2eApproverKeyPublished": { "title": "E2eApproverKeyPublished", "type": "object", "required": [ "approver_pubkey", "changed" ], "additionalProperties": false, "properties": { "approver_pubkey": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "changed": { "type": "boolean", "description": "false when the key was already published" } } }, "E2eApproverKeyRequest": { "title": "E2eApproverKeyRequest", "type": "object", "required": [ "approver_pubkey" ], "properties": { "approver_pubkey": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$", "description": "Ed25519 public key, 64 hex characters" } } }, "E2eApproverKeys": { "title": "E2eApproverKeys", "type": "object", "required": [ "team_id", "approvers" ], "additionalProperties": false, "properties": { "team_id": { "type": "string", "format": "uuid" }, "approvers": { "type": "array", "items": { "type": "object", "required": [ "user_id", "email", "display_name", "role", "approver_pubkey" ], "additionalProperties": false, "properties": { "user_id": { "type": "string", "format": "uuid" }, "email": { "type": "string" }, "display_name": { "type": [ "string", "null" ] }, "role": { "enum": [ "admin", "member" ] }, "approver_pubkey": { "type": [ "string", "null" ], "description": "null until the member publishes a key" } } } } } }, "E2eConsentGiven": { "title": "E2eConsentGiven", "type": "object", "required": [ "e2e_mode", "changed", "switch_on" ], "additionalProperties": false, "properties": { "e2e_mode": { "const": "on" }, "changed": { "type": "boolean", "description": "false when the consent was already given" }, "switch_on": { "title": "E2eSwitchOnProgress", "type": [ "object", "null" ], "description": "the stored state of the switch-on; null while the mode is off", "properties": { "enabled_at": { "type": "string", "format": "date-time" }, "enabled_by": { "type": [ "string", "null" ], "format": "uuid" }, "state": { "enum": [ "migrating", "complete" ], "description": "complete when every kind is done or retained" }, "consent": { "type": "object" }, "keys_removed": { "type": [ "boolean", "null" ] }, "completed_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_run_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_error": { "type": [ "string", "null" ] }, "reseal_deadline_days": { "const": 30 }, "reseal_deadline_at": { "type": [ "string", "null" ], "format": "date-time", "description": "null without the unresealed consent" }, "kinds": { "type": "array", "items": { "type": "object", "required": [ "kind", "how", "state" ], "additionalProperties": false, "properties": { "kind": { "enum": [ "transcript", "replay_keyframe", "session_meta", "team_blob", "kb_note", "kb_index", "secret", "workflow_definition", "workflow_result", "instruction_layer", "skill_bundle", "mcp_config", "custody_dek", "custody_custodian" ] }, "how": { "enum": [ "consent", "server_delete", "reseal", "key_purge", "not_tracked" ] }, "state": { "type": "string", "description": "pending, done, retained, unavailable or not_tracked" }, "remaining": { "type": [ "integer", "null" ] }, "detail": { "type": [ "object", "null" ] }, "checked_at": { "type": [ "string", "null" ], "format": "date-time" }, "done_at": { "type": [ "string", "null" ], "format": "date-time" } } } } } } } }, "E2eConsentRequest": { "title": "E2eConsentRequest", "type": "object", "required": [ "consent" ], "properties": { "consent": { "type": "object", "required": [ "unresealed" ], "additionalProperties": false, "properties": { "unresealed": { "const": "delete" } } }, "totp_code": { "type": "string", "description": "step-up: the current TOTP code" }, "recovery_code": { "type": "string", "description": "step-up: a recovery code instead of totp_code" } } }, "E2eHolders": { "title": "E2eHolders", "type": "object", "required": [ "scope_kind", "scope_id", "versions", "pending_rotation" ], "additionalProperties": false, "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "versions": { "type": "array", "description": "newest first", "items": { "type": "object", "required": [ "key_version", "state", "created_at", "users", "hosts", "tokens" ], "properties": { "key_version": { "type": "integer" }, "state": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "users": { "type": "integer" }, "hosts": { "type": "integer" }, "tokens": { "type": "integer" } } } }, "pending_rotation": { "type": [ "object", "null" ], "properties": { "reason": { "type": "string" }, "requested_at": { "type": "string", "format": "date-time" } } } } }, "E2eKeyCreateRequest": { "title": "E2eKeyCreateRequest", "type": "object", "required": [ "scope_kind", "scope_id", "wraps" ], "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "wraps": { "type": "array", "maxItems": 5000, "description": "one wrap per recipient", "items": { "type": "object", "required": [ "recipient_kind", "recipient_id", "wrapped_key" ], "properties": { "recipient_kind": { "enum": [ "user", "host", "token" ] }, "recipient_id": { "type": "string", "format": "uuid", "description": "a user id, a host id or an integration-token chain id" }, "wrapped_key": { "type": "string", "pattern": "^[0-9a-fA-F]{184}$", "description": "92 bytes as hex" } } } } } }, "E2eKeyCreated": { "title": "E2eKeyCreated", "type": "object", "required": [ "scope_kind", "scope_id", "key_version", "wraps" ], "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "key_version": { "type": "integer" }, "wraps": { "type": "integer" }, "completed_rotation": { "type": [ "boolean", "object", "null" ], "description": "the rotation this version completed, if any" } } }, "E2eKeyRefusal": { "title": "E2eKeyRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value (with detail), e2e_wraps_required, e2e_recipient_kind, e2e_recipient_unknown, e2e_key_version_unknown, e2e_scope_not_found, e2e_service_user_refused, e2e_key_version_conflict, forbidden, internal_error" }, "detail": { "type": "string" } } }, "E2eKeyWrapsAdded": { "title": "E2eKeyWrapsAdded", "type": "object", "required": [ "inserted", "existing" ], "additionalProperties": false, "properties": { "inserted": { "type": "integer" }, "existing": { "type": "integer" } } }, "E2eKeyWrapsRequest": { "title": "E2eKeyWrapsRequest", "type": "object", "required": [ "scope_kind", "scope_id", "wraps" ], "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "wraps": { "type": "array", "minItems": 1, "maxItems": 5000, "items": { "type": "object", "required": [ "key_version", "recipient_kind", "recipient_id", "wrapped_key" ], "properties": { "key_version": { "type": "integer", "minimum": 1 }, "recipient_kind": { "enum": [ "user", "host", "token" ] }, "recipient_id": { "type": "string", "format": "uuid", "description": "a user id, a host id or an integration-token chain id" }, "wrapped_key": { "type": "string", "pattern": "^[0-9a-fA-F]{184}$", "description": "92 bytes as hex" } } } } } }, "E2eKeysList": { "title": "E2eKeysList", "type": "object", "required": [ "keys", "pending_rotations" ], "additionalProperties": false, "properties": { "keys": { "type": "array", "items": { "type": "object", "required": [ "scope_kind", "scope_id", "key_version", "state", "wrapped_key" ], "additionalProperties": false, "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "key_version": { "type": "integer" }, "state": { "type": "string" }, "wrapped_key": { "type": "string", "pattern": "^[0-9a-f]+$" } } } }, "pending_rotations": { "type": "array", "items": { "type": "object", "required": [ "scope_kind", "scope_id", "reason", "requested_at" ], "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "reason": { "enum": [ "member_removed", "host_unenrolled", "token_revoked", "manual" ] }, "requested_at": { "type": "string", "format": "date-time" } } } } } }, "E2eMigrationBusy": { "title": "E2eMigrationBusy", "type": "object", "required": [ "busy" ], "additionalProperties": false, "properties": { "busy": { "const": true } }, "description": "another pass holds the lock" }, "E2eMigrationStep": { "title": "E2eMigrationStep", "type": "object", "required": [ "e2e_mode", "switch_on" ], "additionalProperties": false, "properties": { "e2e_mode": { "const": "on" }, "switch_on": { "title": "E2eSwitchOnProgress", "type": [ "object", "null" ], "description": "the stored state of the switch-on; null while the mode is off", "properties": { "enabled_at": { "type": "string", "format": "date-time" }, "enabled_by": { "type": [ "string", "null" ], "format": "uuid" }, "state": { "enum": [ "migrating", "complete" ], "description": "complete when every kind is done or retained" }, "consent": { "type": "object" }, "keys_removed": { "type": [ "boolean", "null" ] }, "completed_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_run_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_error": { "type": [ "string", "null" ] }, "reseal_deadline_days": { "const": 30 }, "reseal_deadline_at": { "type": [ "string", "null" ], "format": "date-time", "description": "null without the unresealed consent" }, "kinds": { "type": "array", "items": { "type": "object", "required": [ "kind", "how", "state" ], "additionalProperties": false, "properties": { "kind": { "enum": [ "transcript", "replay_keyframe", "session_meta", "team_blob", "kb_note", "kb_index", "secret", "workflow_definition", "workflow_result", "instruction_layer", "skill_bundle", "mcp_config", "custody_dek", "custody_custodian" ] }, "how": { "enum": [ "consent", "server_delete", "reseal", "key_purge", "not_tracked" ] }, "state": { "type": "string", "description": "pending, done, retained, unavailable or not_tracked" }, "remaining": { "type": [ "integer", "null" ] }, "detail": { "type": [ "object", "null" ] }, "checked_at": { "type": [ "string", "null" ], "format": "date-time" }, "done_at": { "type": [ "string", "null" ], "format": "date-time" } } } } } } } }, "E2eModeState": { "title": "E2eModeState", "type": "object", "required": [ "e2e_mode", "switch_on" ], "additionalProperties": false, "properties": { "e2e_mode": { "enum": [ "on", "off" ] }, "preconditions": { "type": "object", "required": [ "ok", "blockers" ], "additionalProperties": false, "properties": { "ok": { "type": "boolean" }, "blockers": { "type": "array", "items": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string", "description": "company_key_missing, team_key_missing, recipients_without_wrap, rotation_pending, members_without_key, server_escrow_enabled or server_escrow_requested" }, "scope_kind": { "enum": [ "company", "team" ] }, "scope_id": { "type": "string", "format": "uuid" }, "key_version": { "type": "integer" }, "users": { "type": "integer" }, "hosts": { "type": "integer" }, "tokens": { "type": "integer" }, "reason": { "type": "string" }, "requests": { "type": "integer" } } } } }, "description": "only while off" }, "consent": { "type": "array", "description": "only while off: the consents the switch asks for", "items": { "type": "object", "required": [ "kind", "choices", "required", "legacy" ], "properties": { "kind": { "enum": [ "transcript", "kb_note", "unresealed" ] }, "choices": { "type": "array", "items": { "type": "string" } }, "required": { "type": "boolean" }, "legacy": { "type": [ "integer", "null" ] }, "kinds": { "type": "array", "items": { "type": "string" } }, "days": { "type": "integer" } } } }, "switch_on": { "title": "E2eSwitchOnProgress", "type": [ "object", "null" ], "description": "the stored state of the switch-on; null while the mode is off", "properties": { "enabled_at": { "type": "string", "format": "date-time" }, "enabled_by": { "type": [ "string", "null" ], "format": "uuid" }, "state": { "enum": [ "migrating", "complete" ], "description": "complete when every kind is done or retained" }, "consent": { "type": "object" }, "keys_removed": { "type": [ "boolean", "null" ] }, "completed_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_run_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_error": { "type": [ "string", "null" ] }, "reseal_deadline_days": { "const": 30 }, "reseal_deadline_at": { "type": [ "string", "null" ], "format": "date-time", "description": "null without the unresealed consent" }, "kinds": { "type": "array", "items": { "type": "object", "required": [ "kind", "how", "state" ], "additionalProperties": false, "properties": { "kind": { "enum": [ "transcript", "replay_keyframe", "session_meta", "team_blob", "kb_note", "kb_index", "secret", "workflow_definition", "workflow_result", "instruction_layer", "skill_bundle", "mcp_config", "custody_dek", "custody_custodian" ] }, "how": { "enum": [ "consent", "server_delete", "reseal", "key_purge", "not_tracked" ] }, "state": { "type": "string", "description": "pending, done, retained, unavailable or not_tracked" }, "remaining": { "type": [ "integer", "null" ] }, "detail": { "type": [ "object", "null" ] }, "checked_at": { "type": [ "string", "null" ], "format": "date-time" }, "done_at": { "type": [ "string", "null" ], "format": "date-time" } } } } } } } }, "E2eRecipients": { "title": "E2eRecipients", "type": "object", "required": [ "users", "hosts", "tokens" ], "additionalProperties": false, "properties": { "users": { "type": "array", "items": { "type": "object", "required": [ "id", "pubkey" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "pubkey": { "type": "string", "pattern": "^[0-9a-f]+$" } } } }, "hosts": { "type": "array", "items": { "type": "object", "required": [ "id", "pubkey" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "pubkey": { "type": "string", "pattern": "^[0-9a-f]+$" } } } }, "tokens": { "type": "array", "items": { "type": "object", "required": [ "id", "pubkey" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "pubkey": { "type": "string", "pattern": "^[0-9a-f]+$" } } } } } }, "E2eSealedRefusal": { "title": "E2eSealedRefusal", "type": "object", "required": [ "error", "hint" ], "properties": { "error": { "const": "e2e_sealed" }, "hint": { "type": "string" } } }, "E2eSwitchOnRefusal": { "title": "E2eSwitchOnRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "enum": [ "e2e_mode_one_way", "e2e_mode_already_on", "e2e_mode_off", "e2e_switch_on_blocked", "e2e_consent_required" ] }, "blockers": { "type": "array", "items": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string", "description": "company_key_missing, team_key_missing, recipients_without_wrap, rotation_pending, members_without_key, server_escrow_enabled or server_escrow_requested" }, "scope_kind": { "enum": [ "company", "team" ] }, "scope_id": { "type": "string", "format": "uuid" }, "key_version": { "type": "integer" }, "users": { "type": "integer" }, "hosts": { "type": "integer" }, "tokens": { "type": "integer" }, "reason": { "type": "string" }, "requests": { "type": "integer" } } } }, "kinds": { "type": "array", "items": { "type": "string" } } } }, "E2eSwitchOnRequest": { "title": "E2eSwitchOnRequest", "type": "object", "required": [ "mode" ], "properties": { "mode": { "const": "on", "description": "off is refused with 409 e2e_mode_one_way" }, "consent": { "type": "object", "additionalProperties": false, "properties": { "transcript": { "enum": [ "delete", "retain" ], "description": "what to do with transcripts recorded before the switch" }, "kb_note": { "const": "delete" }, "unresealed": { "const": "delete", "description": "delete what is not resealed within reseal_deadline_days" } } }, "totp_code": { "type": "string", "description": "step-up: the current TOTP code" }, "recovery_code": { "type": "string", "description": "step-up: a recovery code instead of totp_code" } } }, "E2eSwitchedOn": { "title": "E2eSwitchedOn", "type": "object", "required": [ "e2e_mode", "switch_on" ], "additionalProperties": false, "properties": { "e2e_mode": { "const": "on" }, "switch_on": { "title": "E2eSwitchOnProgress", "type": [ "object", "null" ], "description": "the stored state of the switch-on; null while the mode is off", "properties": { "enabled_at": { "type": "string", "format": "date-time" }, "enabled_by": { "type": [ "string", "null" ], "format": "uuid" }, "state": { "enum": [ "migrating", "complete" ], "description": "complete when every kind is done or retained" }, "consent": { "type": "object" }, "keys_removed": { "type": [ "boolean", "null" ] }, "completed_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_run_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_error": { "type": [ "string", "null" ] }, "reseal_deadline_days": { "const": 30 }, "reseal_deadline_at": { "type": [ "string", "null" ], "format": "date-time", "description": "null without the unresealed consent" }, "kinds": { "type": "array", "items": { "type": "object", "required": [ "kind", "how", "state" ], "additionalProperties": false, "properties": { "kind": { "enum": [ "transcript", "replay_keyframe", "session_meta", "team_blob", "kb_note", "kb_index", "secret", "workflow_definition", "workflow_result", "instruction_layer", "skill_bundle", "mcp_config", "custody_dek", "custody_custodian" ] }, "how": { "enum": [ "consent", "server_delete", "reseal", "key_purge", "not_tracked" ] }, "state": { "type": "string", "description": "pending, done, retained, unavailable or not_tracked" }, "remaining": { "type": [ "integer", "null" ] }, "detail": { "type": [ "object", "null" ] }, "checked_at": { "type": [ "string", "null" ], "format": "date-time" }, "done_at": { "type": [ "string", "null" ], "format": "date-time" } } } } } } } }, "E2eWriteRefusal": { "title": "E2eWriteRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden, or csrf_token mismatch" } } }, "E2eWriteRefusal2": { "title": "E2eWriteRefusal2", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "E2eeAlreadyEnrolled": { "title": "E2eeAlreadyEnrolled", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "already_enrolled" }, "detail": { "type": "string" } } }, "E2eeBlob": { "title": "E2eeBlob", "type": "object", "required": [ "wrapped_master", "kdf_salt", "seed_kdf_salt", "pubkey", "e2ee_enrolled_at", "memberships" ], "additionalProperties": false, "properties": { "wrapped_master": { "type": "string" }, "kdf_salt": { "type": "string" }, "seed_kdf_salt": { "type": [ "string", "null" ] }, "pubkey": { "type": [ "string", "null" ] }, "e2ee_enrolled_at": { "type": [ "string", "null" ], "format": "date-time" }, "memberships": { "type": "array", "items": { "type": "object", "required": [ "team_id", "wrapped_team_dek" ], "additionalProperties": false, "properties": { "team_id": { "type": "string", "format": "uuid" }, "wrapped_team_dek": { "type": "string" } } } } } }, "E2eeBlobMissing": { "title": "E2eeBlobMissing", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "not_enrolled, company_master_wrap_missing" }, "detail": { "type": "string" }, "has_kdf_salt": { "type": "boolean" }, "account": { "enum": [ "company", "solo" ] }, "e2ee_enrolled_at": { "type": [ "string", "null" ], "format": "date-time" }, "e2ee_skipped_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "E2eeEnrolRefused": { "title": "E2eeEnrolRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "previously_skipped" }, "detail": { "type": "string" } } }, "E2eeEnrolled": { "title": "E2eeEnrolled", "type": "object", "required": [ "ok", "enrolled_at" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "enrolled_at": { "type": "string", "format": "date-time" } } }, "E2eeSkipConflict": { "title": "E2eeSkipConflict", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "already_enrolled, already_skipped" }, "detail": { "type": "string" } } }, "E2eeSkipRefused": { "title": "E2eeSkipRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "require_e2ee_policy" }, "detail": { "type": "string" } } }, "E2eeSkipped": { "title": "E2eeSkipped", "type": "object", "required": [ "ok", "skipped_at" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "skipped_at": { "type": "string", "format": "date-time" } } }, "EnrolLimitRefusal": { "title": "EnrolLimitRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "kind": { "type": "string" }, "limit": {}, "current": {} }, "description": "the host or seat cap refusal (status and code come from the cap check)" }, "EnrolTokenInvalid": { "title": "EnrolTokenInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "enrol_token_invalid" } } }, "EnrolTokenList": { "title": "EnrolTokenList", "type": "object", "required": [ "tokens" ], "additionalProperties": false, "properties": { "tokens": { "type": "array", "items": { "type": "object", "required": [ "id", "token_prefix", "label", "created_at", "expires_at", "revoked_at" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "token_prefix": { "type": "string" }, "label": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": [ "string", "null" ], "format": "date-time" }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" } } } } } }, "EnrolTokenMintRequest": { "title": "EnrolTokenMintRequest", "type": "object", "properties": { "label": { "type": "string", "description": "cut to 200 characters" }, "ttl_seconds": { "type": "number", "description": "seconds until expiry; absent = no expiry" } } }, "EnrolTokenMinted": { "title": "EnrolTokenMinted", "type": "object", "required": [ "id", "token", "token_prefix", "expires_at" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "token": { "type": "string", "pattern": "^tok-[0-9a-f]{48}$", "description": "secret" }, "token_prefix": { "type": "string" }, "expires_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "EnrolTokenNotFound": { "title": "EnrolTokenNotFound", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": false } } }, "EnrolTokenRevoked": { "title": "EnrolTokenRevoked", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } } }, "EnrollCodeInvalid": { "title": "EnrollCodeInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_code" } } }, "EnrollRateLimited": { "title": "EnrollRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "retry_after_ms": { "type": "integer" }, "retry_after_seconds": { "type": "integer" } }, "description": "Retry-After is set" }, "EnrollRedeemRequest": { "title": "EnrollRedeemRequest", "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string", "pattern": "^enr_" } } }, "EnrollRedeemed": { "title": "EnrollRedeemed", "type": "object", "required": [ "client_token" ], "additionalProperties": false, "properties": { "client_token": { "type": "string", "description": "sct_..., shown once" }, "hub_url": { "type": "string", "description": "present when the operator set CALDYR_HUB_URL" } } }, "EnrollmentCreateRequest": { "title": "EnrollmentCreateRequest", "type": "object", "properties": { "label": { "type": "string" }, "policy": { "title": "ClientTokenPolicy", "type": "object", "additionalProperties": false, "description": "what a device token may do; every field defaults to allowed, {} allows all five", "properties": { "vault": { "type": "object", "additionalProperties": false, "properties": { "read": { "type": "boolean" }, "write": { "type": "boolean" } } }, "secrets": { "type": "object", "additionalProperties": false, "properties": { "read": { "type": "boolean" }, "write": { "type": "boolean" }, "delete": { "type": "boolean" } } } } }, "user_id": { "type": "string", "format": "uuid" } } }, "EnrollmentCreated": { "title": "EnrollmentCreated", "type": "object", "required": [ "id", "code", "expires_at" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "code": { "type": "string", "pattern": "^enr_", "description": "one-time pairing code" }, "expires_at": { "type": "string", "format": "date-time" } } }, "EnterpriseGateRefusal": { "title": "EnterpriseGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "enterprise_only (422), license_feature_not_included (402), tier_lookup_failed (500), company_admin_required (403), auth_required (401)" }, "feature": { "type": "string" } } }, "EntitlementsCompanyNotFound": { "title": "EntitlementsCompanyNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "company_not_found" } } }, "EntitlementsDocument": { "title": "EntitlementsDocument", "type": "object", "required": [ "state", "tier", "max_hosts", "siem", "features", "source", "customer_id" ], "properties": { "state": { "type": "string", "description": "licence state; plan_limits_base and inert when no licence is held" }, "tier": { "type": [ "string", "null" ] }, "seats": { "type": [ "integer", "null" ] }, "max_hosts": { "type": [ "integer", "null" ] }, "max_sessions": { "type": [ "integer", "null" ] }, "storage_mb": { "type": [ "integer", "null" ] }, "retention_days": { "type": [ "integer", "null" ] }, "siem": { "type": "string", "description": "none, webhook:1 or all" }, "max_siem_destinations": { "type": [ "integer", "null" ] }, "features": { "type": "array", "items": { "type": "string" } }, "trial": { "type": "boolean" }, "expires_at": { "type": [ "string", "null" ], "format": "date-time" }, "grace_until": { "type": [ "string", "null" ], "format": "date-time" }, "source": { "enum": [ "licence", "plan_limits", "none" ] }, "licence_id": { "type": [ "string", "null" ] }, "customer_id": { "type": [ "string", "null" ] }, "reason": { "type": "string", "description": "present without a licence" } }, "description": "the effective entitlements of a company, as scripts/lib/license/entitlements.js resolves them; a licence that cannot be verified is not answered with a document" }, "EntitlementsUnavailable": { "title": "EntitlementsUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "database not ready, entitlements_unavailable" } } }, "ErasureBadRequest": { "title": "ErasureBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "bootstrap_company_protected, or a body-parse code" }, "detail": { "type": "string" } } }, "ErasureCancelBody": { "title": "ErasureCancelBody", "type": "object", "properties": { "totp_code": { "type": "string", "description": "step-up: the current TOTP code" }, "recovery_code": { "type": "string", "description": "step-up: a recovery code instead of totp_code" }, "locale": { "type": "string" } } }, "ErasureCancelled": { "title": "ErasureCancelled", "type": "object", "required": [ "id", "status" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "status": { "const": "cancelled" } } }, "ErasureFailed": { "title": "ErasureFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "erasure_request_failed" }, "detail": { "type": "string" } } }, "ErasureForbidden2": { "title": "ErasureForbidden2", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden" }, "detail": { "type": "string" } } }, "ErasureNotPending": { "title": "ErasureNotPending", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "erasure_not_pending" }, "detail": { "type": "string" } } }, "ErasurePending": { "title": "ErasurePending", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "erasure_pending" }, "detail": { "type": "string" }, "id": { "type": "string", "format": "uuid" } } }, "ErasureQueued": { "title": "ErasureQueued", "type": "object", "required": [ "id", "status", "due_at", "grace_days" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "status": { "const": "queued" }, "due_at": { "type": "string", "format": "date-time" }, "grace_days": { "type": "integer" } } }, "ErasureRequestBody": { "title": "ErasureRequestBody", "type": "object", "properties": { "totp_code": { "type": "string", "description": "step-up: the current TOTP code" }, "recovery_code": { "type": "string", "description": "step-up: a recovery code instead of totp_code" }, "locale": { "type": "string" } }, "description": "the step-up proof" }, "ErasureState": { "title": "ErasureState", "type": "object", "required": [ "request" ], "additionalProperties": false, "properties": { "request": { "type": [ "object", "null" ], "required": [ "id", "status" ], "properties": { "id": { "type": "string", "format": "uuid" }, "status": { "type": "string" }, "requested_at": { "type": "string", "format": "date-time" }, "due_at": { "type": "string", "format": "date-time" }, "grace_days": { "type": "integer" }, "cancelled_at": { "type": [ "string", "null" ], "format": "date-time" }, "finished_at": { "type": [ "string", "null" ], "format": "date-time" }, "error": { "type": [ "string", "null" ] } }, "description": "the latest erasure request of the caller's tenant; null when there is none" } } }, "ErrorBody": { "title": "ErrorBody", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$", "description": "stable snake_case code" }, "detail": { "type": "string" }, "field": { "type": "string", "description": "the offending field, where the handler names it" }, "level": { "type": "string", "description": "sudo_required (A) and stepup_required (B): the step-up level the route needs" } } }, "EscrowApproveRequest": { "title": "EscrowApproveRequest", "type": "object", "properties": { "totp_code": { "type": "string", "description": "step-up: the current TOTP code" }, "recovery_code": { "type": "string", "description": "step-up: a recovery code instead of totp_code" } } }, "EscrowCancelRefused": { "title": "EscrowCancelRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "escrow_request_not_pending" }, "status": { "type": "string" } } }, "EscrowRequestNotPending": { "title": "EscrowRequestNotPending", "type": "object", "required": [ "error" ], "properties": { "error": { "enum": [ "e2e_escrow_refused", "escrow_request_not_pending" ] }, "status": { "type": "string" }, "reason": { "const": "requester_no_longer_admin" } } }, "ExportArchive": { "title": "ExportArchive", "type": "string", "format": "binary", "description": "Content-Disposition attachment caldyr-export-.zip; X-Content-SHA256 carries the digest" }, "ExportExpired": { "title": "ExportExpired", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "export_expired" }, "detail": { "type": "string" } } }, "ExportFailed": { "title": "ExportFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "export_request_failed, export_list_failed, export_download_failed" }, "detail": { "type": "string" } } }, "ExportInProgress": { "title": "ExportInProgress", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "export_in_progress" }, "detail": { "type": "string" }, "id": { "type": "string", "format": "uuid" } } }, "ExportList": { "title": "ExportList", "type": "object", "required": [ "exports" ], "additionalProperties": false, "properties": { "exports": { "type": "array", "maxItems": 50, "items": { "type": "object", "required": [ "id", "owner_kind", "owner_id", "status", "created_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "owner_kind": { "enum": [ "company", "user" ] }, "owner_id": { "type": "string", "format": "uuid" }, "requested_by": { "type": "string", "format": "uuid" }, "status": { "type": "string", "description": "queued, running, done, failed or expired" }, "created_at": { "type": "string", "format": "date-time" }, "started_at": { "type": [ "string", "null" ], "format": "date-time" }, "finished_at": { "type": [ "string", "null" ], "format": "date-time" }, "expires_at": { "type": [ "string", "null" ], "format": "date-time" }, "bytes": { "type": [ "integer", "null" ] }, "sha256": { "type": [ "string", "null" ] }, "manifest": { "type": [ "object", "null" ] }, "error": { "type": [ "string", "null" ] }, "locale": { "type": [ "string", "null" ] } } } } } }, "ExportNotFound": { "title": "ExportNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "export_not_found" }, "detail": { "type": "string" } } }, "ExportNotReady": { "title": "ExportNotReady", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "export_not_ready" }, "detail": { "type": "string" }, "status": { "type": "string" } } }, "ExportQueued": { "title": "ExportQueued", "type": "object", "required": [ "id", "owner_kind", "owner_id", "status", "created_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "owner_kind": { "enum": [ "company", "user" ] }, "owner_id": { "type": "string", "format": "uuid" }, "requested_by": { "type": "string", "format": "uuid" }, "status": { "type": "string", "description": "queued, running, done, failed or expired" }, "created_at": { "type": "string", "format": "date-time" }, "started_at": { "type": [ "string", "null" ], "format": "date-time" }, "finished_at": { "type": [ "string", "null" ], "format": "date-time" }, "expires_at": { "type": [ "string", "null" ], "format": "date-time" }, "bytes": { "type": [ "integer", "null" ] }, "sha256": { "type": [ "string", "null" ] }, "manifest": { "type": [ "object", "null" ] }, "error": { "type": [ "string", "null" ] }, "locale": { "type": [ "string", "null" ] } } }, "ExportRateLimited": { "title": "ExportRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "rate_limited" }, "reason": { "const": "export_daily_cap" }, "limit": { "type": "integer" }, "retry_after_s": { "type": "integer" } }, "description": "Retry-After is set" }, "ExportRequestBody": { "title": "ExportRequestBody", "type": "object", "properties": { "totp_code": { "type": "string" }, "recovery_code": { "type": "string" }, "locale": { "enum": [ "en", "ru", "es", "et", "fi" ] } }, "description": "the step-up proof" }, "ExportUnauthorized": { "title": "ExportUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized" }, "detail": { "type": "string" } } }, "FinalizeE2eeRequest": { "title": "FinalizeE2eeRequest", "type": "object", "required": [ "kdf_salt", "seed_kdf_salt", "wrapped_master", "wrapped_seed_backup", "pubkey" ], "properties": { "kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "16 bytes as hex" }, "seed_kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "16 bytes as hex" }, "wrapped_master": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "wrapped_seed_backup": { "type": "string", "description": "hex, at least 32 bytes" }, "pubkey": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "32 bytes as hex" } } }, "FinalizeMembershipAnswer": { "title": "FinalizeMembershipAnswer", "type": "object", "required": [ "ok", "team_id", "user_id", "role" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "team_id": { "type": "string", "format": "uuid" }, "user_id": { "type": "string", "format": "uuid" }, "role": { "type": "string" } } }, "FinalizeMembershipRequest": { "title": "FinalizeMembershipRequest", "type": "object", "required": [ "user_id", "wrapped_team_dek" ], "properties": { "user_id": { "type": "string", "format": "uuid" }, "wrapped_team_dek": { "type": "string", "pattern": "^[0-9a-fA-F]{184,}$", "description": "hex, at least 92 bytes" }, "role": { "enum": [ "admin", "member", "viewer" ], "default": "member" } }, "description": "forwarded to caldyr-identity, which validates it" }, "FleetConfigExport": { "title": "FleetConfigExport", "type": "object", "required": [ "version", "exported_at", "hosts", "groups", "agent_roles", "prices", "features", "webhooks", "workflows" ], "additionalProperties": false, "properties": { "version": { "const": 1 }, "exported_at": { "type": "string", "format": "date-time" }, "hosts": { "type": "array", "items": { "type": "object", "required": [ "id", "name" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "display_name": { "type": [ "string", "null" ] }, "capabilities": { "type": "array", "items": { "type": "string" } }, "installed_backends": { "type": [ "object", "null" ] } } } }, "groups": { "type": "array", "items": { "type": "object", "description": "group row plus host_ids and role_ids", "properties": { "host_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "role_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } } } } }, "agent_roles": { "type": "array", "items": { "type": "object" } }, "prices": { "type": "array", "items": { "type": "object" } }, "features": { "type": "array", "items": { "type": "object" } }, "webhooks": { "type": "array", "items": { "type": "object" }, "description": "secrets are redacted" }, "workflows": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": [ "string", "null" ] }, "definition": { "type": "object" }, "version": { "type": "integer" }, "trigger": { "type": [ "object", "null" ] } } } } } }, "FleetDispatchRequest": { "title": "FleetDispatchRequest", "type": "object", "description": "one of tag, group, host_name, host_id is required", "properties": { "tag": { "type": "string", "description": "a capability tag of the target host" }, "host_name": { "type": "string" }, "host_id": { "type": "string", "format": "uuid" }, "cwd": { "type": "string" }, "agent": { "type": "string", "description": "routed against the company and team agent policy" }, "model": { "type": "string" }, "prompt": { "description": "plain text, or a sealed envelope for a company in the end-to-end mode" }, "prompt_seal": { "type": "object", "description": "with a sealed prompt: spawn_id, key_version, aad_v" }, "spawn_sig": { "type": "object", "description": "end-to-end mode: the signature over the spawn parameters, relayed to the daemon" }, "session_id": { "description": "relayed" }, "group": { "type": "string", "description": "group name or id; its brain prompt and roles apply" }, "args": { "type": "array", "description": "agent arguments; a legacy `-p ` pair becomes prompt + one_shot" }, "env": { "type": "object", "description": "spawn environment; keys on the daemon denylist answer 422" }, "label": { "type": "string" }, "metadata": { "type": "object" }, "one_shot": { "type": "boolean" } } }, "FleetDispatchResult": { "title": "FleetDispatchResult", "type": "object", "additionalProperties": false, "required": [ "session_id", "host_id", "host_name", "display_name", "group_brain_prompt_applied", "applied_roles" ], "properties": { "session_id": { "type": "string", "format": "uuid" }, "host_id": { "type": "string", "format": "uuid" }, "host_name": { "type": "string" }, "display_name": { "type": [ "string", "null" ] }, "group_brain_prompt_applied": { "type": "boolean" }, "applied_roles": { "type": "array", "items": { "type": "string" } } } }, "FleetDownloadFile": { "title": "FleetDownloadFile", "type": "string", "format": "binary", "description": "file content; etag and no-cache; 304 when if-none-match matches" }, "FleetExecRequest": { "title": "FleetExecRequest", "type": "object", "required": [ "prompt" ], "description": "one of tag, host_name, host_id is required", "properties": { "tag": { "type": "string", "description": "a capability tag of the target host" }, "host_name": { "type": "string" }, "host_id": { "type": "string", "format": "uuid" }, "cwd": { "type": "string" }, "agent": { "type": "string", "description": "routed against the company and team agent policy" }, "model": { "type": "string" }, "prompt": { "description": "plain text, or a sealed envelope for a company in the end-to-end mode" }, "prompt_seal": { "type": "object", "description": "with a sealed prompt: spawn_id, key_version, aad_v" }, "spawn_sig": { "type": "object", "description": "end-to-end mode: the signature over the spawn parameters, relayed to the daemon" }, "session_id": { "description": "relayed" }, "timeout_ms": { "type": "integer" } } }, "FleetExecResult": { "title": "FleetExecResult", "type": "object", "description": "plain mode: session_id, host_*, exit_code, timeout, output, cost. End-to-end mode: status, exit, cost, session_id, team_id, result.", "properties": { "session_id": { "type": "string", "format": "uuid" }, "host_id": { "type": "string", "format": "uuid" }, "host_name": { "type": "string" }, "display_name": { "type": [ "string", "null" ] }, "exit_code": { "type": [ "integer", "null" ] }, "timeout": { "type": "boolean" }, "output": { "type": "string" }, "cost": { "description": "advisory; absent or null when not measured" }, "status": { "enum": [ "timeout", "ok", "no_result" ], "description": "end-to-end mode" }, "exit": { "type": [ "integer", "null" ], "description": "end-to-end mode" }, "team_id": { "type": [ "string", "null" ], "format": "uuid", "description": "end-to-end mode" }, "result": { "description": "end-to-end mode: the sealed result, or null" } } }, "FleetHealthz": { "title": "FleetHealthz", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } } }, "FleetHost": { "title": "FleetHost", "type": "object", "description": "fleet-db HOST_PUBLIC_COLUMNS; never carries host_token, *_hash, wrapped_*_dek or mtls_fingerprint", "properties": { "id": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "pubkey": { "type": "string" }, "fingerprint": { "type": "string" }, "status": { "enum": [ "pending", "active", "revoked" ] }, "target_team_id": { "type": [ "string", "null" ], "format": "uuid" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "enrolled_by": { "type": [ "string", "null" ], "format": "uuid" }, "approved_by": { "type": [ "string", "null" ], "format": "uuid" }, "approved_at": { "type": [ "string", "null" ], "format": "date-time" }, "machine_info": { "type": [ "object", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "os": { "type": [ "string", "null" ] }, "arch": { "type": [ "string", "null" ] }, "capabilities": { "type": [ "array", "null" ], "items": { "type": "string" } }, "daemon_version": { "type": [ "string", "null" ] }, "claude_version": { "type": [ "string", "null" ] }, "installed_backends": { "type": [ "object", "null" ] }, "last_seen": { "type": [ "string", "null" ], "format": "date-time" }, "metadata": { "type": [ "object", "null" ] }, "latest_metrics": { "type": [ "object", "null" ] }, "connection_state": { "enum": [ "online", "offline" ] }, "mtls_first_seen_at": { "type": [ "string", "null" ], "format": "date-time" }, "mtls_last_seen_at": { "type": [ "string", "null" ], "format": "date-time" }, "max_concurrent_sessions": { "type": [ "integer", "null" ] }, "session_limit_source": { "enum": [ "server", "daemon", null ] }, "display_name": { "type": [ "string", "null" ] }, "owner_kind": { "type": [ "string", "null" ] }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "owner_instance_id": { "type": [ "string", "null" ] }, "owner_since": { "type": [ "string", "null" ], "format": "date-time" }, "auto_approved": { "type": [ "boolean", "null" ] }, "auto_approved_token_id": { "type": [ "string", "null" ], "format": "uuid" }, "install_layout": { "enum": [ "caldyr", null ] }, "last_refusal": { "type": [ "object", "null" ], "properties": { "status": {}, "error": {}, "hint": {}, "at": {} }, "additionalProperties": false } } }, "FleetHostDetail": { "title": "FleetHostDetail", "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "pubkey": { "type": "string" }, "fingerprint": { "type": "string" }, "status": { "enum": [ "pending", "active", "revoked" ] }, "target_team_id": { "type": [ "string", "null" ], "format": "uuid" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "enrolled_by": { "type": [ "string", "null" ], "format": "uuid" }, "approved_by": { "type": [ "string", "null" ], "format": "uuid" }, "approved_at": { "type": [ "string", "null" ], "format": "date-time" }, "machine_info": { "type": [ "object", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "os": { "type": [ "string", "null" ] }, "arch": { "type": [ "string", "null" ] }, "capabilities": { "type": [ "array", "null" ], "items": { "type": "string" } }, "daemon_version": { "type": [ "string", "null" ] }, "claude_version": { "type": [ "string", "null" ] }, "installed_backends": { "type": [ "object", "null" ] }, "last_seen": { "type": [ "string", "null" ], "format": "date-time" }, "metadata": { "type": [ "object", "null" ] }, "latest_metrics": { "type": [ "object", "null" ] }, "connection_state": { "enum": [ "online", "offline" ] }, "mtls_first_seen_at": { "type": [ "string", "null" ], "format": "date-time" }, "mtls_last_seen_at": { "type": [ "string", "null" ], "format": "date-time" }, "max_concurrent_sessions": { "type": [ "integer", "null" ] }, "session_limit_source": { "enum": [ "server", "daemon", null ] }, "display_name": { "type": [ "string", "null" ] }, "owner_kind": { "type": [ "string", "null" ] }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "owner_instance_id": { "type": [ "string", "null" ] }, "owner_since": { "type": [ "string", "null" ], "format": "date-time" }, "auto_approved": { "type": [ "boolean", "null" ] }, "auto_approved_token_id": { "type": [ "string", "null" ], "format": "uuid" }, "install_layout": { "enum": [ "caldyr", null ] }, "last_refusal": { "type": [ "object", "null" ], "properties": { "status": {}, "error": {}, "hint": {}, "at": {} }, "additionalProperties": false }, "groups": { "type": "array", "items": { "type": "object" } }, "effective_capabilities": { "type": "array", "items": { "type": "string" } }, "inherited_labels": { "type": "array", "items": { "type": "string" } }, "published_version": { "type": [ "string", "null" ] }, "upgrade_supported": { "type": "boolean" }, "can_upgrade": { "type": "boolean" }, "upgrade": { "type": [ "object", "null" ] } } }, "FleetHostFileRead": { "title": "FleetHostFileRead", "type": "object", "required": [ "path", "exists", "content" ], "additionalProperties": false, "properties": { "path": { "type": "string" }, "exists": { "type": "boolean" }, "content": { "type": [ "string", "null" ] } } }, "FleetHostFileWrite": { "title": "FleetHostFileWrite", "type": "object", "required": [ "path", "bytes" ], "additionalProperties": false, "properties": { "path": { "type": "string" }, "bytes": { "type": "integer" } } }, "FleetHostInventory": { "title": "FleetHostInventory", "type": "object", "description": "daemon-reported inventory, shape owned by the daemon" }, "FleetHostList": { "title": "FleetHostList", "type": "object", "required": [ "hosts" ], "additionalProperties": false, "properties": { "hosts": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "pubkey": { "type": "string" }, "fingerprint": { "type": "string" }, "status": { "enum": [ "pending", "active", "revoked" ] }, "target_team_id": { "type": [ "string", "null" ], "format": "uuid" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "enrolled_by": { "type": [ "string", "null" ], "format": "uuid" }, "approved_by": { "type": [ "string", "null" ], "format": "uuid" }, "approved_at": { "type": [ "string", "null" ], "format": "date-time" }, "machine_info": { "type": [ "object", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "os": { "type": [ "string", "null" ] }, "arch": { "type": [ "string", "null" ] }, "capabilities": { "type": [ "array", "null" ], "items": { "type": "string" } }, "daemon_version": { "type": [ "string", "null" ] }, "claude_version": { "type": [ "string", "null" ] }, "installed_backends": { "type": [ "object", "null" ] }, "last_seen": { "type": [ "string", "null" ], "format": "date-time" }, "metadata": { "type": [ "object", "null" ] }, "latest_metrics": { "type": [ "object", "null" ] }, "connection_state": { "enum": [ "online", "offline" ] }, "mtls_first_seen_at": { "type": [ "string", "null" ], "format": "date-time" }, "mtls_last_seen_at": { "type": [ "string", "null" ], "format": "date-time" }, "max_concurrent_sessions": { "type": [ "integer", "null" ] }, "session_limit_source": { "enum": [ "server", "daemon", null ] }, "display_name": { "type": [ "string", "null" ] }, "owner_kind": { "type": [ "string", "null" ] }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "owner_instance_id": { "type": [ "string", "null" ] }, "owner_since": { "type": [ "string", "null" ], "format": "date-time" }, "auto_approved": { "type": [ "boolean", "null" ] }, "auto_approved_token_id": { "type": [ "string", "null" ], "format": "uuid" }, "install_layout": { "enum": [ "caldyr", null ] }, "last_refusal": { "type": [ "object", "null" ], "properties": { "status": {}, "error": {}, "hint": {}, "at": {} }, "additionalProperties": false }, "spawn_agents": { "type": "array", "items": { "type": "string" }, "description": "installed backends allowed by the company and team policy" }, "published_version": { "type": [ "string", "null" ] }, "upgrade_supported": { "type": "boolean" }, "can_upgrade": { "type": "boolean" }, "upgrade": { "type": [ "object", "null" ] } } } } } }, "FleetHostMetrics": { "title": "FleetHostMetrics", "type": "array", "items": { "type": "object", "description": "raw sample (ts, cpu_pct, ram_*, disk, net, error) or, with downsampled=1, rollup row (bucket, cpu_pct_avg, cpu_pct_max, ram_used_bytes)", "properties": { "ts": { "type": "string", "format": "date-time" }, "cpu_pct": { "type": [ "number", "null" ] }, "ram_used_bytes": { "type": [ "integer", "string", "null" ] }, "ram_total_bytes": { "type": [ "integer", "string", "null" ] }, "disk": { "type": [ "object", "array", "null" ] }, "net": { "type": [ "object", "array", "null" ] }, "error": { "type": [ "string", "null" ] }, "bucket": { "type": "string", "format": "date-time" }, "cpu_pct_avg": { "type": [ "number", "null" ] }, "cpu_pct_max": { "type": [ "number", "null" ] } } } }, "FleetHostMtlsPinCleared": { "title": "FleetHostMtlsPinCleared", "type": "object", "required": [ "host_id", "cleared", "previous_fingerprint" ], "additionalProperties": false, "properties": { "host_id": { "type": "string", "format": "uuid" }, "cleared": { "type": "boolean" }, "previous_fingerprint": { "type": [ "string", "null" ] } } }, "FleetHostRevoked": { "title": "FleetHostRevoked", "type": "object", "required": [ "host_id", "status", "revoked_at" ], "additionalProperties": false, "properties": { "host_id": { "type": "string", "format": "uuid" }, "status": { "const": "revoked" }, "revoked_at": { "type": "string", "format": "date-time" } } }, "FleetHostTokenRotated": { "title": "FleetHostTokenRotated", "type": "object", "required": [ "host_id", "token", "grace_window_s" ], "additionalProperties": false, "properties": { "host_id": { "type": "string", "format": "uuid" }, "token": { "type": "string", "description": "new host token (a secret)" }, "grace_window_s": { "type": "integer" } } }, "FleetInstallScript": { "title": "FleetInstallScript", "type": "string", "description": "scripts/assets/install.sh" }, "FleetInstallScriptWindows": { "title": "FleetInstallScriptWindows", "type": "string", "description": "a PowerShell script" }, "FleetSession": { "title": "FleetSession", "type": "object", "required": [ "id", "host_id", "status" ], "description": "fleet_sessions row; the handlers add the derived fields below", "properties": { "id": { "type": "string", "format": "uuid" }, "host_id": { "type": "string", "format": "uuid" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" }, "started_at": { "type": "string", "format": "date-time" }, "ended_at": { "type": [ "string", "null" ], "format": "date-time" }, "pid": { "type": [ "integer", "null" ] }, "exit_code": { "type": [ "integer", "null" ] }, "origin": { "type": "string" }, "agent": { "type": "string" }, "local_session_id": { "type": [ "string", "null" ] }, "metadata": { "type": [ "object", "null" ] }, "cost_source": { "type": "string" }, "host_name": { "type": [ "string", "null" ], "description": "list only" }, "spawn_error": { "description": "derived from the session metadata (spawnErrorOf)" }, "stop_reason": { "description": "derived (tenant-block-stop stopReasonOf)" }, "replay_paused": { "type": "boolean" }, "replay_partial": { "type": "boolean" }, "e2e": { "type": [ "object", "null" ], "description": "{ key_version } of a team session sealed on the daemon" }, "solo_input_seal": { "type": [ "object", "null" ] } } }, "FleetSessionCleanupInvalid": { "title": "FleetSessionCleanupInvalid", "type": "object", "required": [ "error", "allowed" ], "properties": { "error": { "const": "invalid_value" }, "detail": { "type": "string" }, "allowed": { "type": "array", "items": { "type": "string" } } } }, "FleetSessionCleanupRequest": { "title": "FleetSessionCleanupRequest", "type": "object", "properties": { "older_than": { "type": "string", "default": "1 hour", "description": "one of the allowed intervals; also accepted as a query parameter" } } }, "FleetSessionCleanupResponse": { "title": "FleetSessionCleanupResponse", "type": "object", "required": [ "deleted", "limited", "older_than" ], "additionalProperties": false, "properties": { "deleted": { "type": "integer" }, "limited": { "type": "boolean" }, "older_than": { "type": "string" } } }, "FleetSessionInputRequest": { "title": "FleetSessionInputRequest", "type": "object", "properties": { "data": { "type": "string", "description": "required unless the body is a sealed input claim (lib/fleet/session-input-seal)" } } }, "FleetSessionInputSealRequired": { "title": "FleetSessionInputSealRequired", "type": "object", "properties": { "error": { "type": "string" }, "detail": { "type": "string" } } }, "FleetSessionList": { "title": "FleetSessionList", "type": "object", "required": [ "sessions" ], "properties": { "sessions": { "type": "array", "items": { "title": "FleetSession", "type": "object", "required": [ "id", "host_id", "status" ], "description": "fleet_sessions row; the handlers add the derived fields below", "properties": { "id": { "type": "string", "format": "uuid" }, "host_id": { "type": "string", "format": "uuid" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" }, "started_at": { "type": "string", "format": "date-time" }, "ended_at": { "type": [ "string", "null" ], "format": "date-time" }, "pid": { "type": [ "integer", "null" ] }, "exit_code": { "type": [ "integer", "null" ] }, "origin": { "type": "string" }, "agent": { "type": "string" }, "local_session_id": { "type": [ "string", "null" ] }, "metadata": { "type": [ "object", "null" ] }, "cost_source": { "type": "string" }, "host_name": { "type": [ "string", "null" ], "description": "list only" }, "spawn_error": { "description": "derived from the session metadata (spawnErrorOf)" }, "stop_reason": { "description": "derived (tenant-block-stop stopReasonOf)" }, "replay_paused": { "type": "boolean" }, "replay_partial": { "type": "boolean" }, "e2e": { "type": [ "object", "null" ], "description": "{ key_version } of a team session sealed on the daemon" }, "solo_input_seal": { "type": [ "object", "null" ] } } } }, "rows": { "type": "array", "items": { "title": "FleetSession", "type": "object", "required": [ "id", "host_id", "status" ], "description": "fleet_sessions row; the handlers add the derived fields below", "properties": { "id": { "type": "string", "format": "uuid" }, "host_id": { "type": "string", "format": "uuid" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" }, "started_at": { "type": "string", "format": "date-time" }, "ended_at": { "type": [ "string", "null" ], "format": "date-time" }, "pid": { "type": [ "integer", "null" ] }, "exit_code": { "type": [ "integer", "null" ] }, "origin": { "type": "string" }, "agent": { "type": "string" }, "local_session_id": { "type": [ "string", "null" ] }, "metadata": { "type": [ "object", "null" ] }, "cost_source": { "type": "string" }, "host_name": { "type": [ "string", "null" ], "description": "list only" }, "spawn_error": { "description": "derived from the session metadata (spawnErrorOf)" }, "stop_reason": { "description": "derived (tenant-block-stop stopReasonOf)" }, "replay_paused": { "type": "boolean" }, "replay_partial": { "type": "boolean" }, "e2e": { "type": [ "object", "null" ], "description": "{ key_version } of a team session sealed on the daemon" }, "solo_input_seal": { "type": [ "object", "null" ] } } }, "description": "with_count=1: the same rows" }, "total": { "type": "integer", "description": "with_count=1" }, "limit": { "type": "integer" }, "offset": { "type": "integer" } } }, "FleetSessionMeta": { "title": "FleetSessionMeta", "type": "object", "required": [ "meta", "team_id" ], "additionalProperties": false, "properties": { "meta": { "oneOf": [ { "type": "object", "required": [ "ciphertext", "nonce", "aadVersion" ], "additionalProperties": false, "properties": { "ciphertext": { "type": "string" }, "nonce": { "type": "string" }, "aadVersion": { "type": "integer" } } }, { "type": "null" } ] }, "team_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "FleetSessionMetaBatchRequest": { "title": "FleetSessionMetaBatchRequest", "type": "object", "required": [ "ids" ], "properties": { "ids": { "type": "array", "maxItems": 200, "items": { "type": "string" }, "description": "longer lists are cut to 200" } } }, "FleetSessionMetaBatchResponse": { "title": "FleetSessionMetaBatchResponse", "type": "object", "required": [ "metas" ], "additionalProperties": false, "properties": { "metas": { "type": "array", "items": { "type": "object", "required": [ "session_id", "team_id", "meta" ], "additionalProperties": false, "properties": { "session_id": { "type": "string" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "meta": { "type": "object", "required": [ "ciphertext", "nonce", "aadVersion" ], "additionalProperties": false, "properties": { "ciphertext": { "type": "string" }, "nonce": { "type": "string" }, "aadVersion": { "type": "integer" } } } } } } } }, "FleetSessionPatched": { "title": "FleetSessionPatched", "type": "object", "required": [ "id", "host_id", "status" ], "description": "fleet_sessions row; the handlers add the derived fields below", "properties": { "id": { "type": "string", "format": "uuid" }, "host_id": { "type": "string", "format": "uuid" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" }, "started_at": { "type": "string", "format": "date-time" }, "ended_at": { "type": [ "string", "null" ], "format": "date-time" }, "pid": { "type": [ "integer", "null" ] }, "exit_code": { "type": [ "integer", "null" ] }, "origin": { "type": "string" }, "agent": { "type": "string" }, "local_session_id": { "type": [ "string", "null" ] }, "metadata": { "type": [ "object", "null" ] }, "cost_source": { "type": "string" }, "host_name": { "type": [ "string", "null" ], "description": "list only" }, "spawn_error": { "description": "derived from the session metadata (spawnErrorOf)" }, "stop_reason": { "description": "derived (tenant-block-stop stopReasonOf)" }, "replay_paused": { "type": "boolean" }, "replay_partial": { "type": "boolean" }, "e2e": { "type": [ "object", "null" ], "description": "{ key_version } of a team session sealed on the daemon" }, "solo_input_seal": { "type": [ "object", "null" ] } } }, "FleetSessionSearchRequest": { "title": "FleetSessionSearchRequest", "type": "object", "required": [ "field", "index_value" ], "properties": { "field": { "type": "string", "minLength": 1 }, "index_value": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$" } } }, "FleetSessionSearchResponse": { "title": "FleetSessionSearchResponse", "type": "object", "required": [ "session_ids" ], "additionalProperties": false, "properties": { "session_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "FleetSpaShell": { "title": "FleetSpaShell", "type": "string", "description": "the browser shell (agent-fleet/web/index.html or the named page); served before authentication" }, "FleetStackStatus": { "title": "FleetStackStatus", "type": "object", "description": "the status file as the host timer wrote it, plus age_ms and stale; { services: [], error: \"stack_status_not_written\" } when the file does not exist", "properties": { "services": { "type": "array", "items": { "type": "object" } }, "age_ms": { "type": "number" }, "stale": { "type": "boolean", "description": "older than 90 s" }, "error": { "const": "stack_status_not_written" } } }, "FleetStaticAsset": { "title": "FleetStaticAsset", "type": "string", "format": "binary", "description": "file content; content-type is chosen from the extension" }, "FleetWhoami": { "title": "FleetWhoami", "type": "object", "description": "with no user (the admin bearer) or a synthetic user only { role } is answered; the full shape below is for a resolved user", "properties": { "id": { "type": "string", "format": "uuid" }, "email": { "type": "string" }, "role": { "type": "string" }, "kind": { "type": "string" }, "is_system": { "type": "boolean" }, "company_id": { "type": [ "string", "null" ], "format": "uuid" }, "is_platform_admin": { "type": "boolean" }, "is_bootstrap": { "type": "boolean" }, "team_memberships": { "type": "array", "items": { "type": "object", "required": [ "team_id", "role" ], "additionalProperties": false, "properties": { "team_id": { "type": "string", "format": "uuid" }, "role": { "type": "string" } } } }, "roaming_auth_enabled": { "type": "boolean" }, "has_sign_key": { "type": "boolean" }, "auth_proof": { "enum": [ "opaque", "password", "none", null ] }, "allow_roaming_keys": { "type": [ "string", "null" ], "description": "on, off or null (no company)" }, "company_status": { "enum": [ "active", "suspended", "deleted", null ] }, "company": { "type": [ "object", "null" ], "required": [ "id", "e2e_mode", "sandbox_mode" ], "properties": { "id": { "type": "string", "format": "uuid" }, "e2e_mode": { "enum": [ "off", "on", null ] }, "sandbox_mode": { "enum": [ "off", "netns", null ] } } }, "e2e_mode": { "enum": [ "off", "on", null ] }, "sandbox_mode": { "enum": [ "off", "netns", null ] }, "tier": { "type": [ "string", "null" ], "description": "solo, team, enterprise, dev, null or unavailable" }, "csrf_token": { "type": [ "string", "null" ] }, "totp_enrolment_required": { "type": "boolean" }, "legacy_role": { "enum": [ "admin", "viewer" ] }, "is_bootstrap_company": { "type": "boolean" } } }, "GetAuthReauthMethodsResponse200": { "type": "object", "required": [ "purpose", "methods" ], "properties": { "purpose": { "type": "string" }, "methods": { "type": "array", "items": { "type": "string", "enum": [ "opaque", "passkey", "sso" ] } } } }, "GetFleetFeaturesResponse200": { "type": "array", "items": { "type": "object", "required": [ "name", "enabled" ], "properties": { "name": { "type": "string" }, "enabled": { "type": "boolean" }, "description": { "type": [ "string", "null" ] }, "updated_at": { "type": [ "string", "null" ], "format": "date-time" } } } }, "GetPlatformAdminArticlesArticleIdResponse200": { "type": "object", "additionalProperties": false, "required": [ "id", "scope", "source_path", "title", "tags", "created_by_user_id", "created_at", "updated_at", "body" ], "properties": { "id": { "type": "string", "format": "uuid" }, "scope": { "const": "global" }, "source_path": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": {}, "updated_at": {}, "body": { "type": "string" } } }, "Healthz": { "title": "Healthz", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } } }, "HealthzDetail": { "title": "HealthzDetail", "type": "object", "required": [ "ok", "ts", "subsystems" ], "properties": { "ok": { "type": "boolean" }, "ts": { "type": "string", "format": "date-time" }, "subsystems": { "type": "object", "additionalProperties": { "type": "object", "required": [ "status" ], "properties": { "status": { "type": "string", "description": "ok, warn, error or skip" }, "detail": { "type": "string" } }, "description": "one subsystem; further fields depend on the subsystem" } } } }, "HealthzDetailUnauthorized": { "title": "HealthzDetailUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized" }, "detail": { "type": "string" } } }, "HealthzHead": { "title": "HealthzHead", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } }, "description": "the status line is the answer; a HEAD request carries no body" }, "HostAgentUpgradeCheck": { "title": "HostAgentUpgradeCheck", "type": "object", "required": [ "published_version", "current_version", "upgrade_available", "upgrades_enabled" ], "additionalProperties": false, "properties": { "published_version": { "type": "string", "pattern": "^[0-9]{1,6}\\.[0-9]{1,6}\\.[0-9]{1,6}$", "description": "the version published for the host os and arch" }, "current_version": { "type": [ "string", "null" ], "description": "the version the hub last saw for this host (fleet_hosts.daemon_version)" }, "upgrade_available": { "type": "boolean", "description": "true only when upgrades are enabled and published_version is newer than current_version" }, "upgrades_enabled": { "type": "boolean", "description": "CALDYR_HUB_UPGRADES_ENABLED" } } }, "HostAgentUpgradeNoBundle": { "title": "HostAgentUpgradeNoBundle", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "enum": [ "no_published_bundle" ] } } }, "HostAgentUpgradeUnauthorized": { "title": "HostAgentUpgradeUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "enum": [ "unauthorized", "host_token_revoked" ] } } }, "HostApproved": { "title": "HostApproved", "type": "object", "required": [ "host_id", "status", "team_id" ], "additionalProperties": false, "properties": { "host_id": { "type": "string", "format": "uuid" }, "status": { "type": "string" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "HostAtCapacity": { "title": "HostAtCapacity", "type": "object", "required": [ "error", "detail", "retry_after_seconds" ], "properties": { "error": { "const": "host_at_capacity" }, "detail": { "type": "string" }, "retry_after_seconds": { "type": "integer" } } }, "HostAuditEventRecorded": { "title": "HostAuditEventRecorded", "type": "object", "required": [ "recorded" ], "additionalProperties": false, "properties": { "recorded": { "const": true } }, "description": "one e2e.pin_cleared audit row, written fail-closed" }, "HostAuditEventTooLarge": { "title": "HostAuditEventTooLarge", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "const": "payload_too_large" } }, "description": "the body exceeds 512 KiB" }, "HostAuditEventUnauthorized": { "title": "HostAuditEventUnauthorized", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "enum": [ "unauthorized", "host_token_revoked" ] } }, "description": "not a 64-hex bearer of an active host; host_token_revoked for a revoked one" }, "HostAuditEventUnavailable": { "title": "HostAuditEventUnavailable", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "const": "audit_log_unavailable" } }, "description": "the audit row could not be written; the host keeps its pin" }, "HostCliLaunch": { "title": "HostCliLaunch", "type": "object", "required": [ "session_id", "team_id", "user_id", "agent", "e2e_mode", "local_tools", "team_key_name" ], "properties": { "session_id": { "type": "string", "format": "uuid" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "user_id": { "type": "string", "format": "uuid" }, "agent": { "type": [ "string", "null" ] }, "e2e_mode": { "enum": [ "on", "off" ] }, "local_tools": { "type": "object", "required": [ "eligible" ], "additionalProperties": false, "properties": { "eligible": { "type": "boolean" }, "reason": { "enum": [ "e2e_mode_off", "no_team", "not_host_team" ] } } }, "team_key_name": { "type": [ "string", "null" ] }, "audit": { "type": "string", "description": "set when purpose=e2e_config released a sealed configuration" } } }, "HostEnrolCode": { "title": "HostEnrolCode", "type": "object", "required": [ "code", "expires_at" ], "additionalProperties": false, "properties": { "code": { "type": "string", "pattern": "^[A-Za-z2-7]{8}$" }, "expires_at": { "type": "string", "format": "date-time" } } }, "HostEnrolled": { "title": "HostEnrolled", "type": "object", "required": [ "host_id", "status" ], "properties": { "host_id": { "type": "string", "format": "uuid" }, "status": { "enum": [ "pending", "active" ] }, "target_team_id": { "type": [ "string", "null" ], "description": "pending host enrolled with a code" }, "pending_token": { "type": "string", "description": "secret; the daemon keeps it until approval" }, "team_id": { "type": "string", "format": "uuid" }, "team_name": { "type": [ "string", "null" ] }, "company_name": { "type": [ "string", "null" ] }, "host_token": { "type": "string", "description": "secret; auto-approved host only" }, "wrapped_team_dek": { "type": "string", "pattern": "^[0-9a-fA-F]+$", "description": "auto-approved host only" } } }, "HostMe": { "title": "HostMe", "type": "object", "additionalProperties": false, "required": [ "host_id", "status", "team_id", "host_token", "wrapped_team_dek", "wrapped_note_dek", "e2e_key_wraps", "company" ], "properties": { "host_id": { "type": "string", "format": "uuid" }, "status": { "enum": [ "pending", "active", "revoked" ] }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "host_token": { "type": [ "string", "null" ], "description": "delivered once, after approval; null on later polls" }, "wrapped_team_dek": { "type": [ "string", "null" ], "description": "hex; active hosts only" }, "wrapped_note_dek": { "type": [ "string", "null" ], "description": "active hosts only" }, "e2e_key_wraps": { "type": "array", "description": "active hosts only, [] otherwise", "items": { "type": "object", "properties": { "scope_kind": { "type": "string" }, "scope_id": { "type": "string" }, "key_version": { "type": "integer" }, "state": { "type": "string" }, "wrapped_key": { "type": "string" } } } }, "company": { "type": [ "object", "null" ], "description": "active host of a company; null otherwise", "additionalProperties": false, "required": [ "e2e_mode" ], "properties": { "e2e_mode": { "enum": [ "on", "off" ] }, "workflow_aad_v1_closed_at": { "description": "set once the company closed AAD v1" } } } } }, "HostSandboxPolicy": { "title": "HostSandboxPolicy", "type": "object", "required": [ "team_id", "sealed" ], "additionalProperties": false, "properties": { "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "sealed": { "type": [ "object", "null" ], "description": "the sealed envelope (lib/e2e parseConfigEnvelope), null when none or the host has no team" } } }, "HostSecretsFetchRequest": { "title": "HostSecretsFetchRequest", "type": "object", "properties": { "name": { "type": [ "string", "null" ] }, "session_id": { "type": "string", "format": "uuid" } } }, "HostSecretsFetchResponse": { "title": "HostSecretsFetchResponse", "type": "object", "required": [ "items" ], "additionalProperties": false, "properties": { "items": { "type": "array", "items": { "type": "object", "required": [ "scope_kind", "scope_id", "name", "key_version", "nonce", "ciphertext" ], "additionalProperties": false, "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "key_version": { "type": "integer" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" } } } } } }, "HostSecretsRevealRequest": { "title": "HostSecretsRevealRequest", "type": "object", "required": [ "name", "scope_kind", "scope_id", "session_id" ], "properties": { "name": { "type": "string", "minLength": 1 }, "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "session_id": { "type": "string", "format": "uuid" } } }, "HostSecretsRevealResponse": { "title": "HostSecretsRevealResponse", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } } }, "HostTokenRequired": { "title": "HostTokenRequired", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "IdentityError": { "title": "IdentityError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "IdentityOk": { "title": "IdentityOk", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } } }, "IdpConfig": { "title": "IdpConfig", "type": "object", "required": [ "id", "company_id", "display_name", "protocol", "issuer_url", "client_id", "client_secret_ref", "scopes", "email_attribute", "name_attribute", "default_role", "policy", "status", "auto_provision", "require_e2ee", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid" }, "display_name": { "type": "string" }, "protocol": { "const": "oidc" }, "issuer_url": { "type": "string" }, "client_id": { "type": "string" }, "client_secret_ref": { "type": "string", "description": "vault-ref://h/; the secret value is never returned" }, "discovery_cache": { "type": [ "object", "null" ] }, "discovery_fetched_at": { "type": [ "string", "null" ], "format": "date-time" }, "jwks_cache": { "type": [ "object", "null" ] }, "jwks_fetched_at": { "type": [ "string", "null" ], "format": "date-time" }, "scopes": { "type": "array", "items": { "type": "string" } }, "email_attribute": { "type": "string" }, "name_attribute": { "type": "string" }, "groups_attribute": { "type": [ "string", "null" ] }, "default_role": { "enum": [ "member", "viewer" ] }, "role_mapping": { "type": [ "object", "null" ] }, "policy": { "enum": [ "sso_only", "sso_preferred", "sso_optional" ] }, "allowed_email_domains": { "type": [ "array", "null" ], "items": { "type": "string" } }, "status": { "enum": [ "active", "disabled" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "created_by": { "type": [ "string", "null" ], "format": "uuid" }, "auto_provision": { "type": "boolean" }, "jit_scim_token_id": { "type": [ "string", "null" ], "format": "uuid" }, "require_e2ee": { "type": "boolean" } }, "description": "a company_idp_configs row" }, "IdpConfigCreateRequest": { "title": "IdpConfigCreateRequest", "type": "object", "required": [ "display_name", "issuer_url", "client_id", "client_secret_ref" ], "properties": { "display_name": { "type": "string" }, "issuer_url": { "type": "string" }, "client_id": { "type": "string" }, "scopes": { "type": "array", "items": { "type": "string" } }, "email_attribute": { "type": "string" }, "name_attribute": { "type": "string" }, "groups_attribute": { "type": [ "string", "null" ] }, "default_role": { "enum": [ "member", "viewer" ] }, "role_mapping": { "type": [ "object", "null" ] }, "policy": { "enum": [ "sso_only", "sso_preferred", "sso_optional" ] }, "allowed_email_domains": { "type": [ "array", "null" ], "items": { "type": "string" } }, "client_secret_ref": { "type": "string", "pattern": "^vault-ref://h/[0-9a-f]{32}$", "description": "a handle minted by POST /admin/sso/secret-bindings" } } }, "IdpConfigList": { "title": "IdpConfigList", "type": "object", "required": [ "configs" ], "additionalProperties": false, "properties": { "configs": { "type": "array", "items": { "title": "IdpConfig", "type": "object", "required": [ "id", "company_id", "display_name", "protocol", "issuer_url", "client_id", "client_secret_ref", "scopes", "email_attribute", "name_attribute", "default_role", "policy", "status", "auto_provision", "require_e2ee", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid" }, "display_name": { "type": "string" }, "protocol": { "const": "oidc" }, "issuer_url": { "type": "string" }, "client_id": { "type": "string" }, "client_secret_ref": { "type": "string", "description": "vault-ref://h/; the secret value is never returned" }, "discovery_cache": { "type": [ "object", "null" ] }, "discovery_fetched_at": { "type": [ "string", "null" ], "format": "date-time" }, "jwks_cache": { "type": [ "object", "null" ] }, "jwks_fetched_at": { "type": [ "string", "null" ], "format": "date-time" }, "scopes": { "type": "array", "items": { "type": "string" } }, "email_attribute": { "type": "string" }, "name_attribute": { "type": "string" }, "groups_attribute": { "type": [ "string", "null" ] }, "default_role": { "enum": [ "member", "viewer" ] }, "role_mapping": { "type": [ "object", "null" ] }, "policy": { "enum": [ "sso_only", "sso_preferred", "sso_optional" ] }, "allowed_email_domains": { "type": [ "array", "null" ], "items": { "type": "string" } }, "status": { "enum": [ "active", "disabled" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "created_by": { "type": [ "string", "null" ], "format": "uuid" }, "auto_provision": { "type": "boolean" }, "jit_scim_token_id": { "type": [ "string", "null" ], "format": "uuid" }, "require_e2ee": { "type": "boolean" } }, "description": "a company_idp_configs row" } } } }, "IdpConfigPatchRequest": { "title": "IdpConfigPatchRequest", "type": "object", "description": "at least one of the three fields", "properties": { "status": { "enum": [ "active", "disabled" ] }, "auto_provision": { "type": "boolean", "description": "true only on an active configuration; seeds a synthetic SCIM token when none is set" }, "jit_scim_token_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "IdpConfigUpdateRequest": { "title": "IdpConfigUpdateRequest", "type": "object", "description": "at least one field; client_secret_ref and status are refused with unexpected_field", "properties": { "display_name": { "type": "string" }, "issuer_url": { "type": "string" }, "client_id": { "type": "string" }, "scopes": { "type": "array", "items": { "type": "string" } }, "email_attribute": { "type": "string" }, "name_attribute": { "type": "string" }, "groups_attribute": { "type": [ "string", "null" ] }, "default_role": { "enum": [ "member", "viewer" ] }, "role_mapping": { "type": [ "object", "null" ] }, "policy": { "enum": [ "sso_only", "sso_preferred", "sso_optional" ] }, "allowed_email_domains": { "type": [ "array", "null" ], "items": { "type": "string" } } } }, "IdpProbeRefusal": { "title": "IdpProbeRefusal", "type": "object", "required": [ "error" ], "properties": { "ok": { "const": false }, "error": { "type": "string", "description": "invalid_value, invalid_issuer_url, forbidden_protocol, forbidden_private_address, dns_failed, dns_empty, forbidden_jwks_redirect, idp_unavailable" }, "detail": { "type": "string" }, "discovery": { "type": "object", "description": "the provider metadata the probe read", "properties": { "issuer": { "type": "string" }, "authorization_endpoint": { "type": "string" }, "token_endpoint": { "type": "string" }, "userinfo_endpoint": { "type": "string" }, "jwks_uri": { "type": "string" }, "response_types_supported": { "type": "array", "items": { "type": "string" } }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string" } }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string" } }, "scopes_supported": { "type": "array", "items": { "type": "string" } }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string" } } } } } }, "IdpProbeResult": { "title": "IdpProbeResult", "type": "object", "required": [ "ok", "discovery", "jwks_kids", "jwks", "alg_none" ], "properties": { "ok": { "type": "boolean" }, "error": { "const": "jwks_unavailable" }, "reason": { "type": "string" }, "retry_after_s": { "type": "integer" }, "discovery": { "type": "object", "description": "the provider metadata the probe read", "properties": { "issuer": { "type": "string" }, "authorization_endpoint": { "type": "string" }, "token_endpoint": { "type": "string" }, "userinfo_endpoint": { "type": "string" }, "jwks_uri": { "type": "string" }, "response_types_supported": { "type": "array", "items": { "type": "string" } }, "id_token_signing_alg_values_supported": { "type": "array", "items": { "type": "string" } }, "token_endpoint_auth_methods_supported": { "type": "array", "items": { "type": "string" } }, "scopes_supported": { "type": "array", "items": { "type": "string" } }, "code_challenge_methods_supported": { "type": "array", "items": { "type": "string" } } } }, "jwks_kids": { "type": "array", "items": { "type": "string" } }, "jwks": { "type": "object", "required": [ "status" ], "properties": { "status": { "enum": [ "ok", "unavailable", "not_advertised" ] }, "kid_count": { "type": "integer" }, "reason": { "type": "string", "description": "no_fetch, http_, timeout, bad_json, fetch_failed" } } }, "alg_none": { "type": "boolean", "description": "the provider advertises the none signing algorithm" } }, "description": "200 when the discovery document and the key set were read; 503 (Retry-After 5) with the discovery metadata when the key set could not be read" }, "IdpRotateSecretRequest": { "title": "IdpRotateSecretRequest", "type": "object", "required": [ "client_secret_ref" ], "additionalProperties": false, "properties": { "client_secret_ref": { "type": "string", "pattern": "^vault-ref://h/[0-9a-f]{32}$", "description": "a handle minted by POST /admin/sso/secret-bindings" } } }, "InternalGateRefusal": { "title": "InternalGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "internal auth required (401, a sentence), internal_token_required, internal_token_invalid, internal_caller_required, internal_caller_forbidden, internal_caller_subject_mismatch" } } }, "InternalSigningChainBadRequest": { "title": "InternalSigningChainBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "user id: uuid required, invite_id: uuid required, bad body" } } }, "InternalSigningChainExists": { "title": "InternalSigningChainExists", "type": "object", "required": [ "minted" ], "additionalProperties": false, "properties": { "minted": { "const": false } }, "description": "the user already has a chain" }, "InternalSigningChainMinted": { "title": "InternalSigningChainMinted", "type": "object", "required": [ "minted" ], "additionalProperties": false, "properties": { "minted": { "const": true } } }, "InternalSigningChainRequest": { "title": "InternalSigningChainRequest", "type": "object", "properties": { "invite_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "InternalSigningChainUnavailable": { "title": "InternalSigningChainUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "chain_mint_failed, database not ready" } } }, "InternalSpawnGateRefusal": { "title": "InternalSpawnGateRefusal", "type": "object", "required": [ "status" ], "properties": { "status": { "enum": [ "unauthorized", "spawn_rejected", "internal_error" ] }, "error": { "type": "string" }, "retry_after": { "type": "integer" } }, "description": "the worker branches on status; a tenant-gate refusal keeps its own status (402 licence, 403 suspended, 503 outage) with status spawn_rejected" }, "InternalTotpBadRequest": { "title": "InternalTotpBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "user_id and totp_code|recovery_code required, or the body-parse message" } } }, "InternalTotpRateLimited": { "title": "InternalTotpRateLimited", "type": "object", "required": [ "error", "retry_after_ms" ], "properties": { "error": { "const": "rate_limited" }, "retry_after_ms": { "type": "integer" } }, "description": "Retry-After is set" }, "InternalTotpVerifyRequest": { "title": "InternalTotpVerifyRequest", "type": "object", "required": [ "user_id" ], "properties": { "user_id": { "type": "string", "format": "uuid" }, "totp_code": { "type": "string" }, "recovery_code": { "type": "string" } }, "description": "one of totp_code and recovery_code" }, "InternalTotpVerifyResult": { "title": "InternalTotpVerifyResult", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "type": "boolean" } } }, "InternalUserNotFound": { "title": "InternalUserNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "user_not_found" } } }, "InternalWorkflowHostRunRefused": { "title": "InternalWorkflowHostRunRefused", "type": "object", "required": [ "status", "error_class" ], "properties": { "status": { "const": "host_run_refused" }, "error_class": { "type": "string" } } }, "InternalWorkflowSpawnFailed": { "title": "InternalWorkflowSpawnFailed", "type": "object", "required": [ "status" ], "properties": { "status": { "const": "internal_error" }, "error": { "type": "string" }, "error_class": { "type": "string" } } }, "InternalWorkflowSpawnRequest": { "title": "InternalWorkflowSpawnRequest", "type": "object", "required": [ "run_id" ], "properties": { "run_id": { "type": "string" }, "node": { "type": "object", "description": "the workflow node; required unless host_run is set" }, "prompt": { "type": "string" }, "timeout_s": { "type": "number", "description": "default: the node's own, else 300" }, "host_run": { "enum": [ "start", "cancel" ] } } }, "InternalWorkflowSpawnResult": { "title": "InternalWorkflowSpawnResult", "type": "object", "required": [ "status" ], "properties": { "status": { "enum": [ "ok", "daemon_offline", "timeout", "spawn_rejected", "internal_error" ] }, "output": { "type": "string" }, "exit_code": { "type": [ "integer", "null" ] }, "session_id": { "type": [ "string", "null" ] }, "error": { "type": "string" } }, "description": "a completed spawn attempt; a host-run answer carries status ok and the host-run fields" }, "InvalidCursor": { "title": "InvalidCursor", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "invalid_cursor" } } }, "InviteAccepted": { "title": "InviteAccepted", "type": "object", "required": [ "user_id", "status" ], "properties": { "user_id": { "type": "string", "format": "uuid" }, "status": { "type": "string" } } }, "InviteCreated": { "title": "InviteCreated", "type": "object", "required": [ "id", "token", "url", "expires_at", "delivery" ], "properties": { "id": { "type": "string", "format": "uuid" }, "token": { "type": "string", "description": "64 hex characters, shown once" }, "url": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" }, "delivery": { "type": "object", "required": [ "status" ], "description": "queued: one mail was committed with the invite; failed: the invite exists, send url by hand", "properties": { "status": { "enum": [ "queued", "failed" ] }, "outbox_id": { "type": [ "string", "null" ], "format": "uuid" }, "locale": { "type": "string" }, "error": { "type": "string" } } } } }, "InviteList": { "title": "InviteList", "type": "object", "required": [ "invites" ], "additionalProperties": false, "properties": { "invites": { "type": "array", "maxItems": 500, "items": { "type": "object", "required": [ "id", "email", "role", "created_at", "expires_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "email": { "type": "string" }, "role": { "type": "string" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "team_name": { "type": [ "string", "null" ] }, "invited_by": { "type": [ "string", "null" ], "format": "uuid" }, "invited_by_email": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time" }, "accepted_at": { "type": [ "string", "null" ], "format": "date-time" }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" } } } } } }, "InviteLookup": { "title": "InviteLookup", "type": "object", "required": [ "email", "role_in_team", "expires_at" ], "properties": { "email": { "type": "string" }, "company_name": { "type": [ "string", "null" ] }, "team_name": { "type": [ "string", "null" ] }, "role_in_team": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" } } }, "InvitePage": { "title": "InvitePage", "type": "string" }, "InviteRevoked": { "title": "InviteRevoked", "type": "object", "required": [ "ok", "id" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "id": { "type": "string", "format": "uuid" } } }, "InviteSeatsExhausted": { "title": "InviteSeatsExhausted", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "license_seats_exhausted" }, "reason": { "type": "string" }, "limit": { "type": "integer" }, "hard_cap": { "type": "integer" }, "used": { "type": "integer" }, "tier": { "type": "string" }, "detail": { "type": "string" } } }, "IpRateLimited": { "title": "IpRateLimited", "type": "object", "required": [ "error", "retry_after_ms" ], "properties": { "error": { "type": "string", "description": "rate-limited; try again later" }, "retry_after_ms": { "type": "integer" } } }, "JsonRpcMethodNotFound": { "title": "JsonRpcMethodNotFound", "type": "object", "required": [ "jsonrpc", "error" ], "properties": { "jsonrpc": { "const": "2.0" }, "id": {}, "error": { "type": "object" } } }, "JsonRpcParseError": { "title": "JsonRpcParseError", "type": "object", "required": [ "jsonrpc", "error" ], "properties": { "jsonrpc": { "const": "2.0" }, "id": { "type": "null" }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "enum": [ -32700, -32600 ] }, "message": { "type": "string" } } } } }, "JsonRpcRequest": { "title": "JsonRpcRequest", "type": [ "object", "array" ], "description": "a request or notification object; a batch (array) is accepted only under the legacy protocol era", "properties": { "jsonrpc": { "const": "2.0" }, "id": { "type": [ "string", "integer", "null" ] }, "method": { "type": "string" }, "params": { "type": [ "object", "array" ] } } }, "JsonRpcResponse": { "title": "JsonRpcResponse", "type": [ "object", "array" ], "description": "result or error of the call; text/event-stream when streamed", "properties": { "jsonrpc": { "const": "2.0" }, "id": { "type": [ "string", "integer", "null" ] }, "result": {}, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "integer" }, "message": { "type": "string" }, "data": {} } } } }, "KbBrowserBadRequest": { "title": "KbBrowserBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "bad_request (too many visible teams)" }, "detail": { "type": "string" } } }, "KbBrowserChanges": { "title": "KbBrowserChanges", "type": "object", "required": [ "changes", "next_cursor", "more" ], "additionalProperties": false, "properties": { "changes": { "type": "array", "items": { "type": "object", "description": "change rows as the knowledge service returns them, filtered to company and visible team scopes" } }, "next_cursor": { "type": [ "string", "null" ] }, "more": { "type": "boolean" } } }, "KbBrowserForbidden": { "title": "KbBrowserForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "no_tenant, forbidden" }, "detail": { "type": "string" } } }, "KbBrowserInvalid": { "title": "KbBrowserInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value" }, "detail": { "type": "string" } } }, "KbBrowserModeOff": { "title": "KbBrowserModeOff", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "e2e_mode_off" }, "detail": { "type": "string" } } }, "KbBrowserNotePut": { "title": "KbBrowserNotePut", "type": "object", "required": [ "note_id", "row_version", "change_seq" ], "description": "the status is the knowledge service's own 2xx for the write", "properties": { "note_id": { "type": "string", "format": "uuid" }, "row_version": { "type": "integer" }, "change_seq": { "type": "integer" }, "replay": { "const": true, "description": "present for a replayed write" } } }, "KbBrowserUnavailable": { "title": "KbBrowserUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unavailable" }, "detail": { "type": "string" } } }, "KbE2eChanges": { "title": "KbE2eChanges", "type": "object", "required": [ "changes", "next_cursor", "more" ], "additionalProperties": false, "properties": { "changes": { "type": "array", "items": { "type": "object", "required": [ "scope" ], "properties": { "note_id": { "type": "string" }, "scope": { "enum": [ "team", "company" ] }, "team_id": { "type": [ "string", "null" ] } }, "description": "change rows as the knowledge service returns them, filtered to the host's scope" } }, "next_cursor": { "type": [ "string", "null" ] }, "more": { "type": "boolean" } } }, "KbE2eChunksAnswer": { "title": "KbE2eChunksAnswer", "type": "object", "description": "existing is true when a set was already stored; the knowledge service's own answer, passed through with its status", "properties": { "replay": { "type": "boolean" }, "row_version": { "type": "integer" }, "existing": { "type": "boolean" } } }, "KbE2eDeleteAnswer": { "title": "KbE2eDeleteAnswer", "type": "object", "description": "the tombstone's version; the knowledge service's own answer, passed through with its status", "properties": { "replay": { "type": "boolean" }, "row_version": { "type": "integer" }, "existing": { "type": "boolean" } } }, "KbE2eLegacy": { "title": "KbE2eLegacy", "type": "object", "required": [ "notes", "next_cursor" ], "additionalProperties": false, "properties": { "notes": { "type": "array", "items": { "type": "object", "required": [ "scope" ], "properties": { "id": { "type": "string" }, "scope": { "const": "team" }, "team_id": { "type": [ "string", "null" ] } }, "description": "rows as the knowledge service returns them" } }, "next_cursor": { "type": [ "string", "null" ] } } }, "KbE2eNote": { "title": "KbE2eNote", "type": "object", "required": [ "note_id", "scope", "team_id", "row_version", "key_version", "note" ], "properties": { "note_id": { "type": "string", "format": "uuid" }, "scope": { "enum": [ "team", "company" ] }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "row_version": { "type": "integer" }, "key_version": { "type": "integer" }, "note": { "type": "object", "description": "the sealed note { nonce, ct }" } } }, "KbE2ePutAnswer": { "title": "KbE2ePutAnswer", "type": "object", "description": "the stored note's version; the knowledge service's own answer, passed through with its status", "properties": { "replay": { "type": "boolean" }, "row_version": { "type": "integer" }, "existing": { "type": "boolean" } } }, "KbE2eUnavailable": { "title": "KbE2eUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unavailable" }, "detail": { "type": "string" } } }, "KbE2eWriteConflict": { "title": "KbE2eWriteConflict", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "e2e_note_version_conflict (current_version), e2e_mode_off, conflict" }, "detail": { "type": "string" }, "current_version": { "type": [ "integer", "null" ] } } }, "KbE2eWriteForbidden": { "title": "KbE2eWriteForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden (a non-team scope, a note outside the host's team)" }, "detail": { "type": "string" } } }, "KbE2eWriteInvalid": { "title": "KbE2eWriteInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value" }, "detail": { "type": "string" } } }, "KbNoteVersionConflict": { "title": "KbNoteVersionConflict", "type": "object", "required": [ "error", "current_version" ], "properties": { "error": { "const": "e2e_note_version_conflict" }, "current_version": { "type": [ "integer", "null" ] } } }, "LegalConsentAccepted": { "title": "LegalConsentAccepted", "type": "object", "required": [ "created" ], "properties": { "created": { "type": "boolean", "description": "false on a repeat" }, "acceptance": { "type": "object" } } }, "LegalConsentHistory": { "title": "LegalConsentHistory", "type": "object", "required": [ "consents" ], "additionalProperties": false, "properties": { "consents": { "type": "array", "items": { "type": "object" } } } }, "LegalConsentRequest": { "title": "LegalConsentRequest", "type": "object", "required": [ "version" ], "properties": { "version": { "type": "string" } } }, "LegalConsentState": { "title": "LegalConsentState", "type": "object", "required": [ "pending" ], "properties": { "current_version": { "type": [ "string", "null" ] }, "accepted_version": { "type": [ "string", "null" ] }, "accepted_at": { "type": [ "string", "null" ], "format": "date-time" }, "pending": { "type": "boolean" }, "locale": { "type": [ "string", "null" ] }, "urls": { "type": [ "object", "null" ], "properties": { "terms": { "type": "string" }, "privacy": { "type": "string" }, "dpa": { "type": "string" } } } }, "description": "a caller with no tenant gets pending false and nulls" }, "LegalFailed": { "title": "LegalFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "legal_consent_failed" }, "detail": { "type": "string" } } }, "LegalForbidden": { "title": "LegalForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden (an automation, CLI, host or device credential, or a role without legal.consent.list), or csrf_token mismatch" }, "detail": { "type": "string" } } }, "LegalTermsUnavailable": { "title": "LegalTermsUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "legal_terms_unavailable" }, "detail": { "type": "string" } } }, "LegalVersionNotCurrent": { "title": "LegalVersionNotCurrent", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "legal_version_not_current" }, "detail": { "type": "string" } } }, "LicenceFeatureRefusal": { "title": "LicenceFeatureRefusal", "type": "object", "required": [ "error", "feature" ], "properties": { "error": { "const": "license_feature_not_included" }, "feature": { "type": "string" } } }, "LicenceInboxBadBody": { "title": "LicenceInboxBadBody", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "invalid_body" } } }, "LicenceInboxEvent": { "title": "LicenceInboxEvent", "type": "object", "required": [ "event_id", "type", "occurred_at", "tenant", "idempotency_key", "payload" ], "additionalProperties": false, "properties": { "event_id": { "type": "string", "format": "uuid" }, "type": { "enum": [ "licence.applied", "audit.event", "usage.drift" ] }, "occurred_at": { "type": "string", "format": "date-time" }, "tenant": { "type": "object", "required": [ "kind", "id" ], "additionalProperties": false, "properties": { "kind": { "enum": [ "company", "solo", "install" ] }, "id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$" } } }, "idempotency_key": { "type": "string", "minLength": 1, "maxLength": 200 }, "request_id": { "type": [ "string", "null" ], "maxLength": 128 }, "payload": { "type": "object", "description": "the schema of the type in scripts/lib/license/events.js SERVICE_EVENT_SCHEMAS; at most 16 KiB" } }, "description": "the service -> hub envelope; the body is at most 32 KiB" }, "LicenceInboxEventConflict": { "title": "LicenceInboxEventConflict", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "event_id_conflict" } }, "description": "the event_id is stored with another type" }, "LicenceInboxInvalidEvent": { "title": "LicenceInboxInvalidEvent", "type": "object", "required": [ "error", "field", "rule" ], "properties": { "error": { "const": "invalid_event" }, "field": { "type": "string" }, "rule": { "type": "string" } } }, "LicenceInboxReceipt": { "title": "LicenceInboxReceipt", "type": "object", "required": [ "status", "event_id" ], "additionalProperties": false, "properties": { "status": { "enum": [ "applied", "duplicate" ] }, "event_id": { "type": "string", "format": "uuid" } } }, "LicenceInboxTooLarge": { "title": "LicenceInboxTooLarge", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "invalid_body" } } }, "LicenceInboxUnavailable": { "title": "LicenceInboxUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "database_not_ready, inbox_unavailable, inbox_apply_failed (the row keeps the error; a retry of the event_id applies it again)" } } }, "LicenseView": { "title": "LicenseView", "type": "object", "required": [ "configured", "status" ], "properties": { "configured": { "type": "boolean" }, "status": { "type": [ "string", "null" ] }, "reason": { "description": "authenticated callers; the loader reason, absent when none" }, "tier": { "type": [ "string", "null" ] }, "expires_at": { "description": "claims.exp; authenticated callers" }, "grace_until": { "description": "authenticated callers" }, "days_until_expiry": { "type": [ "number", "null" ], "description": "authenticated callers" }, "in_grace": { "type": "boolean" }, "hard_expired": { "type": "boolean" }, "seats": { "description": "claims.seats; admin only" }, "seats_used": { "description": "admin only: install-wide usage, or { error: unavailable } when the count failed", "oneOf": [ { "type": "null" }, { "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "const": "unavailable" } } }, { "type": "object", "required": [ "users", "hosts", "total", "limit", "hard_cap", "grace_pct" ], "additionalProperties": false, "properties": { "users": { "type": "integer" }, "hosts": { "type": "integer" }, "total": { "type": "integer" }, "limit": {}, "hard_cap": {}, "grace_pct": {} } } ] }, "aud": { "description": "licensed FQDN; admin only" }, "features": { "type": "array", "items": { "type": "string" }, "description": "admin only" }, "issued_at": { "description": "claims.iat; admin only" }, "pubkey_fingerprint": { "description": "admin only" }, "loaded_at": { "description": "admin only" } } }, "LocalSessionCreate": { "title": "LocalSessionCreate", "type": "object", "required": [ "host_id", "local_session_id" ], "properties": { "host_id": { "type": "string", "format": "uuid" }, "local_session_id": { "type": "string" }, "cwd": { "type": "string" }, "user": { "type": "string", "description": "the operating-system user" }, "started_at": { "type": "string", "format": "date-time" } } }, "LocalSessionCreated": { "title": "LocalSessionCreated", "type": "object", "required": [ "session_id" ], "additionalProperties": false, "properties": { "session_id": { "type": "string", "format": "uuid" } } }, "LocalSessionExit": { "title": "LocalSessionExit", "type": "object", "properties": { "exit_code": { "type": [ "integer", "null" ] } } }, "LocalSessionExited": { "title": "LocalSessionExited", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } } }, "LogoutFailed": { "title": "LogoutFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "logout_failed" }, "detail": { "type": "string" } } }, "LogoutNoSession": { "title": "LogoutNoSession", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "no_session" }, "detail": { "type": "string" } } }, "MasterEscrowRequest": { "title": "MasterEscrowRequest", "type": "object", "required": [ "wrapped_master_team_dek" ], "properties": { "wrapped_master_team_dek": { "type": "string", "pattern": "^[0-9a-fA-F]{184}$", "description": "exactly 92 bytes as hex" } } }, "McpAuthRequired": { "title": "McpAuthRequired", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "auth required" }, "oauth_error": { "type": "string" } }, "description": "WWW-Authenticate carries the challenge" }, "McpAuthUnavailable": { "title": "McpAuthUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "auth_unavailable" }, "detail": { "type": "string" }, "reason": { "type": "string" } } }, "McpMethodNotAllowed": { "title": "McpMethodNotAllowed", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "method_not_allowed" } } }, "MembershipsRewrapped": { "title": "MembershipsRewrapped", "type": "object", "required": [ "ok", "updated" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "updated": { "type": "integer" } } }, "MemoryNoteList": { "title": "MemoryNoteList", "type": "object", "required": [ "notes" ], "additionalProperties": false, "properties": { "notes": { "type": "array", "maxItems": 500, "items": { "type": "object", "required": [ "id", "ref_id", "created_at", "provenance", "size", "versions" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "ref_id": { "type": "string" }, "created_at": { "type": "string" }, "provenance": { "type": [ "string", "null" ] }, "size": { "type": "integer" }, "versions": { "type": "integer" } } } } } }, "MemoryNoteRestoreRequest": { "title": "MemoryNoteRestoreRequest", "type": "object", "required": [ "version_id" ], "properties": { "version_id": { "type": "string", "format": "uuid" } } }, "MemoryNoteRestored": { "title": "MemoryNoteRestored", "type": "object", "required": [ "id", "ref_id", "restored_from" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "ref_id": { "type": "string" }, "restored_from": { "type": "string", "format": "uuid" } } }, "MemoryNoteVersions": { "title": "MemoryNoteVersions", "type": "object", "required": [ "ref_id", "bound", "versions" ], "additionalProperties": false, "properties": { "ref_id": { "type": "string" }, "bound": { "type": [ "integer", "null" ], "description": "the number of versions kept per note" }, "versions": { "type": "array", "items": { "type": "object", "required": [ "id", "created_at", "provenance", "created_by", "size", "head", "restored_from" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string" }, "provenance": { "type": [ "string", "null" ] }, "created_by": { "type": [ "string", "null" ] }, "size": { "type": "integer" }, "head": { "type": "boolean" }, "restored_from": { "type": [ "string", "null" ] } } } } } }, "MetricsExposition": { "title": "MetricsExposition", "type": "string", "description": "Prometheus text format 0.0.4" }, "MetricsForbidden": { "title": "MetricsForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden" }, "detail": { "type": "string" } } }, "NoteTokenPair": { "title": "NoteTokenPair", "type": "object", "required": [ "team_id", "token_type", "access_token", "access_token_id", "access_expires_at", "refresh_token", "refresh_expires_at", "chain_id", "refresh", "token", "note", "deprecation" ], "additionalProperties": false, "properties": { "team_id": { "type": "string", "format": "uuid" }, "token_type": { "const": "Bearer" }, "access_token": { "type": "string" }, "access_token_id": { "type": "string", "format": "uuid" }, "access_expires_at": { "type": "string", "format": "date-time" }, "refresh_token": { "type": "string" }, "refresh_expires_at": { "type": "string", "format": "date-time" }, "chain_id": { "type": "string", "format": "uuid" }, "refresh": { "const": "POST /api/auth/automation/refresh" }, "token": { "type": "string", "description": "the access token again" }, "note": { "type": "string" }, "deprecation": { "type": "object", "required": [ "deprecated", "replacement", "message" ], "additionalProperties": false, "properties": { "deprecated": { "const": true }, "replacement": { "type": "string" }, "message": { "type": "string" } } } } }, "NotesSearchBadRequest": { "title": "NotesSearchBadRequest", "type": "object", "properties": { "error": { "type": "string" }, "detail": { "type": "string" } } }, "NotesSearchRequest": { "title": "NotesSearchRequest", "type": "object", "required": [ "q" ], "properties": { "q": { "type": "string", "minLength": 1, "description": "trimmed; empty is 422 value_required" }, "limit": { "type": "integer", "maximum": 50, "default": 10 }, "mode": { "type": "string", "default": "keyword", "description": "forwarded to the knowledge service" }, "team_id": { "type": "string", "format": "uuid", "description": "one visible team" } } }, "NotesSearchResponse": { "title": "NotesSearchResponse", "type": "object", "required": [ "results" ], "properties": { "results": { "type": "array", "items": { "type": "object" }, "description": "hits as the knowledge service returns them; [] when the caller sees no team" } } }, "NotificationCount": { "title": "NotificationCount", "type": "object", "required": [ "unread" ], "additionalProperties": false, "properties": { "unread": { "type": "integer" } } }, "NotificationDismissed": { "title": "NotificationDismissed", "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" } } }, "NotificationList": { "title": "NotificationList", "type": "object", "required": [ "notifications" ], "additionalProperties": false, "properties": { "notifications": { "type": "array", "items": { "type": "object", "required": [ "id", "category", "severity", "title", "created_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "category": { "type": "string" }, "severity": { "type": "string", "description": "info, warn, error or critical" }, "title": { "type": "string" }, "body": { "type": [ "string", "null" ] }, "link": { "type": [ "string", "null" ] }, "meta": { "type": [ "object", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "read_at": { "type": [ "string", "null" ], "format": "date-time" }, "dismissed_at": { "type": [ "string", "null" ], "format": "date-time" }, "snoozed_until": { "type": [ "string", "null" ], "format": "date-time" }, "source_ref": { "type": [ "string", "null" ] } } } } } }, "NotificationPreferences": { "title": "NotificationPreferences", "type": "object", "required": [ "categories", "browser_push" ], "additionalProperties": false, "properties": { "categories": { "type": "object", "description": "category -> { severity: cadence }; {} when none are stored" }, "browser_push": { "type": "boolean" } } }, "NotificationPreferencesSaved": { "title": "NotificationPreferencesSaved", "type": "object", "required": [ "updated" ], "additionalProperties": false, "properties": { "updated": { "const": true } } }, "NotificationRead": { "title": "NotificationRead", "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" } } }, "NotificationSnoozeRequest": { "title": "NotificationSnoozeRequest", "type": "object", "required": [ "until" ], "properties": { "until": { "type": "string", "description": "ISO 8601 timestamp" } } }, "NotificationSnoozed": { "title": "NotificationSnoozed", "type": "object", "required": [ "id", "snoozed_until" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "snoozed_until": { "type": "string" } } }, "OauthAuthorizeOff": { "title": "OauthAuthorizeOff", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "not_found" } } }, "OauthAuthorizePage400": { "title": "OauthAuthorizePage400", "type": "string" }, "OauthAuthorizePage429": { "title": "OauthAuthorizePage429", "type": "string" }, "OauthAuthorizePage500": { "title": "OauthAuthorizePage500", "type": "string" }, "OauthAuthorizePage503": { "title": "OauthAuthorizePage503", "type": "string" }, "OauthAuthorizeRedirect": { "title": "OauthAuthorizeRedirect", "type": "object", "description": "no body; Location is /fleet/oauth/consent?request= with a Set-Cookie binding the request, or the client redirect URI with an error" }, "OauthClientRegistered": { "title": "OauthClientRegistered", "type": "object", "additionalProperties": false, "required": [ "client_id", "client_id_issued_at", "client_name", "redirect_uris", "grant_types", "response_types", "token_endpoint_auth_method" ], "properties": { "client_id": { "type": "string", "pattern": "^cdc_" }, "client_id_issued_at": { "type": "integer" }, "client_name": { "type": "string" }, "redirect_uris": { "type": "array", "items": { "type": "string" } }, "grant_types": { "type": "array", "items": { "type": "string" } }, "response_types": { "type": "array", "items": { "type": "string" } }, "token_endpoint_auth_method": { "const": "none" } } }, "OauthCompanyGrantList": { "title": "OauthCompanyGrantList", "type": "object", "required": [ "grants" ], "additionalProperties": false, "properties": { "grants": { "type": "array", "maxItems": 500, "items": { "type": "object", "additionalProperties": false, "required": [ "id", "client_id", "client_name", "client_kind", "scopes", "team_id", "team_name", "created_at", "last_used_at", "user_id", "user_email" ], "properties": { "id": { "type": "string", "format": "uuid" }, "client_id": { "type": "string" }, "client_name": { "type": [ "string", "null" ] }, "client_kind": { "enum": [ "dcr", "cimd", null ] }, "scopes": { "type": "array", "items": { "enum": [ "mcp:read", "mcp:write", "mcp:secrets", "mcp:secrets.reveal" ] } }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "team_name": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "last_used_at": { "type": [ "string", "null" ], "format": "date-time" }, "client_host": { "type": [ "string", "null" ], "description": "CIMD clients: the host of the client_id URL" }, "unverified": { "const": true, "description": "DCR clients" }, "user_id": { "type": "string", "format": "uuid" }, "user_email": { "type": [ "string", "null" ] } } } } } }, "OauthCompanySettings": { "title": "OauthCompanySettings", "type": "object", "required": [ "third_party_clients_enabled", "client_allowlist", "updated_at", "updated_by" ], "additionalProperties": false, "properties": { "third_party_clients_enabled": { "type": "boolean" }, "client_allowlist": { "type": [ "array", "null" ], "items": { "type": "string" }, "description": "null admits every client" }, "updated_at": { "type": [ "string", "null" ], "format": "date-time" }, "updated_by": { "type": [ "string", "null" ], "format": "uuid" } } }, "OauthCompanySettingsRequest": { "title": "OauthCompanySettingsRequest", "type": "object", "additionalProperties": false, "description": "at least one field; an absent field keeps its value", "properties": { "third_party_clients_enabled": { "type": "boolean" }, "client_allowlist": { "type": [ "array", "null" ], "items": { "type": "string" }, "description": "client ids (cdc_... or a CIMD https URL); null admits every client" } } }, "OauthCompanySettingsSaved": { "title": "OauthCompanySettingsSaved", "allOf": [ { "type": "object", "required": [ "third_party_clients_enabled", "client_allowlist", "updated_at", "updated_by" ], "additionalProperties": false, "properties": { "third_party_clients_enabled": { "type": "boolean" }, "client_allowlist": { "type": [ "array", "null" ], "items": { "type": "string" }, "description": "null admits every client" }, "updated_at": { "type": [ "string", "null" ], "format": "date-time" }, "updated_by": { "type": [ "string", "null" ], "format": "uuid" } } } ], "type": "object", "required": [ "grants_revoked" ], "properties": { "grants_revoked": { "type": "integer", "description": "the number of live grants the new settings closed" } } }, "OauthConsentDecided": { "title": "OauthConsentDecided", "type": "object", "required": [ "decision", "redirect_to" ], "properties": { "decision": { "enum": [ "approved", "denied" ] }, "redirect_to": { "type": "string", "description": "where the browser goes next: back to the client with code and state" } } }, "OauthConsentDecision": { "title": "OauthConsentDecision", "type": "object", "required": [ "decision" ], "properties": { "decision": { "enum": [ "approve", "deny" ] }, "team_id": { "type": [ "string", "null" ], "format": "uuid", "description": "required when more than one team is eligible" }, "reauth_token": { "type": "string", "description": "required when the view says step_up_required" } } }, "OauthConsentRefused": { "title": "OauthConsentRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "field": { "type": "string" } }, "description": "oauth_step_up_required, oauth_step_up_invalid, team_membership_required, oauth_platform_admin_refused, oauth_tenant_required, or a tenant gate refusal" }, "OauthConsentView": { "title": "OauthConsentView", "type": "object", "additionalProperties": false, "required": [ "client", "redirect_uri", "redirect_kind", "scopes", "reveal_requested", "expires_at", "solo", "e2ee", "teams", "step_up_required" ], "properties": { "client": { "type": "object", "required": [ "client_id", "kind", "name" ], "properties": { "client_id": { "type": "string" }, "kind": { "enum": [ "dcr", "cimd" ] }, "name": { "type": [ "string", "null" ] }, "host": { "type": [ "string", "null" ] }, "verified_host": { "const": true }, "unverified": { "const": true } } }, "redirect_uri": { "type": [ "string", "null" ], "description": "null for an https return target" }, "redirect_kind": { "type": "string" }, "scopes": { "type": "array", "items": { "enum": [ "mcp:read", "mcp:write", "mcp:secrets", "mcp:secrets.reveal" ] } }, "reveal_requested": { "type": "boolean" }, "expires_at": {}, "solo": { "type": "boolean" }, "e2ee": { "type": "boolean" }, "teams": { "type": "array", "items": { "type": "object", "required": [ "id", "name" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" } } } }, "step_up_required": { "type": "boolean" } } }, "OauthGrantList": { "title": "OauthGrantList", "type": "object", "required": [ "grants" ], "additionalProperties": false, "properties": { "grants": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "client_id", "client_name", "client_kind", "scopes", "team_id", "team_name", "created_at", "last_used_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "client_id": { "type": "string" }, "client_name": { "type": [ "string", "null" ] }, "client_kind": { "enum": [ "dcr", "cimd", null ] }, "scopes": { "type": "array", "items": { "enum": [ "mcp:read", "mcp:write", "mcp:secrets", "mcp:secrets.reveal" ] } }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "team_name": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "last_used_at": { "type": [ "string", "null" ], "format": "date-time" }, "client_host": { "type": [ "string", "null" ], "description": "CIMD clients: the host of the client_id URL" }, "unverified": { "const": true, "description": "DCR clients" } } } } } }, "OauthGrantRevoked": { "title": "OauthGrantRevoked", "type": "object", "required": [ "grant_id", "revoked" ], "additionalProperties": false, "properties": { "grant_id": { "type": "string", "format": "uuid" }, "revoked": { "const": true } } }, "OauthJwks": { "title": "OauthJwks", "type": "object", "required": [ "keys" ], "additionalProperties": false, "properties": { "keys": { "type": "array", "items": { "type": "object", "description": "a JWK" } } } }, "OauthNotFound": { "title": "OauthNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "OauthPayloadTooLarge": { "title": "OauthPayloadTooLarge", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "OauthRateLimited": { "title": "OauthRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "retry_after": { "type": "integer" } } }, "OauthRegisterError": { "title": "OauthRegisterError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } } }, "OauthRegisterRequest": { "title": "OauthRegisterRequest", "type": "object", "properties": { "client_name": { "type": "string", "maxLength": 128 }, "redirect_uris": { "type": "array", "minItems": 1, "maxItems": 5, "items": { "type": "string" } }, "grant_types": { "type": "array", "items": { "enum": [ "authorization_code", "refresh_token" ] } }, "response_types": { "type": "array", "items": { "const": "code" } }, "token_endpoint_auth_method": { "type": "string", "description": "accepted, the answer is always none" } }, "description": "other members are ignored" }, "OauthRevokeRequest": { "title": "OauthRevokeRequest", "type": "object", "required": [ "token", "client_id" ], "properties": { "token": { "type": "string" }, "client_id": { "type": "string" }, "token_type_hint": { "type": "string" } } }, "OauthRevokeResponse": { "title": "OauthRevokeResponse", "type": "object", "additionalProperties": false, "description": "always {}" }, "OauthServerMetadata": { "title": "OauthServerMetadata", "type": "object", "additionalProperties": false, "required": [ "issuer", "authorization_endpoint", "token_endpoint", "registration_endpoint", "revocation_endpoint", "jwks_uri", "scopes_supported", "response_types_supported", "response_modes_supported", "grant_types_supported", "code_challenge_methods_supported", "token_endpoint_auth_methods_supported", "revocation_endpoint_auth_methods_supported", "authorization_response_iss_parameter_supported", "client_id_metadata_document_supported" ], "properties": { "issuer": { "type": "string" }, "authorization_endpoint": { "type": "string" }, "token_endpoint": { "type": "string" }, "registration_endpoint": { "type": "string" }, "revocation_endpoint": { "type": "string" }, "jwks_uri": { "type": "string" }, "scopes_supported": { "type": "array", "items": { "enum": [ "mcp:read", "mcp:write", "mcp:secrets", "mcp:secrets.reveal" ] } }, "response_types_supported": { "const": [ "code" ] }, "response_modes_supported": { "const": [ "query" ] }, "grant_types_supported": { "type": "array", "items": { "enum": [ "authorization_code", "refresh_token" ] } }, "code_challenge_methods_supported": { "const": [ "S256" ] }, "token_endpoint_auth_methods_supported": { "const": [ "none" ] }, "revocation_endpoint_auth_methods_supported": { "const": [ "none" ] }, "authorization_response_iss_parameter_supported": { "const": true }, "client_id_metadata_document_supported": { "const": true } } }, "OauthTokenError": { "title": "OauthTokenError", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "error_description": { "type": "string" } } }, "OauthTokenRequest": { "title": "OauthTokenRequest", "type": "object", "required": [ "grant_type" ], "properties": { "grant_type": { "enum": [ "authorization_code", "refresh_token" ] }, "client_id": { "type": "string" }, "code": { "type": "string" }, "redirect_uri": { "type": "string" }, "code_verifier": { "type": "string" }, "refresh_token": { "type": "string" }, "scope": { "type": "string" }, "resource": { "type": "string" } } }, "OauthTokenResponse": { "title": "OauthTokenResponse", "type": "object", "additionalProperties": false, "required": [ "access_token", "token_type", "expires_in", "refresh_token", "scope" ], "properties": { "access_token": { "type": "string", "description": "ES256 at+jwt for the hub MCP resource" }, "token_type": { "const": "Bearer" }, "expires_in": { "type": "integer" }, "refresh_token": { "type": "string" }, "scope": { "type": "string", "description": "space-separated" } } }, "OkTrue": { "title": "OkTrue", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } } }, "OpaqueStartResponse": { "title": "OpaqueStartResponse", "type": "object", "required": [ "ke2", "state_id" ], "properties": { "ke2": { "type": "string" }, "state_id": { "type": "string" } } }, "OpenApiDocument": { "title": "OpenApiDocument", "type": "object", "required": [ "openapi", "info", "paths" ], "properties": { "openapi": { "const": "3.1.0" }, "info": { "type": "object", "required": [ "title", "version" ], "properties": { "title": { "type": "string" }, "version": { "type": "string", "description": "CALDYR_VERSION (unversioned when the build passed none), then + and the first 12 hex digits of CALDYR_GIT_SHA when the build passed one" }, "description": { "type": "string" } } }, "servers": { "type": "array", "items": { "type": "object" } }, "tags": { "type": "array", "items": { "type": "object" } }, "paths": { "type": "object" }, "components": { "type": "object" } }, "description": "this document" }, "OpenApiDocumentHead": { "title": "OpenApiDocumentHead", "type": "object", "required": [ "openapi", "info", "paths" ], "properties": { "openapi": { "const": "3.1.0" }, "info": { "type": "object", "required": [ "title", "version" ], "properties": { "title": { "type": "string" }, "version": { "type": "string", "description": "CALDYR_VERSION (unversioned when the build passed none), then + and the first 12 hex digits of CALDYR_GIT_SHA when the build passed one" }, "description": { "type": "string" } } }, "servers": { "type": "array", "items": { "type": "object" } }, "tags": { "type": "array", "items": { "type": "object" } }, "paths": { "type": "object" }, "components": { "type": "object" } }, "description": "the headers GET would send; a HEAD request carries no body" }, "OpenApiUnavailable": { "title": "OpenApiUnavailable", "type": "object", "required": [ "error" ], "additionalProperties": false, "properties": { "error": { "const": "openapi_unavailable" } }, "description": "the committed document could not be read or parsed; Cache-Control no-store" }, "OverrideRefusal": { "title": "OverrideRefusal", "type": "object", "required": [ "error", "detail" ], "properties": { "error": { "enum": [ "invalid_value", "value_required" ] }, "detail": { "type": "string" } } }, "OverrideRoleRefusal": { "title": "OverrideRoleRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "forbidden" }, "detail": { "type": "string" } } }, "OwnerRequired": { "title": "OwnerRequired", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "forbidden" }, "detail": { "type": "string" } } }, "OwnerRequiresLocalCredential": { "title": "OwnerRequiresLocalCredential", "type": "object", "required": [ "error", "code" ], "properties": { "error": { "type": "string", "enum": [ "owner_requires_local_credential" ] }, "code": { "type": "string", "enum": [ "owner_requires_local_credential" ] }, "detail": { "type": "string" } } }, "PasskeyChallengeGone": { "title": "PasskeyChallengeGone", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "challenge_expired_or_unknown" }, "detail": { "type": "string" } } }, "PasskeyFinishBadRequest": { "title": "PasskeyFinishBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value, invalid_body" }, "detail": { "type": "string" } } }, "PasskeyFinishRequest": { "title": "PasskeyFinishRequest", "type": "object", "required": [ "challenge_id", "credential" ], "properties": { "challenge_id": { "type": "string" }, "credential": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "base64url credential id" }, "rawId": { "type": "string" }, "type": { "type": "string" }, "response": { "type": "object" }, "clientExtensionResults": { "type": "object" } }, "description": "the WebAuthn assertion or attestation as the browser returned it" }, "email": { "type": "string" } } }, "PasskeyNotAccepted": { "title": "PasskeyNotAccepted", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "passkey_not_accepted" }, "detail": { "type": "string" } } }, "PasskeyOptions": { "title": "PasskeyOptions", "type": "object", "required": [ "challenge_id", "expires_at", "publicKey" ], "additionalProperties": false, "properties": { "challenge_id": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" }, "publicKey": { "type": "object", "description": "PublicKeyCredentialRequestOptionsJSON" } } }, "PasskeyOptionsBadRequest": { "title": "PasskeyOptionsBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_body" }, "detail": { "type": "string" } } }, "PasskeyOptionsFailed": { "title": "PasskeyOptionsFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "options_failed" }, "detail": { "type": "string" } } }, "PasskeyOptionsRequest": { "title": "PasskeyOptionsRequest", "type": "object", "required": [ "email" ], "properties": { "email": { "type": "string", "maxLength": 320 } } }, "PasskeyRateLimited": { "title": "PasskeyRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "retry_after_ms": { "type": "integer" }, "retry_after_seconds": { "type": "integer" } }, "description": "Retry-After is set" }, "PasskeySignIn": { "title": "PasskeySignIn", "type": "object", "required": [ "token", "csrf_token", "expires_at", "user", "memberships", "factor" ], "properties": { "token": { "type": "string" }, "csrf_token": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" }, "user": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "email": { "type": "string" }, "role": { "type": "string" }, "kind": { "type": "string" } } }, "kdf_salt": { "type": [ "string", "null" ] }, "seed_kdf_salt": { "type": [ "string", "null" ] }, "wrapped_master": { "type": [ "string", "null" ] }, "memberships": { "type": "array", "items": { "type": "object", "properties": { "team_id": { "type": "string", "format": "uuid" }, "role": { "type": "string" }, "wrapped_team_dek": { "type": [ "string", "null" ] }, "has_master_escrow": { "type": [ "boolean", "null" ] }, "wrapped_master_team_dek": { "type": [ "string", "null" ] } } } }, "e2e_mode": { "type": [ "string", "null" ], "enum": [ "on", "off", null ] }, "totp_enrolment_required": { "type": "boolean" }, "factor": { "const": "passkey" }, "prf_wrapped_master": { "type": "string", "description": "hex; absent on the admin host or for a legacy salt" }, "prf_wrap_kind": { "enum": [ "solo", "company" ] } }, "description": "sets the session cookie; the same sign-in body as the OPAQUE sign-in plus the passkey fields" }, "PasskeyUnauthorized": { "title": "PasskeyUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized, auth_required" }, "detail": { "type": "string" } } }, "PasskeyWrongSubdomain": { "title": "PasskeyWrongSubdomain", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "wrong_subdomain" }, "detail": { "type": "string" } } }, "PassphraseChanged": { "title": "PassphraseChanged", "type": "object", "required": [ "ok", "rotated_at", "password_rotated", "memberships_rewrapped" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "rotated_at": { "type": "string", "format": "date-time" }, "password_rotated": { "type": "boolean" }, "memberships_rewrapped": { "type": "integer" } } }, "PasswordChangeBadRequest": { "title": "PasswordChangeBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, bad_request, or a body-parse code" }, "detail": { "type": "string" } } }, "PasswordChangeConflict": { "title": "PasswordChangeConflict", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "password_is_also_vault_key, conflict" }, "detail": { "type": "string" } } }, "PasswordChangeForbidden": { "title": "PasswordChangeForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "reauth_required, opaque_ticket_invalid, account_unavailable, or csrf_token mismatch" }, "detail": { "type": "string" } } }, "PasswordChangeRequest": { "title": "PasswordChangeRequest", "type": "object", "required": [ "reauth_token", "credential_id", "record" ], "properties": { "reauth_token": { "type": "string", "description": "from POST /auth/opaque/reauth/finish for this session and purpose" }, "credential_id": { "type": "string", "format": "uuid", "description": "from POST /auth/opaque/register/start under a session ticket" }, "record": { "type": "string", "description": "the OPAQUE registration record, 192 bytes base64url" } } }, "PasswordChangeRevokeIncomplete": { "title": "PasswordChangeRevokeIncomplete", "type": "object", "required": [ "error", "password_changed", "revoke_failed" ], "properties": { "error": { "const": "credential_changed_revoke_incomplete" }, "password_changed": { "const": true }, "revoke_failed": { "type": "array", "items": { "type": "string" } }, "detail": { "type": "string" }, "password_rotated": { "type": "boolean" }, "memberships_rewrapped": { "type": "integer" } }, "description": "the credential change is committed but not every session or token could be revoked; repeat the change" }, "PasswordChanged": { "title": "PasswordChanged", "type": "object", "required": [ "ok", "sessions_revoked", "reauth_required" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "sessions_revoked": { "type": "integer" }, "reauth_required": { "const": true } } }, "PasswordLoginRemoved": { "title": "PasswordLoginRemoved", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "password_login_removed" }, "detail": { "type": "string" } } }, "PasswordLoginRemoved2": { "title": "PasswordLoginRemoved2", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "password_login_removed" }, "detail": { "type": "string" } } }, "PasswordLoginRemoved3": { "title": "PasswordLoginRemoved3", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "password_login_removed" }, "detail": { "type": "string" } } }, "PasswordLoginRemoved4": { "title": "PasswordLoginRemoved4", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "password_login_removed" }, "detail": { "type": "string" } } }, "PasswordLoginRemoved5": { "title": "PasswordLoginRemoved5", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "password_login_removed" }, "detail": { "type": "string" } } }, "PatchFleetFeaturesFeatureIdRequest": { "type": "object", "required": [ "enabled" ], "properties": { "enabled": { "type": "boolean" } } }, "PatchFleetFeaturesFeatureIdResponse200": { "type": "object", "required": [ "name", "enabled" ], "properties": { "name": { "type": "string" }, "enabled": { "type": "boolean" } } }, "PatchFleetHostsHostIdRequest": { "type": "object", "properties": { "display_name": { "type": [ "string", "null" ] }, "capabilities": { "type": "array", "items": { "type": "string" } }, "max_concurrent_sessions": { "type": [ "integer", "null" ], "minimum": 1, "description": "null lifts the limit" }, "source": { "type": "string", "description": "'daemon' keeps the limit daemon-reported; anything else marks it set by the server" } } }, "PatchFleetSessionsSessionIdRequest": { "type": "object", "required": [ "meta" ], "properties": { "meta": { "title": "SessionMetaSealed", "type": "object", "required": [ "ciphertext", "nonce" ], "properties": { "ciphertext": { "type": "string" }, "nonce": { "type": "string" }, "aadVersion": { "description": "2 for a team end-to-end or Solo session; 1 or 2 otherwise" }, "blindIndex": { "type": "array", "description": "blind-index entries (not for an end-to-end session)" } } } } }, "PatchFleetWorkflowsWorkflowIdRequest": { "type": "object", "properties": { "name": { "type": "string" }, "description": { "type": [ "string", "null" ] }, "definition": { "anyOf": [ { "type": "object", "description": "a plain workflow definition (start node and nodes)" }, { "title": "WorkflowEnvelope", "type": "object", "required": [ "enc_v", "nonce", "ct" ], "additionalProperties": false, "properties": { "enc_v": { "const": 2 }, "nonce": { "type": "string", "pattern": "^[0-9a-f]{48}$" }, "ct": { "type": "string", "pattern": "^(?:[0-9a-f]{2})+$", "minLength": 34, "maxLength": 2097152 } } } ] }, "expected_version": { "type": "integer", "description": "refused 409 conflict when the row moved on" } } }, "PatchNotesNoteIdRequest": { "type": "object", "properties": { "title": { "type": "string", "description": "cut to 500 characters" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "at most 64 kept, each cut to 128 characters" }, "body": { "type": "string", "description": "at most 256 KiB of UTF-8" } } }, "PatchPlatformAdminArticlesArticleIdResponse200": { "type": "object", "additionalProperties": false, "required": [ "id", "scope", "source_path", "title", "tags", "created_by_user_id", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "scope": { "const": "global" }, "source_path": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": {}, "updated_at": {} } }, "PatchQuotasQuotaIdRequest": { "type": "object", "properties": { "cap_usd": { "type": [ "number", "string" ], "exclusiveMinimum": 0, "description": "more than 0; a numeric string is read with parseFloat" }, "warn_pct": { "type": "integer", "minimum": 1, "maximum": 99 }, "enabled": { "type": "boolean" }, "override_role": { "enum": [ "owner", "admin" ] }, "cap_mode": { "enum": [ "enforce", "warn", "notify" ] } }, "anyOf": [ { "required": [ "cap_usd" ] }, { "required": [ "warn_pct" ] }, { "required": [ "enabled" ] }, { "required": [ "override_role" ] }, { "required": [ "cap_mode" ] } ] }, "PatchTeamsTeamIdMcpServersMcpServerIdRequest": { "type": "object", "properties": { "transport": { "enum": [ "stdio", "http", "ws" ] }, "endpoint": { "type": "string", "pattern": "\\S" }, "auth_ref": { "description": "a secret reference; empty for none" }, "offered": { "description": "false hides the server from member picks" }, "mandatory": { "description": "true injects the server into every spawn (and offers it)" } } }, "PatchUsersUserIdRequest": { "type": "object", "minProperties": 1, "additionalProperties": false, "properties": { "display_name": { "type": "string", "minLength": 1, "maxLength": 200, "pattern": "\\S" }, "status": { "type": "string", "maxLength": 32, "enum": [ "active", "suspended" ] }, "role": { "type": "string", "maxLength": 32, "enum": [ "admin", "member", "viewer" ] } } }, "PlanAuthRequired": { "title": "PlanAuthRequired", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "PlanDocument": { "title": "PlanDocument", "type": "object", "additionalProperties": false, "required": [ "customer_id", "customer_kind", "tier", "state", "source", "trial", "seats", "seats_raw", "hosts", "sessions", "storage", "storage_measured", "storage_recording_paused", "retention_days", "siem", "features", "expires_at", "grace_until" ], "properties": { "customer_id": { "type": "string", "format": "uuid" }, "customer_kind": { "enum": [ "company", "solo" ] }, "tier": { "type": [ "string", "null" ] }, "state": { "enum": [ "ok", "grace", "read_only", "inert" ], "description": "resolveEntitlements state" }, "source": { "enum": [ "licence", "none" ] }, "trial": { "type": "boolean" }, "seats": { "type": "object", "required": [ "used", "limit" ], "additionalProperties": false, "properties": { "used": { "type": [ "integer", "null" ] }, "limit": { "type": [ "integer", "null" ], "description": "null = unlimited" } } }, "seats_raw": { "type": [ "integer", "null" ], "description": "the signed seat count verbatim (0 = unlimited)" }, "hosts": { "type": "object", "required": [ "used", "limit" ], "additionalProperties": false, "properties": { "used": { "type": [ "integer", "null" ] }, "limit": { "type": [ "integer", "null" ], "description": "null = unlimited" } } }, "sessions": { "type": "object", "required": [ "used", "limit" ], "additionalProperties": false, "properties": { "used": { "type": [ "integer", "null" ] }, "limit": { "type": [ "integer", "null" ], "description": "null = unlimited" } } }, "storage": { "type": "object", "required": [ "used_mb", "limit_mb" ], "additionalProperties": false, "properties": { "used_mb": { "type": [ "integer", "null" ] }, "limit_mb": { "type": [ "integer", "null" ] } } }, "storage_measured": { "type": "boolean" }, "storage_recording_paused": { "type": [ "boolean", "null" ] }, "retention_days": { "type": [ "integer", "null" ] }, "siem": { "description": "the licence siem entitlement, verbatim" }, "features": { "type": "array", "items": { "type": "string" } }, "expires_at": { "description": "licence expiry, verbatim" }, "grace_until": { "description": "end of the grace window, verbatim" } } }, "PlanLimitsSet": { "title": "PlanLimitsSet", "type": "object", "required": [ "ok", "changed", "prev", "overrides", "plan", "plan_defaults", "effective", "source", "licence", "enforcement" ], "properties": { "ok": { "const": true }, "changed": {}, "prev": {}, "overrides": { "type": "object" }, "plan": {}, "plan_defaults": { "type": [ "object", "null" ] }, "effective": { "type": [ "object", "null" ] }, "source": { "enum": [ "plan_limits", "licence" ] }, "licence": { "type": [ "object", "null" ] }, "enforcement": { "type": "object", "required": [ "enforced", "notice" ], "properties": { "enforced": { "type": "object" }, "notice": { "type": "string" } } } } }, "PlanLimitsView": { "title": "PlanLimitsView", "type": "object", "required": [ "company_id", "plan", "plan_defaults", "overrides", "effective", "source", "licence", "enforcement" ], "properties": { "company_id": { "type": "string", "format": "uuid" }, "plan": { "description": "plan key of the tenant" }, "plan_defaults": { "type": "object" }, "overrides": { "type": "object" }, "effective": { "type": "object" }, "source": { "enum": [ "plan_limits", "licence" ], "description": "licence: the numbers are the signed ones and the overrides are inert" }, "licence": { "type": [ "object", "null" ] }, "enforcement": { "type": "object", "required": [ "enforced", "notice" ], "properties": { "enforced": { "type": "object" }, "notice": { "type": "string" } } } } }, "PlatformActivated": { "title": "PlatformActivated", "type": "object", "required": [ "ok", "action", "licence", "plan" ], "properties": { "ok": { "const": true }, "action": { "enum": [ "activate", "deactivate" ] }, "licence": {}, "plan": {} } }, "PlatformActivationRequest": { "title": "PlatformActivationRequest", "type": "object", "required": [ "action" ], "properties": { "action": { "enum": [ "activate", "deactivate" ] }, "tier": { "type": "string", "description": "activate: a licence tier key" }, "days": { "type": "integer" }, "seats": { "type": "integer" } } }, "PlatformArticleDeleted": { "title": "PlatformArticleDeleted", "type": "object", "required": [ "deleted", "id" ], "additionalProperties": false, "properties": { "deleted": { "const": true }, "id": { "type": "string", "format": "uuid" } } }, "PlatformArticleList": { "title": "PlatformArticleList", "type": "object", "required": [ "articles" ], "additionalProperties": false, "properties": { "articles": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "scope", "source_path", "title", "tags", "created_by_user_id", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "scope": { "const": "global" }, "source_path": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": {}, "updated_at": {} } } } } }, "PlatformArticlePatch": { "title": "PlatformArticlePatch", "type": "object", "properties": { "title": { "type": "string", "minLength": 1, "maxLength": 300, "description": "trimmed" }, "body": { "type": "string", "description": "at most 256 KiB" }, "tags": { "type": "array", "items": { "type": "string" } } } }, "PlatformArticleRequest": { "title": "PlatformArticleRequest", "type": "object", "required": [ "title", "body" ], "properties": { "title": { "type": "string", "minLength": 1, "maxLength": 300, "description": "trimmed" }, "body": { "type": "string", "description": "at most 256 KiB" }, "tags": { "type": "array", "items": { "type": "string" } } } }, "PlatformCompanies": { "title": "PlatformCompanies", "type": "array", "items": { "type": "object", "required": [ "id", "name", "slug", "tier", "status", "created_at", "demo" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "slug": { "type": "string" }, "tier": { "type": "string" }, "status": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "demo": { "type": "boolean" } } } }, "PlatformCompanyCreateRetired": { "title": "PlatformCompanyCreateRetired", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "retired" }, "message": { "type": "string" } } }, "PlatformCompanyDeleted": { "title": "PlatformCompanyDeleted", "type": "object", "required": [ "ok", "deleted", "keys_purged", "services_purged" ], "properties": { "ok": { "const": true }, "deleted": {}, "keys_purged": {}, "services_purged": {} } }, "PlatformCompanyStatus": { "title": "PlatformCompanyStatus", "type": "object", "required": [ "ok", "status" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "status": { "type": "string" } } }, "PlatformCompanyTeams": { "title": "PlatformCompanyTeams", "type": "object", "required": [ "teams" ], "additionalProperties": false, "properties": { "teams": { "type": "array", "items": { "type": "object", "required": [ "id", "name", "slug" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "slug": { "type": "string" } } } } } }, "PlatformDemoLicenceRefused": { "title": "PlatformDemoLicenceRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "demo_licence_customer_not_demo" }, "tenants": { "type": "array", "items": { "type": "object" } } } }, "PlatformDemoTenantsReport": { "title": "PlatformDemoTenantsReport", "type": "object", "required": [ "tenants" ], "properties": { "tenants": { "type": "array", "items": { "type": "object", "required": [ "name", "action" ], "properties": { "name": { "type": "string" }, "display": { "type": [ "string", "null" ] }, "action": { "type": "string" }, "licence_issued": { "type": "boolean" }, "error_code": { "type": "string" } } } }, "credentials_delivery": { "type": "object" } } }, "PlatformDemoTenantsRequest": { "title": "PlatformDemoTenantsRequest", "type": "object", "properties": { "mode": { "enum": [ "provision", "reset" ], "default": "provision" }, "only": { "type": "string", "description": "one demo tenant by its stable name" } } }, "PlatformExpiringLicences": { "title": "PlatformExpiringLicences", "type": "object", "required": [ "licences" ], "additionalProperties": false, "properties": { "licences": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "customer_id", "customer", "customer_kind", "plan", "trial", "expires_at", "days_left" ], "properties": { "id": {}, "customer_id": { "type": "string", "format": "uuid" }, "customer": { "type": [ "string", "null" ] }, "customer_kind": { "type": "string" }, "plan": { "type": "string" }, "trial": { "type": "boolean" }, "expires_at": {}, "days_left": { "type": [ "integer", "number", "null" ] } } } } } }, "PlatformHealthBadRequest": { "title": "PlatformHealthBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "bad_request" }, "detail": { "type": "string" } } }, "PlatformHealthEnvelope": { "title": "PlatformHealthEnvelope", "type": "object", "required": [ "registry_schema_version", "api_contract_version", "generated_at", "cache", "overall", "capabilities", "components" ], "properties": { "registry_schema_version": { "type": [ "integer", "string" ] }, "api_contract_version": { "type": [ "integer", "string" ] }, "generated_at": { "type": "string", "format": "date-time" }, "cache": { "type": "object", "required": [ "hit", "age_ms" ], "properties": { "hit": { "type": "boolean" }, "age_ms": { "type": "integer" } } }, "overall": { "type": "object", "required": [ "mode", "attention_count" ], "properties": { "mode": { "const": "NO_SINGLE" }, "attention_count": { "type": "integer" } } }, "capabilities": { "type": "array", "items": { "type": "object" } }, "components": { "type": "array", "items": { "type": "object" } } }, "description": "always 200 for an authorized request whose collection ran; a degraded subsystem is a status in the body. Cache-Control no-store." }, "PlatformHealthForbidden": { "title": "PlatformHealthForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden" }, "detail": { "type": "string" } } }, "PlatformHealthRateLimited": { "title": "PlatformHealthRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "rate_limited" } }, "description": "Retry-After is set" }, "PlatformHealthUnauthorized": { "title": "PlatformHealthUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized" }, "detail": { "type": "string" } } }, "PlatformInviteConflict": { "title": "PlatformInviteConflict", "type": "object", "required": [ "ok", "error" ], "properties": { "ok": { "const": false }, "error": { "type": "string" } } }, "PlatformInviteOwnerRequest": { "title": "PlatformInviteOwnerRequest", "type": "object", "required": [ "owner_email", "company_name" ], "additionalProperties": false, "properties": { "owner_email": { "type": "string" }, "company_name": { "type": "string" }, "locale": { "type": "string" } } }, "PlatformInviteRefused": { "title": "PlatformInviteRefused", "type": "object", "required": [ "ok", "error" ], "properties": { "ok": { "const": false }, "error": { "type": "string" }, "fields": { "type": "array", "items": { "type": "string" } } } }, "PlatformMetricsText": { "title": "PlatformMetricsText", "type": "string", "description": "Prometheus text format 0.0.4" }, "PlatformOwnerInvited": { "title": "PlatformOwnerInvited", "type": "object", "additionalProperties": false, "required": [ "ok", "request_id", "status", "origin", "completion_expires_at", "superseded" ], "properties": { "ok": { "const": true }, "request_id": { "type": "string", "format": "uuid" }, "status": { "const": "approved" }, "origin": { "const": "owner_invite" }, "completion_expires_at": {}, "superseded": {} } }, "PlatformPlanLimitsRequest": { "title": "PlatformPlanLimitsRequest", "type": "object", "description": "at least one cap is required", "properties": { "max_agents": { "type": [ "integer", "null" ], "minimum": 0, "maximum": 100000, "description": "null clears the override" }, "max_siem_destinations": { "type": [ "integer", "null" ], "minimum": 0, "maximum": 100000, "description": "null clears the override" } } }, "PlatformQaTotpAllowlist": { "title": "PlatformQaTotpAllowlist", "type": "object", "required": [ "emails", "source", "entries", "max_entries", "tool" ], "properties": { "emails": { "type": "array", "items": { "type": "string" } }, "source": { "enum": [ "default", "stored", "invalid" ] }, "entries": { "type": "array", "items": { "type": "object", "required": [ "email", "user_exists", "totp_enrolled", "is_platform_admin" ], "properties": { "email": { "type": "string" }, "user_exists": { "type": "boolean" }, "totp_enrolled": { "type": "boolean" }, "is_platform_admin": { "type": "boolean" } } } }, "max_entries": { "const": 50 }, "tool": { "type": "object", "required": [ "enabled", "switch_on", "expires_at", "expired" ], "properties": { "enabled": { "type": "boolean" }, "switch_on": { "type": "boolean" }, "expires_at": { "type": [ "string", "null" ] }, "expired": { "type": "boolean" } } } } }, "PlatformQaTotpAllowlistRequest": { "title": "PlatformQaTotpAllowlistRequest", "type": "object", "required": [ "emails" ], "properties": { "emails": { "type": "array", "maxItems": 50, "items": { "type": "string" } } } }, "PlatformQaTotpAllowlistSet": { "title": "PlatformQaTotpAllowlistSet", "type": "object", "required": [ "ok", "max_entries", "tool" ], "properties": { "ok": { "const": true }, "max_entries": { "const": 50 }, "tool": { "type": "object" }, "emails": { "type": "array", "items": { "type": "string" } } } }, "PlatformSecretCommand": { "title": "PlatformSecretCommand", "type": "object", "required": [ "command_id", "state" ], "properties": { "command_id": { "type": "string", "format": "uuid" }, "state": { "type": "string" }, "result": { "type": "object" } } }, "PlatformSecretCommandConflict": { "title": "PlatformSecretCommandConflict", "type": "object", "required": [ "error" ], "properties": { "error": { "enum": [ "target_locked", "idempotency_key_conflict" ] }, "command_id": { "type": [ "string", "null" ] } } }, "PlatformSecretCommandStatus": { "title": "PlatformSecretCommandStatus", "type": "object", "required": [ "command_id", "action", "state", "team_id", "secret_name", "error_class", "result_metadata" ], "additionalProperties": false, "properties": { "command_id": { "type": "string", "format": "uuid" }, "action": { "enum": [ "set", "rotate", "delete" ] }, "state": { "type": "string" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "secret_name": { "type": [ "string", "null" ] }, "error_class": { "type": [ "string", "null" ] }, "result_metadata": { "type": [ "object", "null" ] } } }, "PlatformSecretDeleteRequest": { "title": "PlatformSecretDeleteRequest", "type": "object", "required": [ "team_id", "name", "idempotency_key", "confirm_name" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1 }, "idempotency_key": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid", "description": "when the session user has none" }, "confirm_name": { "type": "string", "description": "must equal name" } } }, "PlatformSecretWriteRequest": { "title": "PlatformSecretWriteRequest", "type": "object", "required": [ "team_id", "name", "idempotency_key", "value" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1 }, "idempotency_key": { "type": "string", "format": "uuid" }, "company_id": { "type": "string", "format": "uuid", "description": "when the session user has none" }, "value": { "type": "string", "description": "secret value; never echoed" } } }, "PlatformSecurityFlagRequest": { "title": "PlatformSecurityFlagRequest", "type": "object", "required": [ "name", "enabled" ], "properties": { "name": { "type": "string", "description": "one of the allowlisted flag names" }, "enabled": { "type": "boolean" } } }, "PlatformSecurityFlagSet": { "title": "PlatformSecurityFlagSet", "type": "object", "required": [ "ok", "name", "enabled" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "name": { "type": "string" }, "enabled": { "type": "boolean" } } }, "PlatformSessionLifetimes": { "title": "PlatformSessionLifetimes", "type": "object", "required": [ "source", "defaults", "bounds" ], "properties": { "session_idle_timeout_platform_admin_seconds": { "type": "integer" }, "session_idle_timeout_tenant_seconds": { "type": "integer" }, "session_absolute_lifetime_platform_admin_seconds": { "type": "integer" }, "session_absolute_lifetime_tenant_seconds": { "type": "integer" }, "source": { "type": "string" }, "defaults": { "type": "object" }, "bounds": { "type": "object", "description": "idle and absolute: { min, max } in seconds" } } }, "PlatformSessionLifetimesRequest": { "title": "PlatformSessionLifetimesRequest", "type": "object", "properties": { "session_idle_timeout_platform_admin_seconds": { "type": "integer", "minimum": 300, "maximum": 86400 }, "session_idle_timeout_tenant_seconds": { "type": "integer", "minimum": 300, "maximum": 86400 }, "session_absolute_lifetime_platform_admin_seconds": { "type": "integer", "minimum": 3600, "maximum": 7776000 }, "session_absolute_lifetime_tenant_seconds": { "type": "integer", "minimum": 3600, "maximum": 7776000 } } }, "PlatformSessionLifetimesSet": { "title": "PlatformSessionLifetimesSet", "type": "object", "required": [ "ok", "changed" ], "properties": { "ok": { "const": true }, "changed": { "type": "array", "items": { "type": "string" } }, "session_idle_timeout_platform_admin_seconds": { "type": "integer" }, "session_idle_timeout_tenant_seconds": { "type": "integer" }, "session_absolute_lifetime_platform_admin_seconds": { "type": "integer" }, "session_absolute_lifetime_tenant_seconds": { "type": "integer" } } }, "PlatformSetTierRequest": { "title": "PlatformSetTierRequest", "type": "object", "required": [ "tier" ], "properties": { "tier": { "enum": [ "team", "enterprise" ] } } }, "PlatformSigningKeyUnavailable": { "title": "PlatformSigningKeyUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "signing_key_unavailable" }, "reason": { "type": "string" } } }, "PlatformSignupApproveRequest": { "title": "PlatformSignupApproveRequest", "type": "object", "properties": { "reason": { "type": [ "string", "null" ] } } }, "PlatformSignupBadRequest": { "title": "PlatformSignupBadRequest", "type": "object", "required": [ "ok", "error" ], "properties": { "ok": { "const": false }, "error": { "type": "string" } } }, "PlatformSignupDecision": { "title": "PlatformSignupDecision", "type": "object", "required": [ "ok" ], "properties": { "ok": { "type": "boolean" }, "code": { "type": "string" }, "error": { "type": "string" } } }, "PlatformSignupRejectRequest": { "title": "PlatformSignupRejectRequest", "type": "object", "properties": { "reason": { "type": [ "string", "null" ] }, "include_reason": { "type": "boolean", "default": false } } }, "PlatformSignupRequest": { "title": "PlatformSignupRequest", "type": "object", "required": [ "request" ], "additionalProperties": false, "properties": { "request": { "type": "object" } } }, "PlatformSignupRequests": { "title": "PlatformSignupRequests", "type": "object", "required": [ "requests" ], "additionalProperties": false, "properties": { "requests": { "type": "array", "items": { "type": "object" } } } }, "PlatformTenants": { "title": "PlatformTenants", "type": "object", "required": [ "tenants" ], "additionalProperties": false, "properties": { "tenants": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "kind", "id", "name", "slug", "email", "tier", "status", "demo", "created_at", "licence" ], "properties": { "kind": { "enum": [ "company", "solo" ] }, "id": { "type": "string", "format": "uuid" }, "name": { "type": [ "string", "null" ] }, "slug": { "type": [ "string", "null" ] }, "email": { "type": [ "string", "null" ] }, "tier": { "type": [ "string", "null" ] }, "status": { "type": [ "string", "null" ] }, "demo": { "type": "boolean" }, "created_at": { "type": [ "string", "null" ], "format": "date-time" }, "licence": { "type": "object", "additionalProperties": false, "required": [ "state", "tier", "trial", "source", "expires_at", "grace_until", "seats_used", "seats_limit" ], "description": "the entitlement resolver's answer for the tenant; state is unavailable (with reason) when it cannot be resolved", "properties": { "state": { "enum": [ "ok", "grace", "read_only", "inert", "unavailable" ] }, "reason": { "type": "string" }, "tier": { "type": [ "string", "null" ] }, "trial": { "type": "boolean" }, "source": { "type": [ "string", "null" ] }, "expires_at": { "type": [ "string", "null" ], "format": "date-time" }, "grace_until": { "type": [ "string", "null" ], "format": "date-time" }, "seats_used": { "type": [ "integer", "null" ] }, "seats_limit": { "type": [ "integer", "null" ] } } } } } } } }, "PlatformTierSet": { "title": "PlatformTierSet", "type": "object", "required": [ "ok", "changed", "prev", "next" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "changed": { "type": "boolean" }, "prev": { "type": [ "string", "null" ] }, "next": { "type": "string" } } }, "PlatformUserDeleteRetry": { "title": "PlatformUserDeleteRetry", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "retry_after_s": { "type": "integer" } }, "description": "a purge of the tenant's secrets failed; status and code come from the purge error" }, "PlatformUserDeleted": { "title": "PlatformUserDeleted", "type": "object", "required": [ "ok", "deleted", "counts" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "deleted": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "format": "uuid" } } }, "counts": { "type": "object" } } }, "PluginFile": { "title": "PluginFile", "type": "string", "format": "binary", "description": "the file's own content type is set by the server" }, "PluginFileNotFound": { "title": "PluginFileNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "not_found" }, "detail": { "type": "string" } } }, "PostAdminScimTokensRequest": { "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string", "minLength": 1, "pattern": "\\S", "description": "trimmed, 1..128 characters" } } }, "PostAuditKeysKeyIdDisasterRotateRequest": { "type": "object", "required": [ "confirm" ], "properties": { "confirm": { "type": "string", "const": "ROTATE KEYS", "description": "the confirmation phrase, exactly" }, "totp_code": { "type": "string", "description": "step-up: the current TOTP code (or recovery_code); without either the answer is 403 step_up_required" }, "recovery_code": { "type": "string", "description": "step-up: an unused recovery code instead of totp_code" } } }, "PostAuditKeysKeyIdDisasterRotateResponse200": { "type": "object", "required": [ "rotated", "new_key_ids", "audit_recorded", "signer_switch_within_s" ], "properties": { "rotated": { "type": "array", "items": { "type": "object", "required": [ "kind", "old_key_id", "new_key_id", "lost_fingerprint", "new_fingerprint", "new_pubkey_hex", "old_key_retired_at" ], "properties": { "kind": { "type": "string", "enum": [ "audit_signing_key" ] }, "old_key_id": { "type": "string", "format": "uuid" }, "new_key_id": { "type": "string", "format": "uuid" }, "lost_fingerprint": { "type": "string" }, "new_fingerprint": { "type": "string" }, "new_pubkey_hex": { "type": "string" }, "old_key_retired_at": { "type": [ "string", "null" ], "format": "date-time", "description": "the rotation moment; the verifier refuses rows the old key signs after it" } } } }, "new_key_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "audit_recorded": { "type": "boolean" }, "signer_switch_within_s": { "type": "integer" } } }, "PostAuthOpaqueLoginFinishRequest": { "type": "object", "required": [ "state_id", "ke3" ], "properties": { "state_id": { "type": "string", "description": "the state_id the matching start answered" }, "ke3": { "type": "string", "minLength": 1, "maxLength": 4096, "description": "an OPAQUE protocol message (base64url)" }, "totp_code": { "type": "string", "description": "required when the account has TOTP enrolled (or recovery_code)" }, "recovery_code": { "type": "string" } } }, "PostAuthOpaqueLoginStartRequest": { "type": "object", "required": [ "email", "ke1" ], "properties": { "email": { "type": "string", "maxLength": 320 }, "ke1": { "type": "string", "minLength": 1, "maxLength": 4096, "description": "an OPAQUE protocol message (base64url)" } } }, "PostAuthOpaqueReauthFinishRequest": { "type": "object", "required": [ "state_id", "ke3" ], "properties": { "state_id": { "type": "string", "description": "the state_id the matching start answered" }, "ke3": { "type": "string", "minLength": 1, "maxLength": 4096, "description": "an OPAQUE protocol message (base64url)" } } }, "PostAuthOpaqueReauthFinishResponse200": { "type": "object", "required": [ "reauth_token", "purpose", "expires_at" ], "properties": { "reauth_token": { "type": "string" }, "purpose": { "type": "string" }, "expires_at": { "type": "string" } } }, "PostAuthOpaqueReauthStartRequest": { "type": "object", "required": [ "ke1", "purpose" ], "properties": { "ke1": { "type": "string", "minLength": 1, "maxLength": 4096, "description": "an OPAQUE protocol message (base64url)" }, "purpose": { "enum": [ "opaque_register", "change_passphrase", "password_change", "signing_token", "sso_link_confirm", "cli_approve", "escrow_enable", "oauth_authorize" ] } } }, "PostAuthOpaqueRegisterFinishRequest": { "type": "object", "required": [ "credential_id", "record", "ticket" ], "properties": { "credential_id": { "type": "string", "format": "uuid" }, "record": { "type": "string", "pattern": "^[A-Za-z0-9_-]+$", "minLength": 256, "maxLength": 256, "description": "the registration record, 192 bytes base64url" }, "ticket": { "type": "object", "required": [ "kind" ], "properties": { "kind": { "enum": [ "session", "recovery", "invite", "signup" ] }, "recovery_token": { "type": "string", "description": "kind recovery" }, "recovery_code": { "type": "string", "description": "kind recovery" }, "invite_token": { "type": "string", "minLength": 16, "maxLength": 256, "description": "kind invite" }, "completion_token": { "type": "string", "minLength": 16, "maxLength": 256, "description": "kind signup" } } }, "reauth_token": { "type": "string", "description": "session ticket: a reauth token minted for purpose opaque_register (refused 403 reauth_required without one); the other kinds answer 409 opaque_register_in_flow" } } }, "PostAuthOpaqueRegisterFinishResponse200": { "type": "object", "required": [ "ok", "sessions_revoked", "reauth_required" ], "properties": { "ok": { "const": true }, "sessions_revoked": { "type": [ "integer", "null" ] }, "reauth_required": { "const": true } } }, "PostAuthOpaqueRegisterStartRequest": { "type": "object", "required": [ "request", "ticket" ], "properties": { "request": { "type": "string", "minLength": 1, "maxLength": 4096, "description": "an OPAQUE protocol message (base64url)" }, "ticket": { "type": "object", "required": [ "kind" ], "properties": { "kind": { "enum": [ "session", "recovery", "invite", "signup" ] }, "recovery_token": { "type": "string", "description": "kind recovery" }, "recovery_code": { "type": "string", "description": "kind recovery" }, "invite_token": { "type": "string", "minLength": 16, "maxLength": 256, "description": "kind invite" }, "completion_token": { "type": "string", "minLength": 16, "maxLength": 256, "description": "kind signup" } } } } }, "PostAuthOpaqueRegisterStartResponse200": { "type": "object", "required": [ "response", "credential_id" ], "properties": { "response": { "type": "string" }, "credential_id": { "type": "string", "format": "uuid" } } }, "PostAuthReauthPasskeyFinishRequest": { "type": "object", "required": [ "challenge_id", "credential" ], "properties": { "challenge_id": { "type": "string", "format": "uuid" }, "credential": { "type": "object" } } }, "PostAuthReauthPasskeyFinishResponse200": { "type": "object", "required": [ "reauth_token", "purpose", "expires_at" ], "properties": { "reauth_token": { "type": "string" }, "purpose": { "type": "string" }, "expires_at": { "type": "string" } } }, "PostAuthReauthPasskeyOptionsRequest": { "type": "object", "required": [ "purpose" ], "properties": { "purpose": { "type": "string", "enum": [ "cli_approve", "oauth_authorize" ] } } }, "PostAuthReauthPasskeyOptionsResponse200": { "type": "object", "required": [ "challenge_id", "expires_at", "purpose", "publicKey" ], "properties": { "challenge_id": { "type": "string", "format": "uuid" }, "expires_at": { "type": "string" }, "purpose": { "type": "string" }, "publicKey": { "type": "object" } } }, "PostAuthReauthSsoFinishRequest": { "type": "object", "required": [ "challenge_id" ], "properties": { "challenge_id": { "type": "string", "format": "uuid" } } }, "PostAuthReauthSsoFinishResponse200": { "type": "object", "required": [ "reauth_token", "purpose", "expires_at" ], "properties": { "reauth_token": { "type": "string" }, "purpose": { "type": "string" }, "expires_at": { "type": "string" } } }, "PostAuthReauthSsoStartRequest": { "type": "object", "required": [ "purpose" ], "properties": { "purpose": { "type": "string", "enum": [ "cli_approve", "oauth_authorize" ] }, "return_to": { "type": "string", "maxLength": 256 } } }, "PostAuthReauthSsoStartResponse200": { "type": "object", "required": [ "challenge_id", "location" ], "properties": { "challenge_id": { "type": "string", "format": "uuid" }, "location": { "type": "string" } } }, "PostAuthSigningTokenRequest": { "type": "object", "properties": { "reauth_token": { "type": [ "string", "null" ], "description": "from POST /auth/opaque/reauth/finish" }, "totp_code": { "description": "the second factor of a TOTP-enrolled account" } } }, "PostAuthTotpEnrollStartRequest": { "type": "object", "properties": { "totp_code": { "type": "string", "description": "re-enrolment: the current TOTP code (or recovery_code)" }, "recovery_code": { "type": "string" } } }, "PostAuthTotpEnrollStartResponse200": { "type": "object", "required": [ "secret", "otpauth_uri" ], "properties": { "secret": { "type": "string" }, "otpauth_uri": { "type": "string" } } }, "PostAuthTotpEnrollVerifyRequest": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string" } } }, "PostAuthTotpEnrollVerifyResponse200": { "type": "object", "required": [ "recovery_codes" ], "properties": { "recovery_codes": { "type": "array", "items": { "type": "string" } } } }, "PostFleetGroupsGroupIdUpgradeRequest": { "type": "object", "additionalProperties": false, "properties": { "allow_busy": { "type": "boolean", "description": "true includes hosts with running sessions; otherwise the sweeper skips them (reason host_busy)" }, "stagger_s": { "type": "integer", "description": "seconds between two hosts of the run; default 60, clamped to 15..3600" } } }, "PostFleetHostsHostIdUpgradeRequest": { "type": "object", "required": [ "to" ], "additionalProperties": false, "properties": { "to": { "type": "string", "pattern": "^[0-9]{1,6}\\.[0-9]{1,6}\\.[0-9]{1,6}$", "description": "the published version for the host target; another value is 409 published_version_changed" }, "allow_busy": { "type": "boolean", "description": "true upgrades a host with running sessions (they end); otherwise 409 host_busy {live_sessions}" } } }, "PostFleetSessionsRequest": { "type": "object", "required": [ "host_id", "cwd" ], "properties": { "host_id": { "type": "string", "minLength": 1 }, "cwd": { "type": "string", "minLength": 1 }, "team_id": { "type": [ "string", "null" ], "format": "uuid", "description": "resolved from the caller when absent or null" }, "args": { "type": "array", "description": "agent arguments; a legacy `-p ` pair becomes prompt + one_shot" }, "env": { "type": "object", "description": "spawn environment; keys on the daemon denylist answer 422" }, "one_shot": { "type": "boolean" }, "agent": { "type": "string" }, "model": { "type": "string", "description": "a model id the host offers for the agent (GET /fleet/agents/catalog?host=: the host's reported list, else the static catalog) or `auto`; absent runs the agent's default; anything else answers 400 model_not_supported" }, "prompt": { "description": "plain text, or a sealed envelope for an end-to-end session" }, "system_prompt": { "description": "plain text, or a sealed envelope for an end-to-end session" }, "prompt_seal": { "type": "object", "description": "with a sealed prompt: spawn_id, key_version, aad_v" }, "allowed_tools": { "description": "relayed to the daemon" }, "resume_session_id": { "description": "relayed to the daemon" }, "dangerous": { "description": "relayed to the daemon" }, "metadata": { "type": "object" }, "meta": { "title": "SessionMetaSealed", "type": "object", "required": [ "ciphertext", "nonce" ], "properties": { "ciphertext": { "type": "string" }, "nonce": { "type": "string" }, "aadVersion": { "description": "2 for a team end-to-end or Solo session; 1 or 2 otherwise" }, "blindIndex": { "type": "array", "description": "blind-index entries (not for an end-to-end session)" } } }, "spawn_sig": { "type": "object", "description": "end-to-end session: the signature over the spawn parameters, relayed to the daemon", "properties": { "sig_v": {}, "spawn_id": {}, "key_version": {}, "nonce": {}, "tag": {}, "sandbox": { "enum": [ "netns", "off" ] } } } } }, "PostFleetSessionsResponse201": { "type": "object", "required": [ "session_id" ], "properties": { "session_id": { "type": "string" } } }, "PostFleetSessionsSessionIdKillRequest": { "type": "object", "properties": { "signal": { "type": "string", "default": "SIGTERM" } } }, "PostFleetSessionsSessionIdKillResponse202": { "type": "object", "required": [ "status" ], "properties": { "status": { "const": "kill_pending" } } }, "PostFleetWorkflowRunsWorkflowRunIdApprovalsApprovalIdResponse200": { "type": "object", "required": [ "id", "run_id", "node_id" ], "description": "fleet_workflow_pending_approvals row", "properties": { "id": { "type": "string", "format": "uuid" }, "run_id": { "type": "string", "format": "uuid" }, "node_id": { "type": "string" }, "reason": { "type": [ "string", "null" ] }, "requested_at": { "type": "string", "format": "date-time" }, "decided_at": { "type": [ "string", "null" ], "format": "date-time" }, "decision": { "enum": [ "approve", "reject", null ] }, "decided_by": { "type": [ "string", "null" ] }, "note": { "type": [ "string", "null" ] } } }, "PostFleetWorkflowsRequest": { "type": "object", "required": [ "name", "definition" ], "properties": { "name": { "type": "string" }, "description": { "type": [ "string", "null" ] }, "definition": { "anyOf": [ { "type": "object", "description": "a plain workflow definition (start node and nodes)" }, { "title": "WorkflowEnvelope", "type": "object", "required": [ "enc_v", "nonce", "ct" ], "additionalProperties": false, "properties": { "enc_v": { "const": 2 }, "nonce": { "type": "string", "pattern": "^[0-9a-f]{48}$" }, "ct": { "type": "string", "pattern": "^(?:[0-9a-f]{2})+$", "minLength": 34, "maxLength": 2097152 } } } ] }, "team_id": { "type": [ "string", "null" ], "format": "uuid", "description": "resolved from the caller when absent or null" }, "id": { "type": [ "string", "null" ], "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", "description": "only with a sealed definition: the id it was sealed for" } } }, "PostFleetWorkflowsWorkflowIdRunRequest": { "type": "object", "properties": { "inputs": { "anyOf": [ { "type": [ "object", "null" ], "description": "plain inputs (not in end-to-end mode); null reads as none" }, { "title": "WorkflowEnvelope", "type": "object", "required": [ "enc_v", "nonce", "ct" ], "additionalProperties": false, "properties": { "enc_v": { "const": 2 }, "nonce": { "type": "string", "pattern": "^[0-9a-f]{48}$" }, "ct": { "type": "string", "pattern": "^(?:[0-9a-f]{2})+$", "minLength": 34, "maxLength": 2097152 } } } ] }, "run_id": { "type": [ "string", "null" ], "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", "description": "required with sealed inputs: the run id they were sealed for" } } }, "PostFleetWorkflowsWorkflowIdRunResponse201": { "type": "object", "required": [ "run_id" ], "properties": { "run_id": { "type": "string", "format": "uuid" } } }, "PostHostsEnrolCodesRequest": { "type": "object", "required": [ "team_id" ], "properties": { "team_id": { "type": "string", "format": "uuid" } } }, "PostHostsEnrolRequest": { "type": "object", "required": [ "pubkey" ], "properties": { "code": { "type": [ "string", "null" ], "description": "8 characters of A-Z and 2-7 (any case); checked by the handler" }, "token": { "type": [ "string", "null" ], "description": "a reusable team enrol token, instead of code" }, "pubkey": { "type": "string", "minLength": 1 }, "machine_info": { "type": [ "object", "null" ], "description": "stored as sent; hostname names the host" } }, "anyOf": [ { "required": [ "code" ], "properties": { "code": { "type": "string", "minLength": 1 } } }, { "required": [ "token" ], "properties": { "token": { "type": "string", "minLength": 1 } } } ] }, "PostHostsHostIdApproveRequest": { "type": "object", "properties": { "wrapped_team_dek": { "type": [ "string", "null" ], "pattern": "^[0-9a-fA-F]{184,}$", "description": "the team DEK wrapped for the host pubkey: at least 92 bytes as hex" }, "wrapped_team_dek_for_service_user": { "type": [ "string", "null" ], "pattern": "^[0-9a-fA-F]{184,}$", "description": "the team DEK wrapped for the company service user" } } }, "PostHostsMeAuditEventsRequest": { "type": "object", "required": [ "event", "at", "pin" ], "properties": { "event": { "type": "string", "enum": [ "e2e.pin_cleared" ] }, "at": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,6})?(Z|[+-]\\d{2}:\\d{2})$", "description": "ISO 8601 time the host cleared the pin" }, "pin": { "type": "object", "required": [ "mode_on", "teams", "sessions", "unreadable" ], "properties": { "mode_on": { "type": "boolean" }, "teams": { "type": "array", "maxItems": 4096, "items": { "type": "string", "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$" } }, "sessions": { "type": "array", "maxItems": 4096, "items": { "type": "string", "pattern": "^[A-Za-z0-9_.:-]{1,128}$" } }, "unreadable": { "type": "boolean" } } } } }, "PostInvitesAcceptRequest": { "type": "object", "required": [ "token", "pubkey", "kdf_salt", "seed_kdf_salt", "wrapped_seed_backup", "opaque" ], "properties": { "token": { "type": "string", "minLength": 1, "maxLength": 256, "description": "the invite token from the link" }, "pubkey": { "type": "string", "pattern": "^[0-9a-fA-F]{64,}$", "description": "hex, at least 32 bytes", "minLength": 1 }, "kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]{32,}$", "description": "hex, at least 16 bytes", "minLength": 1 }, "seed_kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]{32,}$", "description": "hex, at least 16 bytes", "minLength": 1 }, "wrapped_seed_backup": { "type": "string", "pattern": "^[0-9a-fA-F]{64,}$", "description": "hex, at least 32 bytes", "minLength": 1 }, "password_hash": { "type": "null", "description": "refused unless null: the credential is the OPAQUE registration" }, "opaque": { "type": "object", "required": [ "credential_id", "record" ], "additionalProperties": false, "properties": { "credential_id": { "type": "string", "format": "uuid", "description": "issued by register/start for the invite ticket" }, "record": { "type": "string", "pattern": "^[A-Za-z0-9_-]{256}$", "description": "the 192-byte registration record, unpadded base64url" } } }, "sign_pubkey": { "type": [ "string", "null" ], "pattern": "^[0-9a-fA-F]{64,}$", "description": "optional seed-derived Ed25519 key: hex, at least 32 bytes" } } }, "PostInvitesLookupRequest": { "type": "object", "required": [ "token" ], "properties": { "token": { "type": "string", "pattern": "^[0-9a-f]{64}$", "description": "the invite token: 64 lower-case hex" } } }, "PostInvitesRequest": { "type": "object", "required": [ "email", "team_id", "role_in_team" ], "properties": { "email": { "type": "string", "minLength": 1 }, "team_id": { "type": "string", "format": "uuid" }, "role_in_team": { "description": "admin, member or viewer", "allOf": [ { "not": { "enum": [ null, false, 0, "" ] } }, { "enum": [ "admin", "member", "viewer" ] } ] }, "locale": { "description": "language of the invite mail: en, ru, es, et or fi; any other value falls back to Accept-Language, then en" } } }, "PostKbE2eNotesNoteIdDeleteRequest": { "type": "object", "required": [ "base_version" ], "properties": { "base_version": { "type": "integer", "minimum": 1, "maximum": 2147483647 }, "session_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "PostNotesRequest": { "type": "object", "required": [ "title", "body" ], "properties": { "title": { "type": "string", "minLength": 1, "description": "cut to 500 characters" }, "body": { "type": "string", "description": "at most 256 KiB of UTF-8" }, "team_id": { "type": [ "string", "null" ], "pattern": "^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})?$", "description": "the team; empty or absent when the caller can write exactly one" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "at most 64 kept, each cut to 128 characters" }, "source_path": { "type": [ "string", "null" ], "description": "a vault path; a second create with it updates the same note" } } }, "PostPlatformAdminArticlesResponse200": { "type": "object", "additionalProperties": false, "required": [ "id", "scope", "source_path", "title", "tags", "created_by_user_id", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "scope": { "const": "global" }, "source_path": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": {}, "updated_at": {} } }, "PostPlatformAdminArticlesResponse201": { "type": "object", "additionalProperties": false, "required": [ "id", "scope", "source_path", "title", "tags", "created_by_user_id", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "scope": { "const": "global" }, "source_path": { "type": [ "string", "null" ] }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_at": {}, "updated_at": {} } }, "PostPlatformAdminSudoRequest": { "type": "object", "properties": { "code": { "type": "string", "description": "a current TOTP code; refused 400 totp_code_required when absent" }, "level": { "enum": [ "A", "B" ], "default": "A" } } }, "PostPlatformAdminSudoResponse200": { "type": "object", "required": [ "ok", "sudo_until", "level" ], "properties": { "ok": { "const": true }, "sudo_until": { "type": "string" }, "level": { "enum": [ "A", "B" ] } } }, "PostQuotasRequest": { "type": "object", "required": [ "scope", "period", "cap_usd" ], "properties": { "scope": { "enum": [ "company", "team", "user", "repo" ] }, "period": { "enum": [ "daily", "weekly", "monthly", "billing_cycle" ], "description": "billing_cycle is stored as monthly" }, "cap_usd": { "type": [ "number", "string" ], "exclusiveMinimum": 0, "description": "more than 0; a numeric string is read with parseFloat" }, "warn_pct": { "type": "integer", "minimum": 1, "maximum": 99, "default": 80 }, "override_role": { "enum": [ "owner", "admin" ], "default": "owner" }, "cap_mode": { "enum": [ "enforce", "warn", "notify" ], "default": "enforce" }, "scope_ref": { "type": [ "string", "null" ], "description": "a UUID for scope team or user" } }, "if": { "required": [ "scope" ], "properties": { "scope": { "enum": [ "team", "user" ] } } }, "then": { "required": [ "scope_ref" ], "properties": { "scope_ref": { "type": "string", "format": "uuid" } } } }, "PostSignupRequestsRequest": { "type": "object", "required": [ "journey", "email", "tos_accepted", "tos_version" ], "properties": { "journey": { "enum": [ "company", "solo", "join" ] }, "email": { "type": "string", "maxLength": 254, "pattern": "^\\s*[^@\\s]+@[^@\\s]+\\.[^@\\s]+\\s*$" }, "locale": { "type": [ "string", "null" ], "description": "one of en, ru, es, et, fi; anything else reads as en" }, "tier": { "enum": [ "solo", "team", "enterprise", null ] }, "company_name": { "type": [ "string", "null" ], "description": "journey company: required; at most 100 characters after trimming" }, "target_company_id": { "type": [ "string", "null" ], "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$", "description": "journey join: the company to join" }, "payload": { "type": [ "object", "null" ] }, "tos_accepted": { "const": true }, "tos_version": { "type": "string", "pattern": "^\\s*[0-9]{4}-[0-9]{2}-[0-9]{2}\\s*$", "description": "a published legal document version" } }, "allOf": [ { "if": { "properties": { "journey": { "const": "company" } }, "required": [ "journey" ] }, "then": { "required": [ "company_name" ] } }, { "if": { "properties": { "journey": { "const": "join" } }, "required": [ "journey" ] }, "then": { "required": [ "target_company_id" ] } } ] }, "PostSignupRequestsResendRequest": { "type": "object", "properties": { "email": { "type": "string" } } }, "PostSignupRequestsVerifyRequest": { "type": "object", "required": [ "token" ], "properties": { "token": { "type": "string", "minLength": 1 } } }, "PostSignupRequestsVerifyResponse200": { "type": "object", "required": [ "verified" ], "properties": { "verified": { "const": true } } }, "PostSkillAssignmentsRequest": { "type": "object", "required": [ "scope", "skill_id", "action" ], "properties": { "scope": { "enum": [ "global", "company", "team", "user" ] }, "scope_id": { "type": [ "string", "null" ] }, "skill_id": { "type": "string", "format": "uuid" }, "action": { "enum": [ "default", "allow", "deny" ] } } }, "PostSkillsRequest": { "type": "object", "required": [ "name", "version", "scope" ], "properties": { "name": { "type": "string", "minLength": 1 }, "version": { "type": "string", "minLength": 1 }, "scope": { "enum": [ "global", "company", "team" ] }, "scope_id": { "description": "the company or team id; required for scope company and team" }, "description": { "type": [ "string", "null" ] }, "signing_token": { "type": "string", "description": "from POST /auth/signing-token" }, "signature": { "type": "string", "description": "an Ed25519 signature over the bundle hash, or 'session'" } }, "if": { "required": [ "scope" ], "properties": { "scope": { "enum": [ "company", "team" ] } } }, "then": { "required": [ "scope_id" ], "properties": { "scope_id": { "type": "string", "format": "uuid" } } } }, "PostTeamMembershipsRequest": { "type": "object", "required": [ "team_id", "user_id", "role", "wrapped_team_dek_for_user", "wrapped_master_for_user" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "user_id": { "type": "string", "format": "uuid" }, "role": { "description": "admin, member or viewer", "allOf": [ { "not": { "enum": [ null, false, 0, "" ] } }, { "enum": [ "admin", "member", "viewer" ] } ] }, "wrapped_team_dek_for_user": { "type": "string", "pattern": "^[0-9a-fA-F]{184,}$", "description": "hex, at least 92 bytes" }, "wrapped_master_for_user": { "type": "string", "pattern": "^[0-9a-fA-F]{184,}$", "description": "hex, at least 92 bytes" } } }, "PostTeamMembershipsRewrapRequest": { "type": "object", "properties": { "memberships": { "type": "array", "description": "absent means none", "items": { "type": "object", "required": [ "team_id", "wrapped_team_dek" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "wrapped_team_dek": { "type": "string", "pattern": "^[0-9a-fA-F]{184,}$", "description": "hex, at least 92 bytes" } } } } } }, "PostTeamsRequest": { "type": "object", "required": [ "name", "wrapped_team_dek_for_master", "wrapped_team_dek_for_self" ], "properties": { "name": { "type": "string", "pattern": "\\S", "description": "trimmed before it is stored" }, "wrapped_team_dek_for_master": { "type": "string", "pattern": "^[0-9a-fA-F]{184,}$", "description": "the team DEK wrapped for the company master key: hex, at least 92 bytes" }, "wrapped_team_dek_for_self": { "type": "string", "pattern": "^[0-9a-fA-F]{184,}$", "description": "the team DEK wrapped for the caller: hex, at least 92 bytes" } } }, "PostTeamsTeamIdAutomationTokensRequest": { "type": "object", "properties": { "e2e_pubkey": { "type": [ "string", "null" ], "pattern": "^[0-9a-fA-F]{64}$", "description": "the token's X25519 public key, 32 bytes as hex; required when the company is in end-to-end mode" } } }, "PostTeamsTeamIdMcpServersRequest": { "type": "object", "required": [ "name", "transport", "endpoint" ], "properties": { "name": { "type": "string", "pattern": "^\\s*[A-Za-z0-9][A-Za-z0-9 ._-]{0,63}\\s*$", "description": "trimmed: a letter or digit, then up to 63 letters, digits, spaces, dots, underscores or hyphens" }, "transport": { "enum": [ "stdio", "http", "ws" ] }, "endpoint": { "type": "string", "pattern": "\\S" }, "auth_ref": { "description": "a secret reference; empty for none" }, "offered": { "description": "false hides the server from member picks" }, "mandatory": { "description": "true injects the server into every spawn (and offers it)" } } }, "PostTeamsTeamIdServiceUserDekRequest": { "type": "object", "required": [ "wrapped_team_dek_for_service_user" ], "properties": { "wrapped_team_dek_for_service_user": { "type": "string", "pattern": "^[0-9a-fA-F]{184}$" } } }, "PostUsersUserIdPasskeysResetResponse200": { "type": "object", "required": [ "ok", "passkeys_removed" ], "properties": { "ok": { "type": "boolean" }, "passkeys_removed": { "type": "integer" }, "sessions_revoked": { "type": [ "integer", "null" ] } } }, "PostUsersUserIdWrappedMasterRequest": { "type": "object", "required": [ "wrapped_master_for_user" ], "properties": { "wrapped_master_for_user": { "type": "string", "pattern": "^[0-9a-fA-F]{184,}$", "description": "hex, at least 92 bytes" } } }, "PublicRateLimited": { "title": "PublicRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "retry_after_ms": { "type": "integer" } }, "description": "Retry-After is set" }, "PushNotImplemented": { "title": "PushNotImplemented", "type": "object", "required": [ "error", "detail" ], "properties": { "error": { "const": "not_implemented" }, "detail": { "type": "string" } } }, "PutFleetHostsHostIdFileRequest": { "type": "object", "required": [ "path", "content" ], "properties": { "path": { "type": "string", "minLength": 1 }, "content": { "type": "string", "description": "UTF-8; larger than the host file cap is 413 payload_too_large" } } }, "PutKbE2eNotesNoteIdChunksRequest": { "type": "object", "required": [ "note_version", "model_id", "dims", "key_version", "chunks" ], "properties": { "note_version": { "type": "integer", "minimum": 1, "maximum": 2147483647 }, "model_id": { "type": "string", "minLength": 1, "maxLength": 128 }, "dims": { "type": "integer", "minimum": 1, "maximum": 4096 }, "key_version": { "type": "integer", "minimum": 1, "maximum": 2147483647 }, "chunks": { "type": "array", "maxItems": 200, "items": { "type": "object", "required": [ "idx", "text", "vec" ], "properties": { "idx": { "type": "integer", "minimum": 0, "maximum": 1000000 }, "text": { "title": "KbSealed", "type": "object", "required": [ "nonce", "ct" ], "properties": { "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]{48}$" }, "ct": { "type": "string", "minLength": 1, "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" } } }, "vec": { "title": "KbSealed", "type": "object", "required": [ "nonce", "ct" ], "properties": { "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]{48}$" }, "ct": { "type": "string", "minLength": 1, "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" } } } } }, "description": "idx unique; text at most 8192 bytes sealed; vec 24 + 4 * dims + 16 bytes sealed", "minItems": 1 }, "session_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "PutKbE2eNotesNoteIdRequest": { "type": "object", "required": [ "scope", "team_id", "base_version", "key_version", "note" ], "properties": { "scope": { "const": "team" }, "team_id": { "type": "string", "format": "uuid", "description": "the host's own team" }, "base_version": { "type": "integer", "minimum": 0, "maximum": 2147483647 }, "key_version": { "type": "integer", "minimum": 1, "maximum": 2147483647 }, "note": { "title": "KbSealed", "type": "object", "required": [ "nonce", "ct" ], "properties": { "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]{48}$" }, "ct": { "type": "string", "minLength": 1, "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" } }, "description": "at most 266240 bytes of ciphertext" }, "session_id": { "type": [ "string", "null" ], "format": "uuid" }, "migrated_from": { "type": [ "string", "null" ], "format": "uuid" }, "chunk_set": { "type": [ "object", "null" ], "required": [ "model_id", "dims", "chunks" ], "properties": { "model_id": { "type": "string", "minLength": 1, "maxLength": 128 }, "dims": { "type": "integer", "minimum": 1, "maximum": 4096 }, "chunks": { "type": "array", "maxItems": 200, "items": { "type": "object", "required": [ "idx", "text", "vec" ], "properties": { "idx": { "type": "integer", "minimum": 0, "maximum": 1000000 }, "text": { "title": "KbSealed", "type": "object", "required": [ "nonce", "ct" ], "properties": { "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]{48}$" }, "ct": { "type": "string", "minLength": 1, "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" } } }, "vec": { "title": "KbSealed", "type": "object", "required": [ "nonce", "ct" ], "properties": { "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]{48}$" }, "ct": { "type": "string", "minLength": 1, "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" } } } } }, "description": "idx unique; text at most 8192 bytes sealed; vec 24 + 4 * dims + 16 bytes sealed" } } } } }, "PutNotificationPreferencesRequest": { "type": "object", "properties": { "categories": { "type": [ "object", "null" ], "description": "category -> { severity: cadence }; absent or null stores no preferences", "additionalProperties": { "allOf": [ { "not": { "const": "off" } }, { "if": { "type": "object" }, "then": { "not": { "required": [ "critical" ], "properties": { "critical": { "const": "off" } } } } } ] } } } }, "PutSecretsSealedRequest": { "type": "object", "required": [ "scope_kind", "scope_id", "name", "key_version", "nonce", "ciphertext" ], "not": { "required": [ "value" ] }, "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[^\\u0000-\\u001f\\u007f]*$" }, "key_version": { "type": "integer", "minimum": 1 }, "nonce": { "type": "string", "pattern": "^[0-9a-f]+$" }, "ciphertext": { "type": "string", "pattern": "^[0-9a-f]+$", "maxLength": 67584 } } }, "PutSecretsSealedResponse200": { "type": "object", "required": [ "ok", "name", "scope_kind", "scope_id", "key_version" ], "properties": { "ok": { "const": true }, "name": { "type": "string" }, "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "key_version": { "type": "integer" } } }, "PutSpawnPrefsRequest": { "type": "object", "properties": { "skill_ids": { "type": "array", "maxItems": 50, "items": { "type": "string", "format": "uuid" } }, "mcp_server_ids": { "type": "array", "maxItems": 50, "items": { "type": "string", "format": "uuid" } } }, "anyOf": [ { "required": [ "skill_ids" ] }, { "required": [ "mcp_server_ids" ] } ] }, "PutTeamsTeamIdAgentPolicyRequest": { "type": "object", "properties": { "allowed_agents": { "type": [ "array", "null" ], "items": { "type": "string", "enum": [ "claude", "codex", "opencode", "gemini", "hermes", "openclaw", "nanoclaw" ] }, "description": "null or empty: no restriction" }, "agent_auth_policy": { "type": [ "object", "null" ], "properties": { "claude": { "type": [ "object", "null" ], "properties": { "allowed": { "type": [ "array", "null" ], "items": { "type": "string", "enum": [ "team_key", "api_key", "subscription" ] } }, "team_key_ref": { "type": [ "string", "null" ], "pattern": "^(?:vault-ref://[A-Za-z0-9][A-Za-z0-9._-]{0,127})?$" } }, "additionalProperties": false }, "codex": { "type": [ "object", "null" ], "properties": { "allowed": { "type": [ "array", "null" ], "items": { "type": "string", "enum": [ "team_key", "api_key", "subscription" ] } }, "team_key_ref": { "type": [ "string", "null" ], "pattern": "^(?:vault-ref://[A-Za-z0-9][A-Za-z0-9._-]{0,127})?$" } }, "additionalProperties": false }, "gemini": { "type": [ "object", "null" ], "properties": { "allowed": { "type": [ "array", "null" ], "items": { "type": "string", "enum": [ "team_key", "api_key", "subscription" ] } }, "team_key_ref": { "type": [ "string", "null" ], "pattern": "^(?:vault-ref://[A-Za-z0-9][A-Za-z0-9._-]{0,127})?$" } }, "additionalProperties": false }, "opencode": { "type": [ "object", "null" ], "properties": { "allowed": { "type": [ "array", "null" ], "items": { "type": "string", "enum": [ "team_key", "api_key", "subscription" ] } }, "team_key_ref": { "type": [ "string", "null" ], "pattern": "^(?:vault-ref://[A-Za-z0-9][A-Za-z0-9._-]{0,127})?$" } }, "additionalProperties": false } }, "additionalProperties": false } }, "anyOf": [ { "required": [ "allowed_agents" ] }, { "required": [ "agent_auth_policy" ] } ] }, "QaTotpBadRequest": { "title": "QaTotpBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_body" }, "detail": { "type": "string" } } }, "QaTotpCode": { "title": "QaTotpCode", "type": "object", "required": [ "code", "seconds_left" ], "additionalProperties": false, "properties": { "code": { "type": "string", "pattern": "^[0-9]{6}$" }, "seconds_left": { "type": "integer" } } }, "QaTotpCodeRequest": { "title": "QaTotpCodeRequest", "type": "object", "required": [ "qa_password", "email" ], "properties": { "qa_password": { "type": "string" }, "email": { "type": "string" } } }, "QaTotpLimiter": { "title": "QaTotpLimiter", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "rate_limit_unavailable" }, "detail": { "type": "string" } } }, "QaTotpOff": { "title": "QaTotpOff", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "not_found, user_not_found" }, "detail": { "type": "string" } } }, "QaTotpPassword": { "title": "QaTotpPassword", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "qa_password_invalid" }, "detail": { "type": "string" } } }, "QaTotpRateLimited": { "title": "QaTotpRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "rate-limited; try again later" }, "detail": { "type": "string" }, "retry_after_ms": { "type": "integer" } } }, "QaTotpTooLarge": { "title": "QaTotpTooLarge", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "payload_too_large" }, "detail": { "type": "string" } } }, "QuotaUnavailable": { "title": "QuotaUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "enum": [ "unavailable", "tenant_state_unavailable" ] }, "reason": { "type": "string" } }, "description": "unavailable: no database pool; tenant_state_unavailable carries Retry-After" }, "Readyz": { "title": "Readyz", "type": "object", "required": [ "ready", "role", "daemon_ready", "checks" ], "additionalProperties": false, "properties": { "ready": { "const": true }, "role": { "type": "string", "description": "leader or follower" }, "daemon_ready": { "type": "boolean", "description": "true only on the leader" }, "checks": { "type": "object", "description": "pg: ok, connecting, timeout or unavailable; verifier: ok or unverifiable" } } }, "ReadyzNotReady": { "title": "ReadyzNotReady", "type": "object", "properties": { "ready": { "const": false }, "role": { "type": "string" }, "daemon_ready": { "type": "boolean" }, "checks": { "type": "object" }, "error": { "type": "string" } }, "description": "a failed check, or an unexpected error" }, "ReauthMethodsBadRequest": { "title": "ReauthMethodsBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "bad_request" }, "detail": { "type": "string" } } }, "RecoveryAccepted": { "title": "RecoveryAccepted", "type": "object", "required": [ "status" ], "additionalProperties": false, "properties": { "status": { "const": "accepted" } } }, "RecoveryChallenge": { "title": "RecoveryChallenge", "type": "object", "required": [ "challenge", "expires_at", "seed_kdf_salt" ], "additionalProperties": false, "properties": { "challenge": { "type": "string", "description": "32 bytes as hex" }, "expires_at": { "type": "string", "format": "date-time" }, "seed_kdf_salt": { "type": "string", "description": "16 bytes as hex; a stable decoy for an unknown account" } } }, "RecoveryChallengeRefused": { "title": "RecoveryChallengeRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_or_expired" }, "detail": { "type": "string" } } }, "RecoveryChallengeRequest": { "title": "RecoveryChallengeRequest", "type": "object", "required": [ "email" ], "properties": { "email": { "type": "string" }, "recovery_token": { "type": "string" }, "recovery_code": { "type": "string" } } }, "RecoveryMaterial": { "title": "RecoveryMaterial", "type": "object", "required": [ "is_solo", "wrapped_seed_backup" ], "properties": { "is_solo": { "type": "boolean" }, "wrapped_seed_backup": { "type": [ "string", "null" ] }, "wrapped_personal_dek": { "description": "Solo accounts" }, "wrapped_secret_dek": { "description": "Solo accounts" }, "memberships": { "type": "array", "description": "company accounts", "items": { "type": "object", "required": [ "team_id", "wrapped_master_team_dek" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "wrapped_master_team_dek": { "type": "string" } } } } } }, "RecoveryMaterialMalformed": { "title": "RecoveryMaterialMalformed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "malformed" }, "detail": { "type": "string" } } }, "RecoveryMaterialRefused": { "title": "RecoveryMaterialRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_or_expired, recovery_denied" }, "detail": { "type": "string" } } }, "RecoveryMaterialRequest": { "title": "RecoveryMaterialRequest", "type": "object", "required": [ "email", "proof" ], "properties": { "email": { "type": "string" }, "recovery_token": { "type": "string" }, "recovery_code": { "type": "string" }, "proof": { "type": "object", "description": "the challenge and its signature" } } }, "RecoveryRequestBody": { "title": "RecoveryRequestBody", "type": "object", "required": [ "email" ], "properties": { "email": { "type": "string", "maxLength": 320 } }, "description": "body capped at 8 KiB" }, "RecoveryRotateBadRequest": { "title": "RecoveryRotateBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_body, invalid_value" }, "detail": { "type": "string" } } }, "RecoveryRotateRefused": { "title": "RecoveryRotateRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_or_expired, unknown_account, account_unavailable, opaque_ticket_invalid, recovery_unavailable, challenge_expired_or_unknown, recovery_proof_failed" }, "detail": { "type": "string" } } }, "RecoveryRotateRequest": { "title": "RecoveryRotateRequest", "type": "object", "required": [ "email", "new_pubkey", "new_kdf_salt", "credential_id", "record", "proof" ], "properties": { "email": { "type": "string" }, "recovery_token": { "type": "string" }, "recovery_code": { "type": "string" }, "proof": { "type": "object", "description": "the challenge and its signature" }, "new_pubkey": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "32 bytes as hex" }, "new_kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "16 bytes as hex" }, "new_wrapped_master": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "new_wrapped_personal_dek": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "new_wrapped_secret_dek": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "new_wrapped_seed_backup": { "type": "string", "description": "hex, Solo accounts" }, "rewrap_memberships": { "type": "array", "items": { "type": "object" } }, "credential_id": { "type": "string", "format": "uuid" }, "record": { "type": "string", "description": "the OPAQUE registration record" } } }, "RecoveryRotated": { "title": "RecoveryRotated", "type": "object", "required": [ "ok", "passkeys_removed" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "passkeys_removed": { "type": "integer" } } }, "RecycleBin": { "title": "RecycleBin", "type": "object", "required": [ "groups", "workflows", "groups_total", "workflows_total", "limit", "offset" ], "additionalProperties": false, "properties": { "groups": { "type": "array", "items": { "type": "object" } }, "workflows": { "type": "array", "items": { "type": "object", "required": [ "id", "name", "deleted_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": [ "string", "null" ] }, "deleted_at": { "type": "string", "format": "date-time" } } } }, "groups_total": { "type": "integer" }, "workflows_total": { "type": "integer" }, "limit": { "type": "integer" }, "offset": { "type": "integer" } } }, "RegisterCompanyRequest": { "title": "RegisterCompanyRequest", "type": "object", "required": [ "company_name", "email", "user", "sign_pubkey", "wrapped_team_dek", "wrapped_master_team_dek", "completion_token" ], "properties": { "company_name": { "type": "string" }, "plan": { "enum": [ "team", "company" ], "default": "team" }, "email": { "type": "string", "maxLength": 254 }, "user": { "type": "object", "required": [ "pubkey", "kdf_salt", "seed_kdf_salt", "wrapped_master", "wrapped_seed_backup", "opaque" ], "properties": { "pubkey": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "32 bytes as hex" }, "kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "16 bytes as hex" }, "seed_kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "16 bytes as hex" }, "wrapped_master": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "wrapped_seed_backup": { "type": "string" }, "opaque": { "type": "object", "required": [ "credential_id", "record" ], "additionalProperties": false, "properties": { "credential_id": { "type": "string", "format": "uuid" }, "record": { "type": "string", "description": "the OPAQUE registration record from register/start under a signup ticket" } } } } }, "sign_pubkey": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "32 bytes as hex" }, "wrapped_team_dek": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "wrapped_master_team_dek": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "completion_token": { "type": "string" } }, "description": "terms-of-service consent fields are read as well and refused with a code when malformed" }, "RegisterSoloRequest": { "title": "RegisterSoloRequest", "type": "object", "required": [ "email", "pubkey", "kdf_salt", "seed_kdf_salt", "wrapped_seed_backup", "opaque", "sign_pubkey", "wrapped_personal_dek", "completion_token" ], "properties": { "email": { "type": "string", "maxLength": 254 }, "pubkey": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "32 bytes as hex" }, "kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "16 bytes as hex" }, "seed_kdf_salt": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "16 bytes as hex" }, "wrapped_seed_backup": { "type": "string", "description": "hex, at least the minimum length" }, "opaque": { "type": "object", "required": [ "credential_id", "record" ], "additionalProperties": false, "properties": { "credential_id": { "type": "string", "format": "uuid" }, "record": { "type": "string", "description": "the OPAQUE registration record from register/start under a signup ticket" } } }, "sign_pubkey": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "32 bytes as hex" }, "wrapped_personal_dek": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" }, "completion_token": { "type": "string" } } }, "RelayedCaldyrreplayAnswer": { "title": "RelayedCaldyrreplayAnswer", "type": [ "object", "array" ], "description": "answered by caldyr-replay; its own error statuses pass through unchanged" }, "RelayedauditdeliveryAnswer": { "title": "RelayedauditdeliveryAnswer", "type": [ "object", "array" ], "description": "answered by audit-delivery; its own error statuses pass through unchanged" }, "RelayedauditdeliveryBody": { "title": "RelayedauditdeliveryBody", "type": "object", "description": "forwarded to audit-delivery as sent; it validates the fields" }, "RelayedcaldyrcostAnswer": { "title": "RelayedcaldyrcostAnswer", "type": [ "object", "array" ], "description": "answered by caldyr-cost; its own error statuses pass through unchanged" }, "RelayedcaldyrcostBody": { "title": "RelayedcaldyrcostBody", "type": "object", "description": "forwarded to caldyr-cost as sent; it validates the fields" }, "RelayedcaldyrreplayAnswer": { "title": "RelayedcaldyrreplayAnswer", "type": [ "object", "array" ], "description": "answered by caldyr-replay; its own error statuses pass through unchanged" }, "RelayedcaldyrreplayBody": { "title": "RelayedcaldyrreplayBody", "type": "object", "description": "forwarded to caldyr-replay as sent; it validates the fields" }, "RelayedfleetconfigAnswer": { "title": "RelayedfleetconfigAnswer", "type": [ "object", "array" ], "description": "answered by fleet-config; its own error statuses pass through unchanged" }, "RelayedfleetconfigBody": { "title": "RelayedfleetconfigBody", "type": "object", "description": "forwarded to fleet-config as sent; it validates the fields" }, "RelayedsecretsserverAnswer": { "title": "RelayedsecretsserverAnswer", "type": [ "object", "array" ], "description": "answered by secrets-server; its own error statuses pass through unchanged" }, "RelayedwebhooksAnswer": { "title": "RelayedwebhooksAnswer", "type": [ "object", "array" ], "description": "answered by webhooks; its own error statuses pass through unchanged" }, "RelayedwebhooksBody": { "title": "RelayedwebhooksBody", "type": "object", "description": "forwarded to webhooks as sent; it validates the fields" }, "ResealBatchRequest": { "title": "ResealBatchRequest", "type": "object", "required": [ "session_id", "key_version", "frames" ], "additionalProperties": false, "properties": { "session_id": { "type": "string", "format": "uuid" }, "key_version": { "type": "integer", "minimum": 1 }, "frames": { "type": "array", "minItems": 1, "maxItems": 500, "items": { "type": "object", "required": [ "seq", "kind", "prev", "nonce", "ct" ], "additionalProperties": false, "properties": { "seq": { "type": "integer", "minimum": 0 }, "kind": { "enum": [ "pty_out", "agent_event", "pty_in" ] }, "prev": { "type": "object", "additionalProperties": false, "properties": { "enc_v": { "enum": [ 0, 1 ] }, "nonce": { "type": "string", "pattern": "^[0-9a-f]+$", "description": "required when enc_v is 1" } }, "required": [ "enc_v" ], "description": "the stored row being replaced" }, "nonce": { "type": "string", "pattern": "^[0-9a-f]{48}$" }, "ct": { "type": "string", "pattern": "^(?:[0-9a-f]{2})+$", "description": "sealed copy, hex, longer than the tag, up to the sealed-frame limit" } } } } } }, "ResealBatchResult": { "title": "ResealBatchResult", "type": "object", "required": [ "session_id", "replaced", "already_resealed", "conflict", "not_found", "conflicts", "complete" ], "properties": { "session_id": { "type": "string", "format": "uuid" }, "key_version": { "type": "integer" }, "session_remaining": { "type": "integer" }, "session_done": { "type": "boolean" }, "company_remaining": { "type": "integer" }, "company_remaining_rows": { "type": "integer" }, "company_remaining_meta": { "type": "integer" }, "complete": { "type": "boolean" }, "replaced": { "type": "integer" }, "already_resealed": { "type": "integer" }, "conflict": { "type": "integer" }, "not_found": { "type": "integer" }, "conflicts": { "type": "array", "items": { "type": "object", "required": [ "kind", "seq", "outcome" ], "additionalProperties": false, "properties": { "kind": { "type": "string" }, "seq": { "type": "integer" }, "outcome": { "enum": [ "conflict", "not_found" ] } } } } } }, "ResealConflict": { "title": "ResealConflict", "type": "object", "required": [ "error" ], "properties": { "error": { "enum": [ "e2e_mode_off", "session_live", "session_not_legacy", "reseal_key_version_mismatch", "team_key_version_not_active" ] }, "key_version": { "type": "integer" } } }, "ResealList": { "title": "ResealList", "type": "object", "required": [ "e2e_mode", "remaining_rows", "remaining_meta", "remaining_sessions", "sessions" ], "additionalProperties": false, "properties": { "e2e_mode": { "const": "on" }, "remaining_rows": { "type": "integer" }, "remaining_meta": { "type": "integer" }, "remaining_sessions": { "type": "integer" }, "sessions": { "type": "array", "maxItems": 100, "items": { "type": "object", "required": [ "session_id", "team_id", "key_version", "legacy_rows", "legacy_meta" ], "additionalProperties": false, "properties": { "session_id": { "type": "string", "format": "uuid" }, "team_id": { "type": "string", "format": "uuid" }, "key_version": { "type": [ "integer", "null" ] }, "legacy_rows": { "type": "integer" }, "legacy_meta": { "type": "integer" } } } } } }, "ResealMetaRequest": { "title": "ResealMetaRequest", "type": "object", "required": [ "session_id", "key_version", "meta" ], "additionalProperties": false, "properties": { "session_id": { "type": "string", "format": "uuid" }, "key_version": { "type": "integer", "minimum": 1 }, "meta": { "type": "object", "required": [ "prev", "nonce", "ciphertext" ], "additionalProperties": false, "properties": { "prev": { "type": "object", "required": [ "aad_version", "nonce" ], "additionalProperties": false, "properties": { "aad_version": { "type": "integer", "minimum": 1, "description": "the legacy version read; not 2" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]+$" } } }, "nonce": { "type": "string", "pattern": "^[0-9a-f]{48}$" }, "ciphertext": { "type": "string", "pattern": "^(?:[0-9a-f]{2})+$" } } } } }, "ResealMetaResult": { "title": "ResealMetaResult", "type": "object", "required": [ "session_id", "outcome", "older_legacy_deleted", "complete" ], "properties": { "session_id": { "type": "string", "format": "uuid" }, "key_version": { "type": "integer" }, "session_remaining": { "type": "integer" }, "session_done": { "type": "boolean" }, "company_remaining": { "type": "integer" }, "company_remaining_rows": { "type": "integer" }, "company_remaining_meta": { "type": "integer" }, "complete": { "type": "boolean" }, "outcome": { "enum": [ "replaced", "already_resealed", "conflict" ] }, "older_legacy_deleted": { "type": "integer" } } }, "ResealRefusal": { "title": "ResealRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "enum": [ "invalid_value", "plaintext_refused" ] }, "detail": { "type": "string" } } }, "RoamingAuthPref": { "title": "RoamingAuthPref", "type": "object", "required": [ "roaming_auth_enabled" ], "additionalProperties": false, "properties": { "roaming_auth_enabled": { "type": "boolean" } } }, "RoamingAuthPrefInvalid": { "title": "RoamingAuthPrefInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value" }, "detail": { "type": "string" } } }, "RoamingAuthPrefRequest": { "title": "RoamingAuthPrefRequest", "type": "object", "required": [ "roaming_auth_enabled" ], "properties": { "roaming_auth_enabled": { "type": "boolean" } } }, "RoamingAuthPrefSet": { "title": "RoamingAuthPrefSet", "type": "object", "required": [ "roaming_auth_enabled" ], "additionalProperties": false, "properties": { "roaming_auth_enabled": { "type": "boolean" } } }, "RoamingPolicyForbidden": { "title": "RoamingPolicyForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden, or csrf_token mismatch" }, "detail": { "type": "string" } } }, "RoamingPolicyInvalid": { "title": "RoamingPolicyInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value" }, "detail": { "type": "string" } } }, "RoamingPolicyNotFound": { "title": "RoamingPolicyNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "not_found" }, "detail": { "type": "string" } } }, "RoamingPolicyRequest": { "title": "RoamingPolicyRequest", "type": "object", "required": [ "allow_roaming_keys" ], "properties": { "allow_roaming_keys": { "enum": [ "on", "off" ] } } }, "RoamingPolicySet": { "title": "RoamingPolicySet", "type": "object", "required": [ "allow_roaming_keys" ], "additionalProperties": false, "properties": { "allow_roaming_keys": { "enum": [ "on", "off" ] } } }, "RoamingPolicyUnauthorized": { "title": "RoamingPolicyUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized" }, "detail": { "type": "string" } } }, "SandboxPolicy": { "title": "SandboxPolicy", "type": "object", "required": [ "team_id", "sealed" ], "additionalProperties": false, "properties": { "team_id": { "type": "string", "format": "uuid" }, "sealed": { "type": [ "string", "null" ], "description": "the stored envelope as JSON text { enc_v: 2, key_version, nonce, ct }, or null" } } }, "SandboxPolicyRequest": { "title": "SandboxPolicyRequest", "type": "object", "required": [ "sealed" ], "properties": { "sealed": { "type": "string", "description": "JSON text of an envelope { enc_v: 2, key_version, nonce, ct } with ct as lower-case hex" } } }, "ScimError": { "title": "ScimError", "type": "object", "required": [ "schemas", "status", "detail" ], "properties": { "schemas": { "type": "array", "items": { "const": "urn:ietf:params:scim:api:messages:2.0:Error" } }, "status": { "type": "string", "description": "the HTTP status as a string" }, "detail": { "type": "string" }, "scimType": { "enum": [ "invalidValue", "invalidFilter", "mutability", "uniqueness", "invalidSyntax", "invalidPath", "noTarget" ] }, "error": { "type": "string", "description": "tenant gate refusals add the gate body (error, ...) next to the SCIM fields" } } }, "ScimGroup": { "title": "ScimGroup", "type": "object", "additionalProperties": false, "required": [ "schemas", "id", "displayName", "members", "meta" ], "properties": { "schemas": { "type": "array", "items": { "const": "urn:ietf:params:scim:schemas:core:2.0:Group" } }, "id": { "type": "string", "format": "uuid" }, "displayName": { "type": "string" }, "members": { "type": "array", "items": { "type": "object", "required": [ "value", "display", "type" ], "description": "also carries $ref, the URL of the member user (not listed: a property named $ref is read as a reference by OpenAPI tooling)", "properties": { "value": { "type": "string", "format": "uuid" }, "display": { "type": [ "string", "null" ] }, "type": { "const": "User" } } } }, "meta": { "type": "object", "additionalProperties": false, "required": [ "resourceType", "location" ], "properties": { "resourceType": { "const": "Group" }, "created": { "type": [ "string", "null" ] }, "lastModified": { "type": [ "string", "null" ] }, "location": { "type": "string" } } } } }, "ScimGroupList": { "title": "ScimGroupList", "type": "object", "additionalProperties": false, "required": [ "schemas", "totalResults", "startIndex", "itemsPerPage", "Resources" ], "properties": { "schemas": { "type": "array", "items": { "const": "urn:ietf:params:scim:api:messages:2.0:ListResponse" } }, "totalResults": { "type": "integer" }, "startIndex": { "type": "integer", "minimum": 1 }, "itemsPerPage": { "type": "integer" }, "Resources": { "type": "array", "items": { "x-media-type": "application/scim+json", "title": "ScimGroup", "type": "object", "additionalProperties": false, "required": [ "schemas", "id", "displayName", "members", "meta" ], "properties": { "schemas": { "type": "array", "items": { "const": "urn:ietf:params:scim:schemas:core:2.0:Group" } }, "id": { "type": "string", "format": "uuid" }, "displayName": { "type": "string" }, "members": { "type": "array", "items": { "type": "object", "required": [ "value", "display", "type" ], "description": "also carries $ref, the URL of the member user (not listed: a property named $ref is read as a reference by OpenAPI tooling)", "properties": { "value": { "type": "string", "format": "uuid" }, "display": { "type": [ "string", "null" ] }, "type": { "const": "User" } } } }, "meta": { "type": "object", "additionalProperties": false, "required": [ "resourceType", "location" ], "properties": { "resourceType": { "const": "Group" }, "created": { "type": [ "string", "null" ] }, "lastModified": { "type": [ "string", "null" ] }, "location": { "type": "string" } } } } } } } }, "ScimGroupPatchRequest": { "title": "ScimGroupPatchRequest", "type": "object", "required": [ "schemas", "Operations" ], "properties": { "schemas": { "type": "array", "items": { "const": "urn:ietf:params:scim:api:messages:2.0:PatchOp" } }, "Operations": { "type": "array", "items": { "type": "object", "required": [ "op" ], "properties": { "op": { "enum": [ "add", "remove", "replace" ] }, "path": { "type": "string" }, "value": {} } } } } }, "ScimGroupRequest": { "title": "ScimGroupRequest", "type": "object", "required": [ "schemas", "displayName" ], "properties": { "schemas": { "type": "array", "items": { "type": "string" } }, "displayName": { "type": "string" }, "members": { "type": "array", "items": { "type": "object", "required": [ "value" ], "properties": { "value": { "type": "string", "format": "uuid" }, "display": { "type": "string" } } } } } }, "ScimHealth": { "title": "ScimHealth", "type": "object", "required": [ "rate_limit" ], "additionalProperties": false, "properties": { "rate_limit": { "type": "object", "required": [ "window_ms", "max_fails", "retry_after_sec", "tracked_ip_count", "throttled_ip_count" ], "properties": { "window_ms": { "type": "integer" }, "max_fails": { "type": "integer" }, "retry_after_sec": { "type": "integer" }, "tracked_ip_count": { "type": "integer" }, "throttled_ip_count": { "type": "integer" } } } } }, "ScimResourceType": { "title": "ScimResourceType", "type": "object", "required": [ "schemas" ], "description": "one resource type (User or Group)", "properties": { "schemas": { "type": "array", "items": { "type": "string" } } } }, "ScimResourceTypes": { "title": "ScimResourceTypes", "type": "object", "required": [ "schemas", "totalResults", "Resources" ], "description": "the User and Group resource types", "properties": { "schemas": { "type": "array", "items": { "type": "string" } }, "totalResults": { "const": 2 }, "Resources": { "type": "array", "items": { "type": "object" } } } }, "ScimSchema": { "title": "ScimSchema", "type": "object", "required": [ "schemas" ], "description": "one schema document", "properties": { "schemas": { "type": "array", "items": { "type": "string" } } } }, "ScimSchemas": { "title": "ScimSchemas", "type": "object", "required": [ "schemas", "totalResults", "Resources" ], "description": "the User and Group schemas", "properties": { "schemas": { "type": "array", "items": { "type": "string" } }, "totalResults": { "const": 2 }, "Resources": { "type": "array", "items": { "type": "object" } } } }, "ScimServiceProviderConfig": { "title": "ScimServiceProviderConfig", "type": "object", "required": [ "schemas", "patch", "bulk", "filter", "changePassword", "sort", "etag", "authenticationSchemes", "meta" ], "properties": { "schemas": { "type": "array", "items": { "const": "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig" } }, "patch": { "type": "object", "properties": { "supported": { "const": true } } }, "bulk": { "type": "object", "properties": { "supported": { "const": false } } }, "filter": { "type": "object", "properties": { "supported": { "const": true }, "maxResults": { "const": 200 } } }, "changePassword": { "type": "object" }, "sort": { "type": "object" }, "etag": { "type": "object" }, "authenticationSchemes": { "type": "array", "items": { "type": "object", "properties": { "type": { "const": "oauthbearertoken" }, "name": { "type": "string" }, "description": { "type": "string" }, "specUri": { "type": "string" }, "primary": { "type": "boolean" } } } }, "meta": { "type": "object", "properties": { "resourceType": { "type": "string" }, "location": { "type": "string" } } } } }, "ScimTokenCreated": { "title": "ScimTokenCreated", "type": "object", "required": [ "id", "name", "token", "created_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "token": { "type": "string", "description": "64 hex characters, shown once; only the hash is kept" }, "created_at": { "type": "string", "format": "date-time" }, "revoked_token_id": { "type": "string", "format": "uuid", "description": "rotation only: the token that was replaced" } } }, "ScimTokenHistory": { "title": "ScimTokenHistory", "type": "object", "required": [ "history" ], "additionalProperties": false, "properties": { "history": { "type": "array", "items": { "type": "object", "required": [ "id", "ts", "action" ], "properties": { "id": { "type": "string" }, "ts": { "type": "string", "format": "date-time" }, "action": { "type": "string" }, "outcome": { "type": [ "string", "null" ] }, "ip_addr": { "type": [ "string", "null" ] }, "user_id": { "type": [ "string", "null" ], "format": "uuid" }, "meta": { "type": [ "object", "null" ] } } } } } }, "ScimTokenList": { "title": "ScimTokenList", "type": "object", "required": [ "tokens" ], "additionalProperties": false, "properties": { "tokens": { "type": "array", "items": { "type": "object", "required": [ "id", "name", "created_at", "users_provisioned_count" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "last_used_at": { "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "type": "string", "format": "date-time" }, "created_by": { "type": [ "string", "null" ], "format": "uuid" }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" }, "users_provisioned_count": { "type": "integer" } } } } } }, "ScimTokenRevoked": { "title": "ScimTokenRevoked", "type": "object", "required": [ "id", "name", "revoked_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "revoked_at": { "type": "string", "format": "date-time" } } }, "ScimTokenRotated": { "title": "ScimTokenRotated", "type": "object", "required": [ "id", "name", "token", "created_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "token": { "type": "string", "description": "64 hex characters, shown once; only the hash is kept" }, "created_at": { "type": "string", "format": "date-time" }, "revoked_token_id": { "type": "string", "format": "uuid", "description": "rotation only: the token that was replaced" } } }, "ScimUser": { "title": "ScimUser", "type": "object", "additionalProperties": false, "required": [ "schemas", "id", "userName", "name", "emails", "active", "meta" ], "properties": { "schemas": { "type": "array", "items": { "const": "urn:ietf:params:scim:schemas:core:2.0:User" } }, "id": { "type": "string", "format": "uuid" }, "userName": { "type": "string" }, "name": { "type": "object", "required": [ "givenName", "familyName" ], "additionalProperties": false, "properties": { "givenName": { "type": "string" }, "familyName": { "type": "string" } } }, "emails": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "value", "primary", "type" ], "properties": { "value": { "type": "string" }, "primary": { "type": "boolean" }, "type": { "const": "work" } } } }, "active": { "type": "boolean" }, "meta": { "type": "object", "additionalProperties": false, "required": [ "resourceType", "location" ], "properties": { "resourceType": { "const": "User" }, "created": { "type": [ "string", "null" ] }, "lastModified": { "type": [ "string", "null" ] }, "location": { "type": "string" } } } } }, "ScimUserList": { "title": "ScimUserList", "type": "object", "additionalProperties": false, "required": [ "schemas", "totalResults", "startIndex", "itemsPerPage", "Resources" ], "properties": { "schemas": { "type": "array", "items": { "const": "urn:ietf:params:scim:api:messages:2.0:ListResponse" } }, "totalResults": { "type": "integer" }, "startIndex": { "type": "integer", "minimum": 1 }, "itemsPerPage": { "type": "integer" }, "Resources": { "type": "array", "items": { "x-media-type": "application/scim+json", "title": "ScimUser", "type": "object", "additionalProperties": false, "required": [ "schemas", "id", "userName", "name", "emails", "active", "meta" ], "properties": { "schemas": { "type": "array", "items": { "const": "urn:ietf:params:scim:schemas:core:2.0:User" } }, "id": { "type": "string", "format": "uuid" }, "userName": { "type": "string" }, "name": { "type": "object", "required": [ "givenName", "familyName" ], "additionalProperties": false, "properties": { "givenName": { "type": "string" }, "familyName": { "type": "string" } } }, "emails": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "value", "primary", "type" ], "properties": { "value": { "type": "string" }, "primary": { "type": "boolean" }, "type": { "const": "work" } } } }, "active": { "type": "boolean" }, "meta": { "type": "object", "additionalProperties": false, "required": [ "resourceType", "location" ], "properties": { "resourceType": { "const": "User" }, "created": { "type": [ "string", "null" ] }, "lastModified": { "type": [ "string", "null" ] }, "location": { "type": "string" } } } } } } } }, "ScimUserPatchRequest": { "title": "ScimUserPatchRequest", "type": "object", "required": [ "schemas", "Operations" ], "properties": { "schemas": { "type": "array", "items": { "const": "urn:ietf:params:scim:api:messages:2.0:PatchOp" } }, "Operations": { "type": "array", "items": { "type": "object", "required": [ "op" ], "properties": { "op": { "enum": [ "add", "remove", "replace" ] }, "path": { "type": "string" }, "value": {} } } } } }, "ScimUserRequest": { "title": "ScimUserRequest", "type": "object", "required": [ "schemas", "userName" ], "properties": { "schemas": { "type": "array", "items": { "type": "string" }, "description": "must include urn:ietf:params:scim:schemas:core:2.0:User" }, "userName": { "type": "string" }, "name": { "type": "object", "properties": { "givenName": { "type": "string" }, "familyName": { "type": "string" } } }, "emails": { "type": "array", "items": { "type": "object", "properties": { "value": { "type": "string" }, "primary": { "type": "boolean" }, "type": { "type": "string" } } } }, "active": { "type": "boolean" }, "externalId": { "type": "string" } } }, "SealedSecretDeleted": { "title": "SealedSecretDeleted", "type": "object", "required": [ "deleted" ], "additionalProperties": false, "properties": { "deleted": { "type": "string" } } }, "SealedSecretItem": { "title": "SealedSecretItem", "type": "object", "required": [ "scope_kind", "scope_id", "name", "key_version", "nonce", "ciphertext" ], "additionalProperties": false, "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "key_version": { "type": "integer" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" } } }, "SealedSecretList": { "title": "SealedSecretList", "type": "object", "required": [ "scope_kind", "scope_id", "e2e_mode", "secrets" ], "additionalProperties": false, "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "e2e_mode": { "enum": [ "on", "off" ] }, "secrets": { "type": "array", "items": { "type": "object", "required": [ "name", "storage", "key_version", "updated_at", "used_by_service", "service" ], "additionalProperties": false, "properties": { "name": { "type": "string" }, "storage": { "enum": [ "sealed", "custody" ] }, "key_version": { "type": [ "integer", "null" ] }, "updated_at": { "type": [ "string", "null" ] }, "used_by_service": { "type": "boolean" }, "service": { "type": [ "string", "null" ] } } } } } }, "SeatsExhausted": { "title": "SeatsExhausted", "type": "object", "required": [ "error", "reason", "limit", "hard_cap", "used", "tier" ], "properties": { "error": { "const": "license_seats_exhausted" }, "reason": {}, "limit": {}, "hard_cap": {}, "used": {}, "tier": {} } }, "SecretDeleteRequest": { "title": "SecretDeleteRequest", "type": "object", "required": [ "team_id", "name" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1 } } }, "SecretDeleteResponse": { "title": "SecretDeleteResponse", "type": "object", "required": [ "deleted" ], "additionalProperties": false, "properties": { "deleted": { "type": "string" } } }, "SecretGetRequest": { "title": "SecretGetRequest", "type": "object", "required": [ "team_id", "blind_index" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "blind_index": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$", "description": "32-byte blind index of the name, hex" } } }, "SecretGetResponse": { "title": "SecretGetResponse", "type": "object", "required": [ "results" ], "additionalProperties": false, "properties": { "results": { "type": "array", "items": { "type": "object", "required": [ "id", "ciphertext", "nonce", "kind", "aad_version" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "kind": { "type": "string" }, "aad_version": { "type": "integer" } } } } } }, "SecretListRequest": { "title": "SecretListRequest", "type": "object", "required": [ "team_id" ], "properties": { "team_id": { "type": "string", "format": "uuid" } } }, "SecretListResponse": { "title": "SecretListResponse", "type": "object", "required": [ "secrets" ], "additionalProperties": false, "properties": { "secrets": { "type": "array", "items": { "type": "object", "required": [ "name", "created_at", "blind_index_hint" ], "additionalProperties": false, "properties": { "name": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "blind_index_hint": { "type": [ "string", "null" ] } } } } } }, "SecretRotateRequest": { "title": "SecretRotateRequest", "type": "object", "required": [ "team_id", "name", "ciphertext", "nonce", "blind_index" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1 }, "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "aad_version": { "type": "integer", "default": 1 }, "blind_index": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$", "description": "32-byte blind index of the name, hex" } } }, "SecretRotateResponse": { "title": "SecretRotateResponse", "type": "object", "required": [ "ok", "blob_id", "rotated" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "blob_id": { "type": "string", "format": "uuid" }, "rotated": { "type": "string" } } }, "SecretSetRequest": { "title": "SecretSetRequest", "type": "object", "required": [ "team_id", "name", "ciphertext", "nonce", "blind_index" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1 }, "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "aad_version": { "type": "integer", "default": 1 }, "blind_index": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$", "description": "32-byte blind index of the name, hex" } } }, "SecretSetResponse": { "title": "SecretSetResponse", "type": "object", "required": [ "blob_id", "ok" ], "additionalProperties": false, "properties": { "blob_id": { "type": "string", "format": "uuid" }, "ok": { "const": true } } }, "SecretVerifyRequest": { "title": "SecretVerifyRequest", "type": "object", "required": [ "team_id", "blind_index" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "blind_index": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$", "description": "32-byte blind index of the name, hex" } } }, "SecretVerifyResponse": { "title": "SecretVerifyResponse", "type": "object", "required": [ "ok", "verified_at" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "verified_at": { "type": "string", "format": "date-time" } } }, "ServerEscrowAnchorPubkey": { "title": "ServerEscrowAnchorPubkey", "type": "object", "required": [ "pubkey" ], "additionalProperties": false, "properties": { "pubkey": { "type": "string", "description": "hex" } } }, "ServerEscrowAnchorUnavailable": { "title": "ServerEscrowAnchorUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "authorization_check_unavailable" }, "detail": { "type": "string" } } }, "ServerEscrowRequest": { "title": "ServerEscrowRequest", "type": "object", "required": [ "wrapped_team_dek_for_server" ], "properties": { "wrapped_team_dek_for_server": { "type": "string", "pattern": "^[0-9a-fA-F]{184,}$", "description": "the team key wrapped to the server anchor key (GET /server-escrow/anchor-pubkey)" }, "reauth_token": { "type": "string", "description": "required when the caller is the only active admin: a fresh re-authentication token for this purpose" }, "totp_code": { "type": "string", "description": "step-up: the current TOTP code" }, "recovery_code": { "type": "string", "description": "step-up: a recovery code instead of totp_code" } } }, "ServerEscrowRequested": { "title": "ServerEscrowRequested", "type": "object", "required": [ "status", "request_id", "expires_at", "admins_available" ], "additionalProperties": false, "properties": { "status": { "enum": [ "second_approval_required", "activation_scheduled" ] }, "request_id": { "type": "string", "format": "uuid" }, "expires_at": { "type": "string", "format": "date-time" }, "activates_at": { "type": "string", "format": "date-time", "description": "only for activation_scheduled (single admin)" }, "admins_available": { "type": "integer" } } }, "ServerEscrowRequests": { "title": "ServerEscrowRequests", "type": "object", "required": [ "requests", "enabled" ], "additionalProperties": false, "properties": { "requests": { "type": "array", "items": { "type": "object", "required": [ "id", "team_id", "requested_by", "requested_at", "expires_at", "can_approve" ], "properties": { "id": { "type": "string", "format": "uuid" }, "team_id": { "type": "string", "format": "uuid" }, "requested_by": { "type": "string", "format": "uuid" }, "requested_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time" }, "activates_at": { "type": [ "string", "null" ], "format": "date-time" }, "can_approve": { "type": "boolean", "description": "false for the caller's own request" } } } }, "enabled": { "type": "array", "items": { "type": "object", "required": [ "team_id", "enabled_at" ], "additionalProperties": false, "properties": { "team_id": { "type": "string", "format": "uuid" }, "enabled_at": { "type": "string", "format": "date-time" } } } } } }, "ServiceUserDekRepaired": { "title": "ServiceUserDekRepaired", "type": "object", "required": [ "user_id", "has_team_wrap" ], "additionalProperties": false, "properties": { "user_id": { "type": "string", "format": "uuid" }, "has_team_wrap": { "const": true } } }, "ServiceUserPubkey": { "title": "ServiceUserPubkey", "type": "object", "required": [ "user_id", "pubkey", "has_team_wrap", "e2e_mode" ], "additionalProperties": false, "properties": { "user_id": { "type": "string", "format": "uuid" }, "pubkey": { "type": "string" }, "has_team_wrap": { "type": "boolean" }, "e2e_mode": {} } }, "SessionList": { "title": "SessionList", "type": "object", "required": [ "sessions" ], "additionalProperties": false, "properties": { "sessions": { "type": "array", "items": { "type": "object", "required": [ "id", "created_at", "current" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time" }, "last_seen_at": { "type": [ "string", "null" ], "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time" }, "user_agent": { "type": [ "string", "null" ] }, "ip_addr": { "type": [ "string", "null" ] }, "current": { "type": "boolean" } } } } } }, "SessionNotFound": { "title": "SessionNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "session_not_found" }, "detail": { "type": "string" } } }, "SessionRevoked": { "title": "SessionRevoked", "type": "object", "required": [ "revoked" ], "additionalProperties": false, "properties": { "revoked": { "const": true } } }, "SessionSecurityEvents": { "title": "SessionSecurityEvents", "type": "object", "required": [ "events" ], "additionalProperties": false, "properties": { "events": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": [ "integer", "string" ] }, "ts": { "type": "string", "format": "date-time" }, "source": { "type": [ "string", "null" ] }, "ref_id": { "type": [ "string", "null" ] }, "path": { "type": [ "string", "null" ] }, "detector": { "type": [ "string", "null" ] }, "verdict": { "type": [ "string", "null" ] }, "reason": { "type": [ "string", "null" ] } } } } } }, "SessionTokenDeleted": { "title": "SessionTokenDeleted", "type": "object", "required": [ "deleted" ], "additionalProperties": false, "properties": { "deleted": { "type": "integer", "minimum": 1 } } }, "SessionTokenNone": { "title": "SessionTokenNone", "type": "object", "required": [ "deleted" ], "additionalProperties": false, "properties": { "deleted": { "const": 0 } } }, "SessionsRevoked": { "title": "SessionsRevoked", "type": "object", "required": [ "revoked", "cli_tokens_revoked", "oauth_grants_revoked" ], "additionalProperties": false, "properties": { "revoked": { "type": "integer" }, "cli_tokens_revoked": { "type": "integer" }, "oauth_grants_revoked": { "type": "integer" } } }, "SiemLicenceRefusal": { "title": "SiemLicenceRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "enum": [ "license_siem_not_included", "license_siem_kind_not_included", "license_siem_destinations_exhausted" ] }, "tier": { "type": [ "string", "null" ] }, "kind": { "type": "string" }, "allowed_kinds": { "type": "array", "items": { "type": "string" } }, "current": { "type": "integer" }, "limit": { "type": "integer" } }, "description": "the licence gate in front of a destination create or update" }, "SiemRefBadRequest": { "title": "SiemRefBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_body, unexpected_field, invalid_value" }, "detail": { "type": "string" } } }, "SiemRefForbidden": { "title": "SiemRefForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "automation_token_required, or a tenant-gate refusal" }, "detail": { "type": "string" } } }, "SiemRefGetRequest": { "title": "SiemRefGetRequest", "type": "object", "required": [ "handle" ], "additionalProperties": false, "properties": { "handle": { "type": "string", "pattern": "^[0-9a-f]{32}$" } } }, "SiemRefNotFound": { "title": "SiemRefNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "not_found" }, "detail": { "type": "string" } } }, "SiemRefRateLimited": { "title": "SiemRefRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "rate_limited" }, "detail": { "type": "string" } } }, "SiemRefSecrets": { "title": "SiemRefSecrets", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "secrets_unreachable, secrets_error, secrets_no_value" }, "detail": { "type": "string" } } }, "SiemRefUnavailable": { "title": "SiemRefUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "binding_lookup_unavailable, tenant_service_user_missing, audit_log_unavailable" }, "detail": { "type": "string" } } }, "SiemRefValue": { "title": "SiemRefValue", "type": "object", "required": [ "value" ], "additionalProperties": false, "properties": { "value": { "type": "string", "description": "the credential; audited before it is returned" } } }, "SiemSecretBinding": { "title": "SiemSecretBinding", "type": "object", "required": [ "handle", "ref", "field", "team_id" ], "additionalProperties": false, "properties": { "handle": { "type": "string", "pattern": "^[0-9a-f]{32}$" }, "ref": { "type": "string", "pattern": "^vault-ref://h/[0-9a-f]{32}$" }, "field": { "type": "string" }, "team_id": { "type": "string", "format": "uuid" } } }, "SiemSecretBindingRequest": { "title": "SiemSecretBindingRequest", "type": "object", "required": [ "team_id", "field", "value" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "field": { "enum": [ "auth_secret_ref", "mtls_cert_ref", "mtls_key_ref", "mtls_bearer_ref", "jwt_signing_key_ref" ] }, "value": { "type": "string", "minLength": 1, "description": "the credential, at most 32 KiB; never logged or returned" } } }, "SignInResponse": { "title": "SignInResponse", "type": "object", "required": [ "token", "csrf_token", "expires_at", "user", "memberships" ], "properties": { "token": { "type": "string" }, "csrf_token": { "type": "string" }, "expires_at": { "type": "string" }, "user": { "type": "object", "properties": { "id": { "type": "string" }, "email": { "type": "string" }, "role": { "type": "string" }, "kind": { "type": "string" } } }, "kdf_salt": { "type": [ "string", "null" ] }, "seed_kdf_salt": { "type": [ "string", "null" ] }, "wrapped_master": { "type": [ "string", "null" ] }, "memberships": { "type": "array", "items": { "type": "object", "properties": { "team_id": { "type": "string" }, "role": { "type": "string" }, "wrapped_team_dek": { "type": [ "string", "null" ] }, "has_master_escrow": { "type": [ "boolean", "null" ] }, "wrapped_master_team_dek": { "type": [ "string", "null" ] } } } }, "e2e_mode": { "type": [ "string", "null" ], "enum": [ "on", "off", null ] }, "totp_enrolment_required": { "type": "boolean" } } }, "SigningToken": { "title": "SigningToken", "type": "object", "required": [ "signing_token", "expires_at" ], "properties": { "signing_token": { "type": "string", "description": "valid for 10 minutes" }, "expires_at": { "type": "string", "format": "date-time" }, "totp_verified": { "type": "boolean" } } }, "SigningTokenForbidden": { "title": "SigningTokenForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "company_inactive, or csrf_token mismatch" }, "detail": { "type": "string" } } }, "SigningTokenTotp": { "title": "SigningTokenTotp", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "totp_required, totp_not_configured" }, "detail": { "type": "string" }, "totp_required": { "const": true } } }, "SigningTokenUnauthorized": { "title": "SigningTokenUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized, invalid_totp, invalid_credentials" }, "detail": { "type": "string" } } }, "SignupAccepted": { "title": "SignupAccepted", "type": "object", "required": [ "status" ], "properties": { "status": { "const": "accepted" } } }, "SignupBadRequest": { "title": "SignupBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_email, invalid_value, signup_credential_invalid, company_name_required, invalid_plan, a name-length or consent refusal" }, "detail": { "type": "string" } } }, "SignupCompletionInfo": { "title": "SignupCompletionInfo", "type": "object", "required": [ "journey", "email", "locale", "needs_code", "needs_consent" ], "additionalProperties": false, "properties": { "journey": { "type": "string" }, "email": { "type": "string" }, "company_name": { "type": [ "string", "null" ] }, "locale": { "type": "string" }, "needs_code": { "type": "boolean" }, "needs_consent": { "type": "boolean" } } }, "SignupCompletionUnavailable": { "title": "SignupCompletionUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "temporarily_unavailable" }, "detail": { "type": "string" } } }, "SignupCompletionUnknown": { "title": "SignupCompletionUnknown", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_or_expired" }, "detail": { "type": "string" } } }, "SignupEmailExists": { "title": "SignupEmailExists", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "email_exists" }, "detail": { "type": "string" } } }, "SignupFailed": { "title": "SignupFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "internal_error, signing_key_unavailable" }, "detail": { "type": "string" } } }, "SignupLegalTerms": { "title": "SignupLegalTerms", "type": "object", "required": [ "version", "locale", "terms_url", "privacy_url", "dpa_url" ], "additionalProperties": false, "properties": { "version": { "type": "string" }, "locale": { "type": "string" }, "terms_url": { "type": "string" }, "privacy_url": { "type": "string" }, "dpa_url": { "type": "string" } } }, "SignupLegalUnavailable": { "title": "SignupLegalUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "legal_terms_unavailable" }, "detail": { "type": "string" } } }, "SignupRefused": { "title": "SignupRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "approval_required, invalid_or_expired, opaque_ticket_invalid" }, "detail": { "type": "string" } } }, "SkillApproved": { "title": "SkillApproved", "type": "object", "required": [ "status" ], "additionalProperties": false, "properties": { "status": { "const": "approved" } } }, "SkillArchived": { "title": "SkillArchived", "type": "object", "required": [ "status" ], "additionalProperties": false, "properties": { "status": { "const": "archived" } } }, "SkillAssignmentList": { "title": "SkillAssignmentList", "type": "object", "required": [ "assignments" ], "additionalProperties": false, "properties": { "assignments": { "type": "array", "items": { "type": "object", "description": "skill_assignments row plus the skill name and version", "required": [ "skill_id", "scope", "action" ], "properties": { "skill_id": { "type": "string", "format": "uuid" }, "scope": { "enum": [ "global", "company", "team", "user" ] }, "scope_id": { "type": [ "string", "null" ], "format": "uuid" }, "action": { "enum": [ "default", "allow", "deny" ] }, "skill_name": { "type": "string" }, "skill_version": { "type": "string" } } } } } }, "SkillAssignmentSet": { "title": "SkillAssignmentSet", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } } }, "SkillContentEnvelope": { "title": "SkillContentEnvelope", "type": "object", "required": [ "encrypted", "team_id", "ciphertext", "nonce", "aad_version", "aad", "content_sha256" ], "properties": { "encrypted": { "const": true }, "team_id": { "type": "string", "format": "uuid" }, "ciphertext": { "type": "string", "description": "hex" }, "nonce": { "type": "string", "description": "hex, 24 bytes" }, "aad_version": { "type": "integer" }, "aad": { "type": "string", "description": "XChaCha20-Poly1305 associated data" }, "content_sha256": { "type": "string" }, "skill_id": { "type": "string", "format": "uuid", "description": "aad_version 2 (sealed under the team key)" }, "e2e": { "const": true } } }, "SkillContentPrecondition": { "title": "SkillContentPrecondition", "type": "object", "required": [ "error" ], "properties": { "error": { "enum": [ "skill_copy_missing", "team_server_escrow_required" ] }, "hint": { "type": "string" } } }, "SkillDetail": { "title": "SkillDetail", "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "version": { "type": "string" }, "scope": { "enum": [ "global", "company", "team" ] }, "scope_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" }, "content_sha256": { "type": "string" }, "signed_by_name_snapshot": { "type": [ "string", "null" ] }, "description": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "signature_kind": { "type": [ "string", "null" ] }, "signature": { "type": [ "string", "null" ] }, "signed_by": { "type": [ "string", "null" ], "format": "uuid" }, "approved_by": { "type": [ "string", "null" ], "format": "uuid" }, "approved_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "SkillDiff": { "title": "SkillDiff", "type": "object", "required": [ "from", "to" ], "description": "identical: true carries only from and to; otherwise manifest_diff, permission_diff, file_diffs and stats follow (truncated when the envelope hit its size cap)", "properties": { "identical": { "const": true }, "from": { "title": "SkillMeta", "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "version": { "type": "string" }, "scope": { "enum": [ "global", "company", "team" ] }, "scope_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" }, "content_sha256": { "type": "string" }, "signed_by_name_snapshot": { "type": [ "string", "null" ] }, "description": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "signature_kind": { "type": [ "string", "null" ] }, "signed_by": { "type": [ "string", "null" ], "format": "uuid" }, "approved_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "to": { "title": "SkillMeta", "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "version": { "type": "string" }, "scope": { "enum": [ "global", "company", "team" ] }, "scope_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" }, "content_sha256": { "type": "string" }, "signed_by_name_snapshot": { "type": [ "string", "null" ] }, "description": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "signature_kind": { "type": [ "string", "null" ] }, "signed_by": { "type": [ "string", "null" ], "format": "uuid" }, "approved_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "manifest_diff": { "type": "object", "description": "added, modified and deleted paths with sizes and hashes" }, "permission_diff": { "type": "object" }, "file_diffs": { "type": "object", "additionalProperties": { "type": "string", "description": "unified diff" } }, "stats": { "type": "object", "additionalProperties": false, "properties": { "files_changed": { "type": "integer" }, "lines_added": { "type": "integer" }, "lines_removed": { "type": "integer" }, "size_delta": { "type": "integer" } } }, "truncated": { "const": true } } }, "SkillDiffUnavailable": { "title": "SkillDiffUnavailable", "type": "object", "required": [ "error", "hint" ], "properties": { "error": { "const": "diff_unavailable_for_encrypted_scope" }, "hint": { "type": "string" } } }, "SkillList": { "title": "SkillList", "type": "object", "required": [ "skills" ], "additionalProperties": false, "properties": { "skills": { "type": "array", "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "version": { "type": "string" }, "scope": { "enum": [ "global", "company", "team" ] }, "scope_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" }, "content_sha256": { "type": "string" }, "signed_by_name_snapshot": { "type": [ "string", "null" ] }, "description": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "signature_kind": { "type": [ "string", "null" ] } } } } } }, "SkillNotApproved": { "title": "SkillNotApproved", "type": "object", "required": [ "error", "current_status" ], "properties": { "error": { "const": "skill_not_approved" }, "current_status": { "type": "string" } } }, "SkillNotPending": { "title": "SkillNotPending", "type": "object", "required": [ "error", "current_status" ], "properties": { "error": { "const": "skill_not_pending" }, "current_status": { "type": "string" } } }, "SkillRejectRequest": { "title": "SkillRejectRequest", "type": "object", "required": [ "signing_token" ], "properties": { "signing_token": { "type": "string" }, "reason": { "type": [ "string", "null" ] }, "decline_comments_blob_id": { "type": "string", "format": "uuid", "description": "an encrypted blob of kind decline comments in the same tenant" } } }, "SkillRejected": { "title": "SkillRejected", "type": "object", "required": [ "status" ], "additionalProperties": false, "properties": { "status": { "const": "rejected" } } }, "SkillSigningRequest": { "title": "SkillSigningRequest", "type": "object", "required": [ "signing_token" ], "properties": { "signing_token": { "type": "string", "description": "from POST /auth/signing-token" } } }, "SkillUploaded": { "title": "SkillUploaded", "type": "object", "required": [ "id", "status", "content_sha256", "signature_kind" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "status": { "const": "pending" }, "content_sha256": { "type": "string" }, "signature_kind": { "enum": [ "ed25519", "session" ] }, "content_team_ids": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "teams whose key sealed the copies; only for sealed uploads" } } }, "SkipE2eeRequest": { "title": "SkipE2eeRequest", "type": "object", "required": [ "skipped" ], "properties": { "skipped": { "const": true } } }, "SoloEnrolCode": { "title": "SoloEnrolCode", "type": "object", "required": [ "code", "expires_at" ], "additionalProperties": false, "properties": { "code": { "type": "string" }, "expires_at": { "type": "string", "format": "date-time" } } }, "SoloHostLinked": { "title": "SoloHostLinked", "type": "object", "required": [ "ok", "secret_dek_linked" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "secret_dek_linked": { "type": "boolean" } } }, "SoloHostList": { "title": "SoloHostList", "type": "object", "required": [ "hosts" ], "additionalProperties": false, "properties": { "hosts": { "type": "array", "items": { "type": "object", "required": [ "id", "status" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": [ "string", "null" ] }, "status": { "type": "string" }, "pubkey": { "type": [ "string", "null" ] }, "fingerprint": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" } } } } } }, "SoloHostNotFound": { "title": "SoloHostNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "host_not_found" }, "detail": { "type": "string" } } }, "SoloKeys": { "title": "SoloKeys", "type": "object", "required": [ "wrapped_personal_dek", "wrapped_secret_dek", "kdf_salt" ], "additionalProperties": false, "properties": { "wrapped_personal_dek": { "type": [ "string", "null" ] }, "wrapped_secret_dek": { "type": [ "string", "null" ] }, "kdf_salt": { "type": [ "string", "null" ], "description": "hex" } } }, "SoloLinkNoteDekRequest": { "title": "SoloLinkNoteDekRequest", "type": "object", "required": [ "wrapped_note_dek" ], "properties": { "wrapped_note_dek": { "type": "string", "pattern": "^[0-9a-fA-F]*$", "description": "92 bytes as hex" } } }, "SoloPlanLookupFailed": { "title": "SoloPlanLookupFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "plan_lookup_failed" }, "detail": { "type": "string" } } }, "SoloRegistered": { "title": "SoloRegistered", "type": "object", "required": [ "user_id", "status" ], "additionalProperties": false, "properties": { "user_id": { "type": "string", "format": "uuid" }, "status": { "const": "active" } } }, "SoloUserRequired": { "title": "SoloUserRequired", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "solo_user_required, or csrf_token mismatch" }, "detail": { "type": "string" } } }, "SpawnConfig": { "title": "SpawnConfig", "type": "object", "required": [ "mcp_url", "tier", "session_cap", "sandbox_mode", "team_id", "company_id", "skills", "mcp_servers", "agent_auth_policy" ], "properties": { "mcp_url": { "type": [ "string", "null" ] }, "tier": { "type": [ "string", "null" ] }, "session_cap": { "type": [ "integer", "null" ] }, "sandbox_mode": { "enum": [ "off", "netns" ] }, "team_id": { "type": "string", "format": "uuid" }, "company_id": { "type": [ "string", "null" ], "format": "uuid" }, "claude_md": { "type": [ "string", "null" ] }, "version_hash": { "type": [ "string", "null" ] }, "components": { "type": [ "object", "null" ] }, "e2e_instructions": { "type": "object", "description": "only when a layer is sealed" }, "skills": { "type": "array", "items": { "type": "object" } }, "skills_overflow": { "type": [ "boolean", "integer" ] }, "mcp_servers": { "type": "array", "items": { "type": "object", "description": "a team MCP server row; endpoint and auth_ref are sealed envelopes in end-to-end mode", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "transport": { "type": "string" }, "endpoint": { "type": "string" }, "auth_ref": { "type": [ "string", "null" ] }, "offered": { "type": "boolean" }, "mandatory": { "type": "boolean" }, "enabled": { "type": "boolean" } } } }, "agent_auth_policy": { "type": "object", "description": "the team's provider-credential policy per agent; {} when none" } } }, "SpawnConfigBadRequest": { "title": "SpawnConfigBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "team_id_required" }, "detail": { "type": "string" } } }, "SpawnConfigFailed": { "title": "SpawnConfigFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "internal" }, "detail": { "type": "string" } } }, "SpawnConfigForbidden": { "title": "SpawnConfigForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "team_membership_required, or the gate refusal" }, "detail": { "type": "string" } } }, "SpawnConfigNotFound": { "title": "SpawnConfigNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "team_not_found" }, "detail": { "type": "string" } } }, "SpawnEventsInvalid": { "title": "SpawnEventsInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_events, invalid_value" }, "detail": { "type": "string" } } }, "SpawnEventsRateLimited": { "title": "SpawnEventsRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "rate_limited" }, "detail": { "type": "string" }, "retry_after_seconds": { "type": "integer" } } }, "SpawnEventsUnauthorized": { "title": "SpawnEventsUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized" }, "detail": { "type": "string" } } }, "SpawnEventsUnscoped": { "title": "SpawnEventsUnscoped", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "spawn_token_unscoped" }, "detail": { "type": "string" } } }, "SpawnMcpAuth": { "title": "SpawnMcpAuth", "type": "object", "required": [ "header_value" ], "additionalProperties": false, "properties": { "header_value": { "type": "string", "description": "the header value; the revealed secret, answered with Cache-Control no-store and audited before it is read" } } }, "SpawnMemory": { "title": "SpawnMemory", "type": "object", "required": [ "user_id", "blobs", "truncated" ], "additionalProperties": false, "properties": { "user_id": { "type": "string", "format": "uuid" }, "blobs": { "type": "array", "items": { "type": "object", "description": "an encrypted blob row, ciphertext only" } }, "truncated": { "type": "boolean" } } }, "SpawnMemorySecurityEventsAccepted": { "title": "SpawnMemorySecurityEventsAccepted", "type": "object", "required": [ "accepted", "recorded" ], "additionalProperties": false, "properties": { "accepted": { "type": "integer" }, "recorded": { "type": "integer" } } }, "SpawnMemorySecurityEventsRequest": { "title": "SpawnMemorySecurityEventsRequest", "type": "object", "required": [ "events" ], "properties": { "events": { "type": "array", "minItems": 1, "items": { "type": "object", "required": [ "ref_id", "detector", "verdict" ], "properties": { "ref_id": { "type": "string" }, "detector": { "type": "string" }, "verdict": { "type": "string" }, "reason": { "type": [ "string", "null" ] } } } } } }, "SpawnMemoryUnavailable": { "title": "SpawnMemoryUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "auth_unavailable and the gate refusals" }, "detail": { "type": "string" } } }, "SpawnNotFound": { "title": "SpawnNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "not_found" }, "detail": { "type": "string" } } }, "SpawnPrefs": { "title": "SpawnPrefs", "type": "object", "required": [ "skill_ids", "mcp_server_ids" ], "additionalProperties": false, "properties": { "skill_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "mcp_server_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "SpawnPrefsCsrf": { "title": "SpawnPrefsCsrf", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "SpawnPrefsFailed": { "title": "SpawnPrefsFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "internal" }, "detail": { "type": "string" } } }, "SpawnPrefsFailed2": { "title": "SpawnPrefsFailed2", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "internal" }, "detail": { "type": "string" } } }, "SpawnPrefsSaved": { "title": "SpawnPrefsSaved", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } } }, "SpawnPrefsUser": { "title": "SpawnPrefsUser", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "user_not_found" }, "detail": { "type": "string" } } }, "SpawnPrefsUser2": { "title": "SpawnPrefsUser2", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "user_not_found" }, "detail": { "type": "string" } } }, "SpawnRefusal": { "title": "SpawnRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "a tenant-gate or agent-wire refusal: error (quota_exceeded, ...), status, kind, reason, retry_after" }, "detail": { "type": "string" }, "status": { "type": "integer" }, "kind": { "type": "string" }, "reason": { "type": "string" } } }, "SpawnSecretRefusal": { "title": "SpawnSecretRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "not_found, authorization_check_unavailable, audit_log_unavailable, e2e_sealed, rate_limited and the gate refusals" }, "detail": { "type": "string" } } }, "SpawnSessionNotLaunchable": { "title": "SpawnSessionNotLaunchable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "session_not_launchable" }, "detail": { "type": "string" }, "session_id": { "type": "string" }, "status": { "type": "string" } } }, "SpawnTeamKey": { "title": "SpawnTeamKey", "type": "object", "required": [ "key_value" ], "additionalProperties": false, "properties": { "key_value": { "type": "string", "description": "the provider key; the revealed secret, answered with Cache-Control no-store and audited before it is read" } } }, "SsoCallbackBadRequest": { "title": "SsoCallbackBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "sso_error, missing_code_or_state, invalid_state, idp_unavailable, token_exchange_failed, iss_mismatch, aud_mismatch, userinfo_failed, no_email_in_userinfo" }, "detail": { "type": "string" } } }, "SsoCallbackFailed": { "title": "SsoCallbackFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "signing_key_unavailable" }, "detail": { "type": "string" } } }, "SsoCallbackForbidden": { "title": "SsoCallbackForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "email_domain_not_allowed, wrong_subdomain, user_not_provisioned, user_inactive, link_confirmation_required, email_not_verified, already_linked" }, "detail": { "type": "string" } } }, "SsoCallbackRedirect": { "title": "SsoCallbackRedirect", "type": "object", "required": [ "ok", "location" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "location": { "type": "string", "description": "return_to, or /fleet/sso/finalize?return_to=... when the organisation requires end-to-end enrolment" } } }, "SsoCallbackTotp": { "title": "SsoCallbackTotp", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "totp_required" }, "detail": { "type": "string" }, "require": { "const": "totp" }, "sso_link_token": { "type": "string" } } }, "SsoCallbackUnavailable": { "title": "SsoCallbackUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "seat_check_unavailable and other transient refusals" }, "detail": { "type": "string" } } }, "SsoConfigRefusal": { "title": "SsoConfigRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value, unexpected_field, inactive_idp_no_jit, reference_not_found, client_secret_handle_required, secret_handle_unknown, secret_handle_bound, domain_conflict, not_found, jit_lookup_failed, jit_seed_failed" }, "detail": { "type": "string" }, "message": { "type": "string" } } }, "SsoDiscovery": { "title": "SsoDiscovery", "type": "object", "description": "provider_name, login_url and button_label of the domain's active provider", "properties": { "provider_name": { "type": "string" }, "login_url": { "type": "string" }, "button_label": { "type": "string" } } }, "SsoDiscoveryFailed": { "title": "SsoDiscoveryFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "discover_failed" }, "detail": { "type": "string" } } }, "SsoDiscoveryInvalid": { "title": "SsoDiscoveryInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_email, bad_request" }, "detail": { "type": "string" } } }, "SsoDiscoveryNone": { "title": "SsoDiscoveryNone", "type": "object", "additionalProperties": false, "description": "an empty object" }, "SsoDiscoveryRateLimited": { "title": "SsoDiscoveryRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "rate_limited" }, "detail": { "type": "string" } } }, "SsoGateRefusal": { "title": "SsoGateRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "enterprise_only (422), license_feature_not_included (402)" }, "feature": { "type": "string" } } }, "SsoIdpDiscoveryFailed": { "title": "SsoIdpDiscoveryFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "idp_discovery_failed" }, "detail": { "type": "string" } } }, "SsoLinkConfirmBadRequest": { "title": "SsoLinkConfirmBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value" }, "detail": { "type": "string" } } }, "SsoLinkConfirmConflict": { "title": "SsoLinkConfirmConflict", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "idp_unavailable, already_linked" }, "detail": { "type": "string" } } }, "SsoLinkConfirmForbidden": { "title": "SsoLinkConfirmForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "user_inactive, reauth_required, password_required, or csrf_token mismatch" }, "detail": { "type": "string" } } }, "SsoLinkConfirmRequest": { "title": "SsoLinkConfirmRequest", "type": "object", "required": [ "id", "reauth_token" ], "properties": { "id": { "type": "string", "format": "uuid" }, "reauth_token": { "type": "string", "description": "from POST /auth/opaque/reauth/finish" } } }, "SsoLinkConfirmUnauthorized": { "title": "SsoLinkConfirmUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "auth_required, invalid_credentials" }, "detail": { "type": "string" } } }, "SsoLinkConfirmed": { "title": "SsoLinkConfirmed", "type": "object", "required": [ "ok", "idp_config_id" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "idp_config_id": { "type": "string", "format": "uuid" } } }, "SsoLinkNotFound": { "title": "SsoLinkNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "pending_link_not_found" }, "detail": { "type": "string" } } }, "SsoLinkTotpBadRequest": { "title": "SsoLinkTotpBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_or_expired_link_token, idp_unavailable" }, "detail": { "type": "string" } } }, "SsoLinkTotpConflict": { "title": "SsoLinkTotpConflict", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "sso_link_restart, already_linked" }, "detail": { "type": "string" } } }, "SsoLinkTotpDone": { "title": "SsoLinkTotpDone", "type": "object", "required": [ "ok", "location" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "location": { "type": "string", "description": "return_to; the session cookie is set" } } }, "SsoLinkTotpForbidden": { "title": "SsoLinkTotpForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "user_inactive, link_confirmation_required, wrong_subdomain" }, "detail": { "type": "string" } } }, "SsoLinkTotpInvalid": { "title": "SsoLinkTotpInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_totp" }, "detail": { "type": "string" } } }, "SsoLinkTotpRequest": { "title": "SsoLinkTotpRequest", "type": "object", "required": [ "token" ], "properties": { "token": { "type": "string" }, "totp_code": { "type": "string" }, "recovery_code": { "type": "string" } } }, "SsoNoConfig": { "title": "SsoNoConfig", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "no_active_sso_config" }, "detail": { "type": "string" } } }, "SsoPendingLinks": { "title": "SsoPendingLinks", "type": "object", "required": [ "pending" ], "additionalProperties": false, "properties": { "pending": { "type": "array", "items": { "type": "object", "required": [ "id", "idp_config_id", "created_at", "expires_at" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "idp_config_id": { "type": "string", "format": "uuid" }, "display_name": { "type": "string" }, "issuer_url": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time" } } } } } }, "SsoRateLimited": { "title": "SsoRateLimited", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "retry_after_ms": { "type": "integer" }, "retry_after_seconds": { "type": "integer" }, "detail": { "type": "string" } }, "description": "Retry-After is set" }, "SsoSecretBinding": { "title": "SsoSecretBinding", "type": "object", "required": [ "handle", "ref", "field", "team_id" ], "additionalProperties": false, "properties": { "handle": { "type": "string", "pattern": "^[0-9a-f]{32}$" }, "ref": { "type": "string", "pattern": "^vault-ref://h/[0-9a-f]{32}$", "description": "a handle minted by POST /admin/sso/secret-bindings" }, "field": { "const": "client_secret_ref" }, "team_id": { "type": "string", "format": "uuid" } } }, "SsoSecretBindingRequest": { "title": "SsoSecretBindingRequest", "type": "object", "required": [ "team_id", "value" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "field": { "const": "client_secret_ref", "description": "optional; the only accepted value" }, "value": { "type": "string", "minLength": 1, "description": "the client secret, at most 32 KiB; never logged or returned" } } }, "SsoStartFailed": { "title": "SsoStartFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "resolve_failed, start_failed, authorize_url_build_failed" }, "detail": { "type": "string" } } }, "SsoStartRedirect": { "title": "SsoStartRedirect", "type": "object", "required": [ "ok", "location" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "location": { "type": "string", "description": "the provider's authorization URL; the state cookie is set with it" } } }, "StripeWebhookAck": { "title": "StripeWebhookAck", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "duplicate": { "const": true }, "error_recorded": { "const": true } } }, "StripeWebhookBadRequest": { "title": "StripeWebhookBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "StripeWebhookEvent": { "title": "StripeWebhookEvent", "type": "object", "required": [ "id", "type" ], "properties": { "id": { "type": "string" }, "type": { "type": "string" }, "data": { "type": "object" } }, "description": "a Stripe event object; other fields are passed to the event handlers" }, "StripeWebhookMalformed": { "title": "StripeWebhookMalformed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "StripeWebhookTooLarge": { "title": "StripeWebhookTooLarge", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "SvcSecretsDeleteRequest": { "title": "SvcSecretsDeleteRequest", "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string", "minLength": 1 } } }, "SvcSecretsDeleteResponse": { "title": "SvcSecretsDeleteResponse", "type": "object", "required": [ "deleted" ], "properties": { "deleted": { "type": "string" } } }, "SvcSecretsGetRequest": { "title": "SvcSecretsGetRequest", "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string", "minLength": 1 }, "reveal": { "type": [ "boolean", "string" ], "description": "parsed by lib/secrets/reveal-flag.js; an unrecognised value is 400" } } }, "SvcSecretsGetResponse": { "title": "SvcSecretsGetResponse", "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string" }, "masked": { "const": true }, "value": { "type": "string", "description": "present only when reveal was true" } } }, "SvcSecretsListRequest": { "title": "SvcSecretsListRequest", "type": "object" }, "SvcSecretsListResponse": { "title": "SvcSecretsListResponse", "type": "object", "required": [ "secrets" ], "properties": { "secrets": { "type": "array", "items": { "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string" } } } } } }, "SvcSecretsSealedRequest": { "title": "SvcSecretsSealedRequest", "type": "object", "properties": { "name": { "type": [ "string", "null" ] } } }, "SvcSecretsSealedResponse": { "title": "SvcSecretsSealedResponse", "type": "object", "required": [ "items" ], "additionalProperties": false, "properties": { "items": { "type": "array", "items": { "type": "object", "required": [ "scope_kind", "scope_id", "name", "key_version", "nonce", "ciphertext" ], "additionalProperties": false, "properties": { "scope_kind": { "enum": [ "team", "company" ] }, "scope_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "key_version": { "type": "integer" }, "nonce": { "type": "string", "pattern": "^[0-9a-fA-F]+$" }, "ciphertext": { "type": "string", "pattern": "^[0-9a-fA-F]+$" } } } } } }, "SvcSecretsSetRequest": { "title": "SvcSecretsSetRequest", "type": "object", "required": [ "name", "value" ], "properties": { "name": { "type": "string", "minLength": 1 }, "value": { "type": "string" } } }, "SvcSecretsSetResponse": { "title": "SvcSecretsSetResponse", "type": "object", "required": [ "ok", "id" ], "properties": { "ok": { "const": true }, "id": { "type": "string" } } }, "TeamCreated": { "title": "TeamCreated", "type": "object", "required": [ "team_id", "name" ], "additionalProperties": false, "properties": { "team_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" } } }, "TeamList": { "title": "TeamList", "type": "object", "required": [ "teams" ], "additionalProperties": false, "properties": { "teams": { "type": "array", "items": { "type": "object", "required": [ "id", "name" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "member_count": { "type": "integer", "description": "company owner or admin" }, "my_role": { "type": "string", "description": "member" }, "wrapped_team_dek": { "type": "string", "description": "member: the caller's own wrapped team key" } } } } } }, "TeamMcpServer": { "title": "TeamMcpServer", "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "team_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "transport": { "enum": [ "stdio", "http", "ws" ] }, "endpoint": { "type": "string", "description": "plaintext, or a sealed envelope string when the company is in end-to-end mode" }, "auth_ref": { "type": [ "string", "null" ] }, "offered": { "type": "boolean" }, "mandatory": { "type": "boolean" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "created_by": { "type": [ "string", "null" ], "format": "uuid", "description": "present on the create answer (RETURNING *)" } } }, "TeamMcpServerList": { "title": "TeamMcpServerList", "type": "object", "required": [ "mcp_servers" ], "additionalProperties": false, "properties": { "mcp_servers": { "type": "array", "items": { "title": "TeamMcpServer", "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "team_id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "transport": { "enum": [ "stdio", "http", "ws" ] }, "endpoint": { "type": "string", "description": "plaintext, or a sealed envelope string when the company is in end-to-end mode" }, "auth_ref": { "type": [ "string", "null" ] }, "offered": { "type": "boolean" }, "mandatory": { "type": "boolean" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "created_by": { "type": [ "string", "null" ], "format": "uuid", "description": "present on the create answer (RETURNING *)" } } } } } }, "TeamMembers": { "title": "TeamMembers", "type": "object", "required": [ "members" ], "additionalProperties": false, "properties": { "members": { "type": "array", "items": { "type": "object", "required": [ "user_id", "role" ], "properties": { "user_id": { "type": "string", "format": "uuid" }, "role": { "type": "string" }, "joined_at": { "type": "string", "format": "date-time" }, "email": { "type": "string" }, "display_name": { "type": [ "string", "null" ] }, "status": { "type": "string" } } } } } }, "TeamMembershipSelf": { "title": "TeamMembershipSelf", "type": "object", "required": [ "team_id", "wrapped_team_dek", "role" ], "additionalProperties": false, "properties": { "team_id": { "type": "string", "format": "uuid" }, "wrapped_team_dek": { "type": "string", "description": "hex" }, "role": { "type": "string" } } }, "TeamNote": { "title": "TeamNote", "type": "object", "required": [ "id", "team_id", "title", "tags", "source_path", "created_at", "updated_at", "body" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "team_id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "source_path": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "body": { "type": "string" } } }, "TeamNoteCreated": { "title": "TeamNoteCreated", "type": "object", "required": [ "id", "team_id", "title", "tags", "source_path", "created_at", "updated_at", "search_indexed" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "team_id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "source_path": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "search_indexed": { "type": "boolean", "description": "false when the search service did not take the note" } } }, "TeamNoteList": { "title": "TeamNoteList", "type": "object", "required": [ "notes" ], "additionalProperties": false, "properties": { "notes": { "type": "array", "items": { "type": "object", "required": [ "id", "team_id", "title", "tags", "source_path", "created_at", "updated_at" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "team_id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "source_path": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } } } } } }, "TeamNoteUpdated": { "title": "TeamNoteUpdated", "type": "object", "required": [ "id", "team_id", "title", "tags", "source_path", "created_at", "updated_at" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "team_id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "source_path": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "search_indexed": { "type": "boolean", "description": "present when the body changed" } } }, "TeamPendingApprovals": { "title": "TeamPendingApprovals", "type": "object", "required": [ "pending" ], "additionalProperties": false, "properties": { "pending": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "email": { "type": "string" }, "pubkey": { "type": [ "string", "null" ], "description": "hex" }, "role_in_team": { "type": "string" }, "invite_id": { "type": "string", "format": "uuid" } } } } } }, "TeamPendingMemberships": { "title": "TeamPendingMemberships", "type": "object", "required": [ "pending" ], "additionalProperties": false, "properties": { "pending": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "user_id": { "type": "string", "format": "uuid" }, "email": { "type": "string" }, "requested_by_scim_token_id": { "type": [ "string", "null" ] }, "requested_by_user_id": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "expires_at": { "type": "string", "format": "date-time" }, "notes": { "type": [ "string", "null" ] } } } } } }, "TenantPurgeBlocked": { "title": "TenantPurgeBlocked", "type": "object", "required": [ "error", "retry_after_s" ], "properties": { "error": { "type": "string" }, "retry_after_s": { "type": "integer" } }, "description": "Retry-After is set; 409 when the purge refused, 503 when a service was unreachable" }, "TenantState": { "title": "TenantState", "type": "object", "additionalProperties": false, "required": [ "state", "trial", "expires_at", "grace_until", "suspended" ], "properties": { "state": { "enum": [ "ok", "grace", "read_only", "inert" ], "description": "resolveEntitlements state" }, "trial": { "type": "boolean" }, "expires_at": { "description": "licence expiry, verbatim" }, "grace_until": { "description": "end of the grace window, verbatim" }, "suspended": { "type": "boolean", "description": "the tenant gate refuses writes (company status is not active)" } } }, "TotpResetResult": { "title": "TotpResetResult", "type": "object", "required": [ "ok", "sessions_revoked", "reauth_required", "message" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "sessions_revoked": { "type": "integer" }, "reauth_required": { "const": true }, "message": { "type": "string" } } }, "TranscriptBin": { "title": "TranscriptBin", "type": "string", "format": "binary", "description": "x-truncated: 1 and x-transcript-next-seq are set when the 10 MiB download cap cut the transcript" }, "TranscriptLegacy": { "title": "TranscriptLegacy", "type": "object", "required": [ "enc_v", "aad_version", "scope_kind", "scope_id", "key", "session_id", "frames" ], "additionalProperties": false, "properties": { "enc_v": { "const": 1 }, "aad_version": { "const": 1 }, "scope_kind": { "const": "team" }, "scope_id": { "type": "string", "format": "uuid" }, "key": { "const": "team_dek" }, "session_id": { "type": "string", "format": "uuid" }, "frames": { "type": "array", "items": { "type": "object", "required": [ "seq", "kind", "enc_v" ], "properties": { "seq": { "type": "integer" }, "kind": { "enum": [ "pty_out", "agent_event", "pty_in" ] }, "enc_v": { "enum": [ 0, 1 ] }, "nonce": { "type": "string" }, "ct": { "type": "string" }, "data": { "type": "string", "description": "base64, for an unencrypted frame (enc_v 0)" } } } }, "next_seq": { "type": "integer" } } }, "TranscriptRangeBody": { "title": "TranscriptRangeBody", "type": "string", "format": "binary", "description": "answered by caldyr-replay with its content-type, content-length and x-* headers" }, "TranscriptRangeRefusal": { "title": "TranscriptRangeRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "TranscriptRateLimited": { "title": "TranscriptRateLimited", "type": "object", "required": [ "error", "retry_after_seconds" ], "additionalProperties": false, "properties": { "error": { "const": "rate_limited" }, "retry_after_seconds": { "type": "integer" } } }, "TranscriptSealed": { "title": "TranscriptSealed", "type": "object", "required": [ "enc_v", "aad_version", "scope_id", "session_id", "frames" ], "additionalProperties": false, "properties": { "enc_v": { "const": 2 }, "aad_version": { "const": 2 }, "scope_kind": { "const": "team", "description": "present for a team-sealed session" }, "scope_id": { "type": "string", "format": "uuid" }, "key_version": { "type": "integer" }, "session_id": { "type": "string", "format": "uuid" }, "frames": { "type": "array", "items": { "type": "object", "required": [ "seq", "kind", "nonce", "ct" ], "additionalProperties": false, "properties": { "seq": { "type": "integer" }, "kind": { "enum": [ "pty_out", "agent_event" ] }, "nonce": { "type": "string" }, "ct": { "type": "string" } } } }, "next_seq": { "type": "integer", "description": "present when the page was cut" } } }, "TranscriptSealedRefusal": { "title": "TranscriptSealedRefusal", "type": "object", "required": [ "error", "hint" ], "additionalProperties": false, "properties": { "error": { "const": "e2e_sealed" }, "hint": { "const": "transcript.sealed" } }, "description": "the session is end-to-end sealed; the plaintext reads refuse and name the sealed route" }, "TranscriptSearch": { "title": "TranscriptSearch", "type": "object", "required": [ "matches", "max" ], "additionalProperties": false, "properties": { "matches": { "type": "array", "items": { "type": "object", "required": [ "seq", "ts", "char_offset", "snippet" ], "additionalProperties": false, "properties": { "seq": { "type": "integer" }, "ts": { "type": "string", "format": "date-time" }, "char_offset": { "type": "integer" }, "snippet": { "type": "string" } } } }, "max": { "type": "integer" } } }, "TranscriptText": { "title": "TranscriptText", "type": "string", "description": "x-truncated: 1 and x-transcript-next-seq are set when the 10 MiB download cap cut the transcript" }, "TranscriptUnavailable": { "title": "TranscriptUnavailable", "type": "object", "required": [ "error", "reason", "undecryptable", "retry_after_s" ], "additionalProperties": false, "properties": { "error": { "const": "transcript_unavailable" }, "reason": { "const": "custody_unavailable" }, "undecryptable": { "type": "integer" }, "retry_after_s": { "type": "integer" } }, "description": "the key custody service is unreachable; Retry-After is set" }, "UnauthorizedBody": { "title": "UnauthorizedBody", "type": "object", "required": [ "error" ], "properties": { "error": { "const": "unauthorized" } } }, "User": { "title": "User", "type": "object", "required": [ "id", "email", "role", "status" ], "properties": { "id": { "type": "string", "format": "uuid" }, "email": { "type": "string" }, "display_name": { "type": [ "string", "null" ] }, "kind": { "type": [ "string", "null" ] }, "role": { "type": "string" }, "status": { "type": "string" }, "totp_enrolled": { "type": [ "boolean", "null" ] }, "created_at": { "type": [ "string", "null" ] }, "last_login_at": { "type": [ "string", "null" ] }, "is_system": { "type": "boolean" }, "has_master_wrap": { "type": "boolean" }, "sso_linked": { "type": "boolean" } } }, "UserDetail": { "title": "UserDetail", "type": "object", "required": [ "id", "email", "role", "status" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "email": { "type": "string" }, "display_name": { "type": [ "string", "null" ] }, "kind": { "type": [ "string", "null" ] }, "role": { "type": "string" }, "status": { "type": "string" }, "totp_enrolled": { "type": [ "boolean", "null" ] }, "created_at": { "type": [ "string", "null" ] }, "last_login_at": { "type": [ "string", "null" ] } } }, "UserList": { "title": "UserList", "type": "object", "required": [ "users" ], "additionalProperties": false, "properties": { "users": { "type": "array", "maxItems": 500, "items": { "type": "object", "required": [ "id", "email", "role", "status" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "email": { "type": "string" }, "display_name": { "type": [ "string", "null" ] }, "kind": { "type": [ "string", "null" ] }, "role": { "type": "string" }, "status": { "type": "string" }, "totp_enrolled": { "type": [ "boolean", "null" ] }, "created_at": { "type": [ "string", "null" ] }, "last_login_at": { "type": [ "string", "null" ] }, "is_system": { "type": "boolean" }, "has_master_wrap": { "type": "boolean" } } } } } }, "UserPubkey": { "title": "UserPubkey", "type": "object", "required": [ "user_id", "pubkey", "kind", "status" ], "additionalProperties": false, "properties": { "user_id": { "type": "string", "format": "uuid" }, "pubkey": { "type": [ "string", "null" ], "description": "hex; null when the user has none" }, "kind": { "type": "string" }, "status": { "type": "string" } } }, "UserPurgeBlocked": { "title": "UserPurgeBlocked", "type": "object", "required": [ "error", "retry_after_s" ], "properties": { "error": { "type": "string" }, "retry_after_s": { "type": "integer" } }, "description": "Retry-After is set" }, "VaultClassifyInvalid": { "title": "VaultClassifyInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required" }, "detail": { "type": "string" } } }, "VaultClassifyRequest": { "title": "VaultClassifyRequest", "type": "object", "required": [ "name", "to_ns" ], "properties": { "name": { "type": "string" }, "to_ns": { "type": "string" }, "to_user_id": { "type": [ "string", "null" ] } } }, "VaultDiff": { "title": "VaultDiff", "type": "object", "required": [ "path", "diff" ], "additionalProperties": false, "properties": { "path": { "type": "string" }, "diff": { "type": "string" } } }, "VaultForbidden": { "title": "VaultForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "forbidden, or csrf_token mismatch" }, "detail": { "type": "string" } } }, "VaultGraph": { "title": "VaultGraph", "type": "object", "additionalProperties": false, "required": [ "root", "depth", "truncated", "node_count", "edge_count", "nodes", "edges" ], "properties": { "root": { "type": [ "string", "null" ] }, "depth": { "type": [ "integer", "null" ] }, "truncated": { "type": "boolean" }, "node_count": { "type": "integer" }, "edge_count": { "type": "integer" }, "nodes": { "type": "array", "items": { "type": "object", "required": [ "id", "label", "group" ], "additionalProperties": false, "properties": { "id": { "type": "string" }, "label": { "type": "string" }, "group": { "type": "string" } } } }, "edges": { "type": "array", "items": { "type": "object", "required": [ "source", "target" ], "additionalProperties": false, "properties": { "source": { "type": "string" }, "target": { "type": "string" } } } } } }, "VaultHistory": { "title": "VaultHistory", "type": "object", "required": [ "path", "commits" ], "additionalProperties": false, "properties": { "path": { "type": "string" }, "commits": { "type": "array", "items": { "type": "object", "required": [ "sha", "ts", "author", "subject" ], "additionalProperties": false, "properties": { "sha": { "type": "string" }, "ts": { "type": "string", "format": "date-time" }, "author": { "type": "string" }, "subject": { "type": "string" } } } } } }, "VaultIndex": { "title": "VaultIndex", "type": "object", "required": [ "byBase", "byBaseLower", "all", "truncated" ], "additionalProperties": false, "properties": { "byBase": { "type": "object", "additionalProperties": { "type": "string" }, "description": "file name without .md -> first path" }, "byBaseLower": { "type": "object", "additionalProperties": { "type": "string" } }, "all": { "type": "array", "items": { "type": "string" } }, "truncated": { "type": "boolean" } } }, "VaultList": { "title": "VaultList", "type": "object", "required": [ "entries" ], "additionalProperties": false, "properties": { "entries": { "type": "array", "maxItems": 5000, "items": { "type": "object", "required": [ "path", "kind" ], "additionalProperties": false, "properties": { "path": { "type": "string" }, "kind": { "enum": [ "dir", "file" ] }, "size": { "type": "integer" }, "mtime": { "type": "number" }, "tags": { "type": "array", "items": { "type": "string" } } } } } } }, "VaultMigrateDryRun": { "title": "VaultMigrateDryRun", "type": "object", "properties": { "key_count": { "type": "integer" } }, "description": "answered by the secrets server" }, "VaultRestoreInvalid": { "title": "VaultRestoreInvalid", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required" }, "detail": { "type": "string" } } }, "VaultRestoreRequest": { "title": "VaultRestoreRequest", "type": "object", "required": [ "backup_file" ], "properties": { "backup_file": { "type": "string" } } }, "VaultShow": { "title": "VaultShow", "type": "object", "required": [ "path", "sha", "text" ], "additionalProperties": false, "properties": { "path": { "type": "string" }, "sha": { "type": "string" }, "text": { "type": "string" } } }, "VaultUnauthorized": { "title": "VaultUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized" }, "detail": { "type": "string" } } }, "VaultUnavailable": { "title": "VaultUnavailable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unavailable" }, "detail": { "type": "string" } } }, "VerifyEmailBadRequest": { "title": "VerifyEmailBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_email, or a body-parse code" }, "detail": { "type": "string" } } }, "VerifyEmailConfig": { "title": "VerifyEmailConfig", "type": "object", "required": [ "required" ], "additionalProperties": false, "properties": { "required": { "type": "boolean" } } }, "VerifyEmailConfirmRequest": { "title": "VerifyEmailConfirmRequest", "type": "object", "required": [ "email", "code" ], "properties": { "email": { "type": "string", "maxLength": 254 }, "code": { "type": "string", "pattern": "^[0-9]{6}$" } } }, "VerifyEmailConfirmed": { "title": "VerifyEmailConfirmed", "type": "object", "required": [ "verification_token" ], "additionalProperties": false, "properties": { "verification_token": { "type": "string" } } }, "VerifyEmailInvalidCode": { "title": "VerifyEmailInvalidCode", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_code (also for an unknown, expired, used or exhausted code)" }, "detail": { "type": "string" } } }, "VerifyEmailMail": { "title": "VerifyEmailMail", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "mail_unavailable" }, "detail": { "type": "string" } } }, "VerifyEmailOff": { "title": "VerifyEmailOff", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "not_found (verification is not required on this install)" }, "detail": { "type": "string" } } }, "VerifyEmailOff2": { "title": "VerifyEmailOff2", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "not_found" }, "detail": { "type": "string" } } }, "VerifyEmailSendRequest": { "title": "VerifyEmailSendRequest", "type": "object", "required": [ "email" ], "properties": { "email": { "type": "string", "maxLength": 254 } } }, "VerifyEmailSent": { "title": "VerifyEmailSent", "type": "object", "required": [ "status" ], "additionalProperties": false, "properties": { "status": { "const": "sent" } } }, "WebauthnAlreadyMigrated": { "title": "WebauthnAlreadyMigrated", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "already_migrated" }, "detail": { "type": "string" } } }, "WebauthnAlreadyRegistered": { "title": "WebauthnAlreadyRegistered", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "credential_already_registered" }, "detail": { "type": "string" } } }, "WebauthnAssertBadRequest": { "title": "WebauthnAssertBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value, verify_failed" }, "detail": { "type": "string" } } }, "WebauthnAssertFinishRequest": { "title": "WebauthnAssertFinishRequest", "type": "object", "required": [ "challenge_id", "credential" ], "properties": { "challenge_id": { "type": "string" }, "credential": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "base64url credential id" }, "rawId": { "type": "string" }, "type": { "type": "string" }, "response": { "type": "object" }, "clientExtensionResults": { "type": "object" } }, "description": "the WebAuthn assertion or attestation as the browser returned it" } } }, "WebauthnAssertForbidden": { "title": "WebauthnAssertForbidden", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "user_mismatch, or csrf_token mismatch" }, "detail": { "type": "string" } } }, "WebauthnAssertOptions": { "title": "WebauthnAssertOptions", "type": "object", "required": [ "supported", "challenge_id", "publicKey" ], "additionalProperties": false, "properties": { "supported": { "const": true }, "challenge_id": { "type": "string" }, "publicKey": { "type": "object", "description": "PublicKeyCredentialRequestOptionsJSON" } } }, "WebauthnAssertOptionsBadRequest": { "title": "WebauthnAssertOptionsBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required" }, "detail": { "type": "string" } } }, "WebauthnAssertOptionsRequest": { "title": "WebauthnAssertOptionsRequest", "type": "object", "properties": { "user_id": { "type": "string", "format": "uuid" }, "email": { "type": "string" } }, "description": "required when there is no session; ignored with one" }, "WebauthnAssertRefused": { "title": "WebauthnAssertRefused", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "auth_required, cred_not_allowed, not_verified, counter_regression, counter_race" }, "detail": { "type": "string" } } }, "WebauthnChallengeGone": { "title": "WebauthnChallengeGone", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "challenge_expired_or_unknown" }, "detail": { "type": "string" } } }, "WebauthnCredentialList": { "title": "WebauthnCredentialList", "type": "object", "required": [ "credentials" ], "additionalProperties": false, "properties": { "credentials": { "type": "array", "items": { "type": "object", "required": [ "id", "credential_id", "created_at" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "device_name": { "type": [ "string", "null" ] }, "aaguid": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "last_used_at": { "type": [ "string", "null" ], "format": "date-time" }, "credential_id": { "type": "string" } } } } } }, "WebauthnCredentialNotFound": { "title": "WebauthnCredentialNotFound", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "credential_not_found" }, "detail": { "type": "string" } } }, "WebauthnE2eeNotEnrolled": { "title": "WebauthnE2eeNotEnrolled", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "e2ee_not_enrolled" }, "detail": { "type": "string" } } }, "WebauthnE2eeNotEnrolled2": { "title": "WebauthnE2eeNotEnrolled2", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "e2ee_not_enrolled" }, "detail": { "type": "string" } } }, "WebauthnMigrateBadRequest": { "title": "WebauthnMigrateBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value" }, "detail": { "type": "string" } } }, "WebauthnMigrateRequest": { "title": "WebauthnMigrateRequest", "type": "object", "required": [ "token", "prf_wrapped_master" ], "properties": { "token": { "type": "string" }, "prf_wrapped_master": { "type": "string", "pattern": "^[0-9a-fA-F]+$", "description": "hex, 60..96 bytes" } } }, "WebauthnMigrated": { "title": "WebauthnMigrated", "type": "object", "required": [ "migrated" ], "additionalProperties": false, "properties": { "migrated": { "const": true } } }, "WebauthnMigrationGone": { "title": "WebauthnMigrationGone", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "migration_token_expired_or_unknown" }, "detail": { "type": "string" } } }, "WebauthnNoChallenge": { "title": "WebauthnNoChallenge", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "no_pending_challenge" }, "detail": { "type": "string" } } }, "WebauthnOptionsFailed": { "title": "WebauthnOptionsFailed", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "options_failed" }, "detail": { "type": "string" } } }, "WebauthnOptionsFailed2": { "title": "WebauthnOptionsFailed2", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "options_failed" }, "detail": { "type": "string" } } }, "WebauthnPrfMissing": { "title": "WebauthnPrfMissing", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "prf_not_supported" }, "detail": { "type": "string" } } }, "WebauthnRegisterBadRequest": { "title": "WebauthnRegisterBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "value_required, invalid_value, attestation_verify_failed" }, "detail": { "type": "string" } } }, "WebauthnRegisterFinishRequest": { "title": "WebauthnRegisterFinishRequest", "type": "object", "required": [ "credential", "prf_wrapped_master" ], "properties": { "credential": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "base64url credential id" }, "rawId": { "type": "string" }, "type": { "type": "string" }, "response": { "type": "object" }, "clientExtensionResults": { "type": "object" } }, "description": "the WebAuthn assertion or attestation as the browser returned it" }, "prf_wrapped_master": { "type": "string", "pattern": "^[0-9a-fA-F]+$", "description": "hex, 60..96 bytes" }, "device_name": { "type": "string", "maxLength": 200 } } }, "WebauthnRegisterOptions": { "title": "WebauthnRegisterOptions", "type": "object", "required": [ "publicKey", "prf_salt_hex" ], "additionalProperties": false, "properties": { "publicKey": { "type": "object", "description": "PublicKeyCredentialCreationOptionsJSON" }, "prf_salt_hex": { "type": "string", "description": "32 bytes as hex" } } }, "WebauthnRegisterOptionsRequest": { "title": "WebauthnRegisterOptionsRequest", "type": "object", "description": "no fields are read" }, "WebauthnRegisterRevokeIncomplete": { "title": "WebauthnRegisterRevokeIncomplete", "type": "object", "required": [ "error", "passkey_changed", "revoke_failed" ], "properties": { "error": { "const": "credential_changed_revoke_incomplete" }, "passkey_changed": { "type": "string" }, "revoke_failed": { "type": "array", "items": { "type": "string" } }, "sessions_revoked": { "type": [ "integer", "null" ] }, "detail": { "type": "string" }, "id": { "type": "string", "format": "uuid" } }, "description": "the change is committed but not every session or token could be revoked" }, "WebauthnRegistered": { "title": "WebauthnRegistered", "type": "object", "required": [ "id", "device_name", "created_at", "sessions_revoked" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "device_name": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "sessions_revoked": { "type": [ "integer", "null" ] } } }, "WebauthnRemoveRevokeIncomplete": { "title": "WebauthnRemoveRevokeIncomplete", "type": "object", "required": [ "error", "passkey_changed", "revoke_failed" ], "properties": { "error": { "const": "credential_changed_revoke_incomplete" }, "passkey_changed": { "type": "string" }, "revoke_failed": { "type": "array", "items": { "type": "string" } }, "sessions_revoked": { "type": [ "integer", "null" ] }, "detail": { "type": "string" }, "id": { "type": "string", "format": "uuid" } }, "description": "the change is committed but not every session or token could be revoked" }, "WebauthnRenameBadRequest": { "title": "WebauthnRenameBadRequest", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "invalid_value" }, "detail": { "type": "string" } } }, "WebauthnRenameRequest": { "title": "WebauthnRenameRequest", "type": "object", "required": [ "device_name" ], "properties": { "device_name": { "type": "string", "minLength": 1, "maxLength": 200 } } }, "WebauthnRenamed": { "title": "WebauthnRenamed", "type": "object", "required": [ "id", "device_name" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "device_name": { "type": "string" } } }, "WebauthnUnknownCredential": { "title": "WebauthnUnknownCredential", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unknown_credential" }, "detail": { "type": "string" } } }, "WebauthnUnlock": { "title": "WebauthnUnlock", "type": "object", "required": [ "prf_wrapped_master", "prf_salt", "user_id", "memberships" ], "properties": { "prf_wrapped_master": { "type": "string", "description": "hex" }, "prf_salt": { "type": "string", "description": "hex" }, "user_id": { "type": "string", "format": "uuid" }, "memberships": { "type": "array", "items": { "type": "object", "required": [ "team_id", "wrapped_master_team_dek" ], "properties": { "team_id": { "type": "string", "format": "uuid" }, "wrapped_master_team_dek": { "type": "string" } } } }, "migrate": { "type": "object", "required": [ "token" ], "properties": { "token": { "type": "string" } }, "description": "present for a legacy-salt credential: post the re-wrap to assert/migrate with this token" } } }, "WebhookList": { "title": "WebhookList", "type": "array", "items": { "title": "WebhookRow", "type": "object", "description": "a webhook subscription as the webhook service returns it, with the secret replaced by has_secret and secret_last4", "properties": { "has_secret": { "type": "boolean" }, "secret_last4": { "type": [ "string", "null" ], "description": "last four characters, only for a secret of 16 characters or more" } } } }, "WebhookRow": { "title": "WebhookRow", "type": "object", "description": "a webhook subscription as the webhook service returns it, with the secret replaced by has_secret and secret_last4", "properties": { "has_secret": { "type": "boolean" }, "secret_last4": { "type": [ "string", "null" ], "description": "last four characters, only for a secret of 16 characters or more" } } }, "WebhookSecretRotated": { "title": "WebhookSecretRotated", "allOf": [ { "title": "WebhookRow", "type": "object", "description": "a webhook subscription as the webhook service returns it, with the secret replaced by has_secret and secret_last4", "properties": { "has_secret": { "type": "boolean" }, "secret_last4": { "type": [ "string", "null" ], "description": "last four characters, only for a secret of 16 characters or more" } } } ], "type": "object", "required": [ "secret" ], "properties": { "secret": { "type": "string", "pattern": "^[0-9a-f]{64}$", "description": "the new secret, shown once" } } }, "WebhooksUnavailable": { "title": "WebhooksUnavailable", "type": "object", "required": [ "error", "reason", "retry_after_s" ], "additionalProperties": false, "properties": { "error": { "const": "temporarily_unavailable" }, "reason": { "const": "webhooks_unavailable" }, "retry_after_s": { "type": "integer" } }, "description": "Retry-After is set" }, "Workflow": { "title": "Workflow", "type": "object", "required": [ "id", "name", "definition", "version" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": [ "string", "null" ] }, "definition": { "anyOf": [ { "type": "object", "description": "a plain workflow definition (start node and nodes)" }, { "title": "WorkflowEnvelope", "type": "object", "required": [ "enc_v", "nonce", "ct" ], "additionalProperties": false, "properties": { "enc_v": { "const": 2 }, "nonce": { "type": "string", "pattern": "^[0-9a-f]{48}$" }, "ct": { "type": "string", "pattern": "^(?:[0-9a-f]{2})+$", "minLength": 34, "maxLength": 2097152 } } } ] }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "company_id": { "type": [ "string", "null" ], "format": "uuid" }, "created_by_user_id": { "type": [ "string", "null" ], "format": "uuid" }, "trigger": { "type": [ "object", "null" ] }, "version": { "type": "integer" }, "definition_aad_v": { "type": [ "integer", "null" ] }, "created_at": { "type": "string" }, "updated_at": { "type": "string" }, "deleted_at": { "type": [ "string", "null" ] } } }, "WorkflowApprovalRequest": { "title": "WorkflowApprovalRequest", "type": "object", "required": [ "decision" ], "properties": { "decision": { "enum": [ "approve", "reject" ] }, "note": { "type": "string", "description": "not accepted in the end-to-end mode" }, "proof": { "type": "object", "description": "end-to-end mode: the approval proof relayed to the host" } } }, "WorkflowConflict": { "title": "WorkflowConflict", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "detail": { "type": "string" }, "current": { "description": "the stored row on an optimistic-concurrency conflict" } } }, "WorkflowEventFired": { "title": "WorkflowEventFired", "type": "object", "required": [ "fired" ], "additionalProperties": false, "properties": { "fired": { "type": "integer" } } }, "WorkflowEventRequest": { "title": "WorkflowEventRequest", "type": "object", "required": [ "name" ], "properties": { "name": { "type": "string", "minLength": 1 }, "payload": { "description": "plain, or a sealed envelope in the end-to-end mode" }, "team_id": { "type": "string", "format": "uuid", "description": "required with a sealed payload" } } }, "WorkflowList": { "title": "WorkflowList", "type": "array", "items": { "type": "object", "required": [ "id", "name" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "description": { "type": [ "string", "null" ] }, "n_nodes": { "type": [ "integer", "null" ], "description": "null for a sealed definition" }, "updated_at": { "type": "string", "format": "date-time" }, "created_at": { "type": "string", "format": "date-time" }, "last_status": { "type": [ "string", "null" ] }, "last_finished": { "type": [ "string", "null" ], "format": "date-time" }, "last_failed_node": { "type": [ "string", "null" ] } } } }, "WorkflowPendingApprovals": { "title": "WorkflowPendingApprovals", "type": "array", "items": { "type": "object", "required": [ "id", "run_id", "node_id" ], "description": "fleet_workflow_pending_approvals row", "properties": { "id": { "type": "string", "format": "uuid" }, "run_id": { "type": "string", "format": "uuid" }, "node_id": { "type": "string" }, "reason": { "type": [ "string", "null" ] }, "requested_at": { "type": "string", "format": "date-time" }, "decided_at": { "type": [ "string", "null" ], "format": "date-time" }, "decision": { "enum": [ "approve", "reject", null ] }, "decided_by": { "type": [ "string", "null" ] }, "note": { "type": [ "string", "null" ] }, "workflow_id": { "type": [ "string", "null" ], "format": "uuid" }, "workflow_name": { "type": [ "string", "null" ] }, "team_id": { "type": [ "string", "null" ], "format": "uuid" } } } }, "WorkflowResealClosed": { "title": "WorkflowResealClosed", "type": "object", "required": [ "closed_at", "already" ], "additionalProperties": false, "properties": { "closed_at": { "type": "string", "format": "date-time" }, "already": { "type": "boolean" } } }, "WorkflowResealCompleteRequest": { "title": "WorkflowResealCompleteRequest", "type": "object" }, "WorkflowResealList": { "title": "WorkflowResealList", "type": "object", "additionalProperties": false, "required": [ "e2e_mode", "closed_at", "pending", "workflows", "next_after_id" ], "properties": { "e2e_mode": { "enum": [ "on", "off" ] }, "closed_at": { "type": [ "string", "null" ], "format": "date-time" }, "pending": { "type": "integer" }, "workflows": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "id", "team_id", "definition", "definition_sha" ], "properties": { "id": { "type": "string", "format": "uuid" }, "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "definition": { "type": "object" }, "definition_sha": { "type": "string" } } } }, "next_after_id": { "type": [ "string", "null" ], "format": "uuid" } } }, "WorkflowResealPending": { "title": "WorkflowResealPending", "type": "object", "properties": { "error": { "type": "string" }, "detail": { "type": "string" }, "pending": { "type": "integer" } } }, "WorkflowResealRequest": { "title": "WorkflowResealRequest", "type": "object", "required": [ "definition", "from_sha" ], "properties": { "definition": { "type": "object", "description": "the sealed envelope" }, "from_sha": { "type": "string", "description": "sha256 of the definition as listed" } } }, "WorkflowResealed": { "title": "WorkflowResealed", "type": "object", "required": [ "id", "version" ], "additionalProperties": false, "properties": { "id": { "type": "string", "format": "uuid" }, "version": { "type": "integer" } } }, "WorkflowRunCancelled": { "title": "WorkflowRunCancelled", "type": "object", "required": [ "ok" ], "additionalProperties": false, "properties": { "ok": { "const": true } } }, "WorkflowRunDetail": { "title": "WorkflowRunDetail", "allOf": [ { "title": "WorkflowRun", "type": "object", "required": [ "id", "status" ], "description": "fleet_workflow_runs row", "properties": { "id": { "type": "string", "format": "uuid" }, "workflow_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" }, "state": { "type": "object" }, "started_at": { "type": [ "string", "null" ], "format": "date-time" }, "finished_at": { "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "type": "string", "format": "date-time" }, "failed_node_id": { "type": [ "string", "null" ] } } } ], "type": "object", "properties": { "team_id": { "type": [ "string", "null" ], "format": "uuid" }, "snapshot": { "description": "the workflow definition the run started from" } } }, "WorkflowRunList": { "title": "WorkflowRunList", "type": "array", "items": { "title": "WorkflowRun", "type": "object", "required": [ "id", "status" ], "description": "fleet_workflow_runs row", "properties": { "id": { "type": "string", "format": "uuid" }, "workflow_id": { "type": [ "string", "null" ], "format": "uuid" }, "status": { "type": "string" }, "state": { "type": "object" }, "started_at": { "type": [ "string", "null" ], "format": "date-time" }, "finished_at": { "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "type": "string", "format": "date-time" }, "failed_node_id": { "type": [ "string", "null" ] } } } }, "WorkflowTemplateIndex": { "title": "WorkflowTemplateIndex", "type": [ "object", "array" ], "description": "the index.json shipped with the install, passed through" }, "WorkflowTemplatesMissing": { "title": "WorkflowTemplatesMissing", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "workflow-templates not mounted" }, "detail": { "type": "string" } } }, "WorkflowTemplatesUnauthorized": { "title": "WorkflowTemplatesUnauthorized", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string", "description": "unauthorized" }, "detail": { "type": "string" } } }, "WorkflowTriggerRequest": { "title": "WorkflowTriggerRequest", "type": "object", "properties": { "every_ms": { "type": "number", "minimum": 60000, "description": "interval; below one minute is 422" } }, "description": "other trigger fields are stored as sent" }, "WorkflowTriggerSet": { "title": "WorkflowTriggerSet", "type": "object", "required": [ "ok", "trigger" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "trigger": { "type": [ "object", "null" ] } } }, "WorkflowUnprocessable": { "title": "WorkflowUnprocessable", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" }, "detail": { "type": "string" } }, "description": "invalid_value, value_required, invalid_workflow_definition, team_id_required, company_required, or a sealed-content refusal of the end-to-end mode" }, "WrappedMasterSet": { "title": "WrappedMasterSet", "type": "object", "required": [ "ok", "wrapped_master_set" ], "additionalProperties": false, "properties": { "ok": { "const": true }, "wrapped_master_set": { "const": true } } }, "WsTicket": { "title": "WsTicket", "type": "object", "required": [ "ticket", "role", "scope", "expires_in_ms" ], "additionalProperties": false, "properties": { "ticket": { "type": "string" }, "role": { "type": "string" }, "scope": { "type": "string" }, "expires_in_ms": { "type": "integer" } } }, "WsTicketRefusal": { "title": "WsTicketRefusal", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } }, "WsTicketRequest": { "title": "WsTicketRequest", "type": "object", "properties": { "role": { "enum": [ "viewer", "workflow_viewer", "metrics_viewer", "notifications" ], "default": "viewer" }, "scope_id": { "type": "string", "maxLength": 64, "description": "session, host, run or user id; required for a tenant user who is not a platform admin" } } }, "WsTicketUnknownRole": { "title": "WsTicketUnknownRole", "type": "object", "required": [ "error" ], "properties": { "error": { "type": "string" } } } }, "securitySchemes": { "adminToken": { "type": "http", "scheme": "bearer", "description": "CALDYR_FLEET_ADMIN_TOKEN (fleet admin bearer, auth/middleware decideBearer)" }, "apiToken": { "type": "http", "scheme": "bearer", "description": "shared operator bearer CALDYR_API_TOKEN (rag-api checkAuth; vt CLI)" }, "automationToken": { "type": "http", "scheme": "bearer", "description": "team automation token (session.via === automation_token)" }, "bearer": { "type": "http", "scheme": "bearer", "description": "session bearer token resolved by lib/auth/middleware authenticate (session, CLI or automation token)" }, "deviceSession": { "type": "http", "scheme": "bearer", "description": "device session (sst_..., signed, from POST /auth/session) of the Obsidian plugin; device-token.js resolveDevice" }, "hostToken": { "type": "http", "scheme": "bearer", "description": "per-host token of an enrolled daemon (req.resolvedAuth.host)" }, "internalToken": { "type": "apiKey", "in": "header", "name": "x-caldyr-internal-token", "description": "signed internal-trust token between Caldyr services" }, "metricsToken": { "type": "http", "scheme": "bearer", "description": "CALDYR_METRICS_TOKEN when set; open otherwise" }, "oauthAccessToken": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT", "description": "access token (JWT) issued by the OAuth authorization server of this install, accepted by the hub MCP endpoint (hub-mcp.js resolveOauthAuth)" }, "recoveryGate": { "type": "http", "scheme": "x-caldyr-recovery", "description": "recovery token (mailed by POST /auth/recovery-request) or recovery code, sent in the JSON body as recovery_token or recovery_code; lib/auth/recovery-request.js checkRecoveryGate" }, "recoveryProof": { "type": "http", "scheme": "x-caldyr-recovery-proof", "description": "signed proof in the JSON body (proof: the challenge from POST /auth/recovery-challenge and its signature by the account recovery signing key); recovery.js verifyRecoveryProof" }, "scimToken": { "type": "http", "scheme": "bearer", "description": "SCIM bearer (scim_tokens)" }, "session": { "type": "apiKey", "in": "cookie", "name": "caldyr_app_session", "description": "SPA session cookie (caldyr_admin_session on admin.); mutating calls also need the CSRF header" }, "sessionBearer": { "type": "http", "scheme": "bearer", "description": "bearer token of a person session (auth_sessions). A CLI token (caldyr_ct_) authenticates only on cli-token-auth.js CLI_ROUTES, and an automation token is refused by the handler (403 cli_tenant_required)" }, "spawnToken": { "type": "http", "scheme": "bearer", "description": "per-spawn session token handed to an agent process" }, "stripeSignature": { "type": "apiKey", "in": "header", "name": "stripe-signature", "description": "Stripe webhook signature over the raw body, verified with the webhook signing secret (billing/webhook-handler.js)" } } } }