{
  "components": {
    "schemas": {
      "APIReference": {
        "description": "Identifies a target API — the strict (all-required) variant.\n\nUsed in responses and as the canonical identity tuple.",
        "properties": {
          "name": {
            "title": "Name",
            "type": "string"
          },
          "vendor": {
            "title": "Vendor",
            "type": "string"
          },
          "version": {
            "title": "Version",
            "type": "string"
          }
        },
        "required": [
          "vendor",
          "name",
          "version"
        ],
        "title": "APIReference",
        "type": "object"
      },
      "APIReferenceRequest": {
        "description": "Relaxed variant for request bodies where partial identification is allowed.",
        "properties": {
          "catalog_api_id": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Catalog Api Id"
          },
          "name": {
            "default": "",
            "title": "Name",
            "type": "string"
          },
          "vendor": {
            "title": "Vendor",
            "type": "string"
          },
          "version": {
            "default": "",
            "title": "Version",
            "type": "string"
          }
        },
        "required": [
          "vendor"
        ],
        "title": "APIReferenceRequest",
        "type": "object"
      },
      "AccessRequestFileRequest": {
        "description": "Request body for filing an access request.",
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/AccessRequestItemRequest"
            },
            "minItems": 1,
            "title": "Items",
            "type": "array"
          },
          "reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reason"
          }
        },
        "required": [
          "items"
        ],
        "title": "AccessRequestFileRequest",
        "type": "object"
      },
      "AccessRequestItemRequest": {
        "description": "A single line-item in a file request.\n\n**Permission rules:** Rules control which upstream API operations the broker\nallows through a credential binding. They are enforced per (toolkit_id,\ncredential_id) pair, so they can only be attached to credential:bind items —\nnot toolkit:bind or scope:grant. You do not need toolkits:write scope to set\nrules; include them directly on the credential:bind item when filing the\naccess request, and the approver's decision persists them on the binding.",
        "properties": {
          "action": {
            "enum": [
              "bind",
              "grant",
              "create",
              "provision"
            ],
            "title": "Action",
            "type": "string"
          },
          "resource_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Resource Id"
          },
          "resource_reference": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Resource Reference"
          },
          "resource_type": {
            "enum": [
              "credential",
              "toolkit",
              "scope"
            ],
            "title": "Resource Type",
            "type": "string"
          },
          "rules": {
            "anyOf": [
              {
                "items": {
                  "$ref": "#/components/schemas/jentic_one__control__web__schemas__access_requests__PermissionRuleSchema"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "description": "Permission rules for the binding (credential:bind only). Rules are evaluated first-match-wins by the broker; if no rule matches, the request is denied. Example: [{\"effect\": \"allow\", \"path\": \".*\"}].",
            "title": "Rules"
          },
          "to_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "To Id"
          },
          "to_type": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "To Type"
          }
        },
        "required": [
          "resource_type",
          "action"
        ],
        "title": "AccessRequestItemRequest",
        "type": "object"
      },
      "AccessRequestItemResponse": {
        "description": "Response model for a single access-request line item.",
        "properties": {
          "action": {
            "title": "Action",
            "type": "string"
          },
          "already_satisfied": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "description": "Whether this item's outcome is already in effect (the binding or grant it asks for already exists), letting a reviewer approve manually-fulfilled work instead of re-doing it in the wizard. Populated on single-request GETs for pending credential:bind, toolkit:bind, and scope:grant items; null when not computed (list endpoints, decided items, fulfilment-only intents, an item whose target cannot be determined, an ambiguous toolkit reference — which approval would refuse as filed — or a credential:bind whose credential is not visible to the caller). Toolkit REFERENCES are resolved under the caller's visibility, mirroring decide-time resolution, so False can also mean 'satisfied by a toolkit this caller cannot see'; explicit-id targets are probed directly.",
            "title": "Already Satisfied"
          },
          "already_satisfied_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "For a satisfied toolkit:bind, the id of the toolkit the agent is already bound to — names the exact object so consumers can point the operator at it. Null for other item types and whenever already_satisfied is not true.",
            "title": "Already Satisfied By"
          },
          "applied_effects": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Applied Effects"
          },
          "credential_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Credential Name"
          },
          "decided_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Decided At"
          },
          "decided_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Decided By"
          },
          "decision_reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Decision Reason"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "resource_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Resource Id"
          },
          "resource_reference": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Resource Reference"
          },
          "resource_type": {
            "title": "Resource Type",
            "type": "string"
          },
          "rules": {
            "anyOf": [
              {
                "items": {
                  "additionalProperties": true,
                  "type": "object"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Rules"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "to_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "To Id"
          },
          "to_type": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "To Type"
          },
          "toolkit_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Toolkit Name"
          }
        },
        "required": [
          "id",
          "resource_type",
          "action",
          "status"
        ],
        "title": "AccessRequestItemResponse",
        "type": "object"
      },
      "AccessRequestListResponse": {
        "description": "Paginated list of access requests.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/AccessRequestResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "AccessRequestListResponse",
        "type": "object"
      },
      "AccessRequestOwnerResponse": {
        "description": "Display info for the filer's human owner (labelling only, not authorization).\n\nServer-resolved from ``filer_owner_id`` (falling back to ``created_by``\nwhen the former is null, mirroring what consumers render) so they don't\nneed ``users:read`` (or a roster fetch) just to label a row. Absent when\nthe id doesn't resolve to a user (service-account filers, purged rows) or\non mutation responses, which skip the enrichment.",
        "properties": {
          "display_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "The owner's full name, when set on the profile.",
            "title": "Display Name"
          },
          "email": {
            "description": "The owner's email address.",
            "title": "Email",
            "type": "string"
          },
          "id": {
            "description": "The resolved owner's user id (filer_owner_id, or created_by when null).",
            "title": "Id",
            "type": "string"
          }
        },
        "required": [
          "id",
          "email"
        ],
        "title": "AccessRequestOwnerResponse",
        "type": "object"
      },
      "AccessRequestResponse": {
        "description": "Response model for an access request envelope.",
        "properties": {
          "actor_id": {
            "title": "Actor Id",
            "type": "string"
          },
          "approve_url": {
            "title": "Approve Url",
            "type": "string"
          },
          "created_by": {
            "title": "Created By",
            "type": "string"
          },
          "evaluation": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/EvaluationResponse"
              },
              {
                "type": "null"
              }
            ]
          },
          "expires_at": {
            "format": "date-time",
            "title": "Expires At",
            "type": "string"
          },
          "filed_at": {
            "format": "date-time",
            "title": "Filed At",
            "type": "string"
          },
          "filer_owner": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/AccessRequestOwnerResponse"
              },
              {
                "type": "null"
              }
            ]
          },
          "filer_owner_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Filer Owner Id"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "items": {
            "items": {
              "$ref": "#/components/schemas/AccessRequestItemResponse"
            },
            "title": "Items",
            "type": "array"
          },
          "reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reason"
          },
          "requested_by": {
            "title": "Requested By",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          }
        },
        "required": [
          "id",
          "actor_id",
          "requested_by",
          "status",
          "approve_url",
          "filed_at",
          "expires_at",
          "created_by",
          "items"
        ],
        "title": "AccessRequestResponse",
        "type": "object"
      },
      "ActorListResponse": {
        "description": "Paginated list of actors.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ActorSummaryResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "ActorListResponse",
        "type": "object"
      },
      "ActorSummaryResponse": {
        "description": "Single actor entry in the actors list.",
        "properties": {
          "active": {
            "title": "Active",
            "type": "boolean"
          },
          "actor_type": {
            "$ref": "#/components/schemas/ActorType"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "name": {
            "title": "Name",
            "type": "string"
          }
        },
        "required": [
          "id",
          "actor_type",
          "name",
          "active",
          "created_at"
        ],
        "title": "ActorSummaryResponse",
        "type": "object"
      },
      "ActorType": {
        "description": "Type of authenticated actor.",
        "enum": [
          "user",
          "agent",
          "service_account",
          "toolkit"
        ],
        "title": "ActorType",
        "type": "string"
      },
      "AgentCreateRequest": {
        "description": "Request body for creating an agent manually.",
        "properties": {
          "description": {
            "anyOf": [
              {
                "maxLength": 1024,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "name": {
            "maxLength": 255,
            "minLength": 1,
            "title": "Name",
            "type": "string"
          },
          "scopes": {
            "anyOf": [
              {
                "items": {
                  "maxLength": 64,
                  "minLength": 1,
                  "pattern": "^[a-zA-Z0-9_:./-]+$",
                  "type": "string"
                },
                "maxItems": 100,
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Scopes"
          }
        },
        "required": [
          "name"
        ],
        "title": "AgentCreateRequest",
        "type": "object"
      },
      "AgentListResponse": {
        "description": "List of agents.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/AgentResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "AgentListResponse",
        "type": "object"
      },
      "AgentPatchRequest": {
        "description": "Request body for partially updating an agent.",
        "properties": {
          "description": {
            "anyOf": [
              {
                "maxLength": 1024,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "name": {
            "anyOf": [
              {
                "maxLength": 255,
                "minLength": 1,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Name"
          },
          "owner_id": {
            "anyOf": [
              {
                "maxLength": 255,
                "minLength": 1,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Owner Id"
          }
        },
        "title": "AgentPatchRequest",
        "type": "object"
      },
      "AgentResponse": {
        "description": "Agent representation in API responses.",
        "properties": {
          "approved_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Approved At"
          },
          "approved_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Approved By"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "denial_reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Denial Reason"
          },
          "denied_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Denied By"
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "has_api_key": {
            "default": false,
            "title": "Has Api Key",
            "type": "boolean"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "owner_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Owner Id"
          },
          "parent_agent_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Parent Agent Id"
          },
          "registered_by": {
            "title": "Registered By",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "registered_by",
          "status",
          "created_at"
        ],
        "title": "AgentResponse",
        "type": "object"
      },
      "AgentScopesRequest": {
        "description": "Request body for replacing an agent's scopes.",
        "properties": {
          "scopes": {
            "items": {
              "maxLength": 64,
              "minLength": 1,
              "pattern": "^[a-zA-Z0-9_:./-]+$",
              "type": "string"
            },
            "maxItems": 100,
            "title": "Scopes",
            "type": "array"
          }
        },
        "required": [
          "scopes"
        ],
        "title": "AgentScopesRequest",
        "type": "object"
      },
      "AgentScopesResponse": {
        "description": "Response containing an agent's current scopes.",
        "properties": {
          "scopes": {
            "items": {
              "type": "string"
            },
            "title": "Scopes",
            "type": "array"
          }
        },
        "required": [
          "scopes"
        ],
        "title": "AgentScopesResponse",
        "type": "object"
      },
      "AmendItemSchema": {
        "description": "A single item amendment.",
        "properties": {
          "item_id": {
            "title": "Item Id",
            "type": "string"
          },
          "resource_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Resource Id"
          },
          "rules": {
            "anyOf": [
              {
                "items": {
                  "$ref": "#/components/schemas/jentic_one__control__web__schemas__access_requests__PermissionRuleSchema"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Rules"
          },
          "to_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "To Id"
          }
        },
        "required": [
          "item_id"
        ],
        "title": "AmendItemSchema",
        "type": "object"
      },
      "AmendRequest": {
        "description": "Request body for the :amend verb.",
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/AmendItemSchema"
            },
            "minItems": 1,
            "title": "Items",
            "type": "array"
          }
        },
        "required": [
          "items"
        ],
        "title": "AmendRequest",
        "type": "object"
      },
      "ApiImportLinksResponse": {
        "description": "Hypermedia links for an import response.",
        "properties": {
          "self": {
            "title": "Self",
            "type": "string"
          }
        },
        "required": [
          "self"
        ],
        "title": "ApiImportLinksResponse",
        "type": "object"
      },
      "ApiImportRequest": {
        "description": "Wrapper for a batch of import sources.",
        "properties": {
          "sources": {
            "items": {
              "discriminator": {
                "mapping": {
                  "inline": "#/components/schemas/ApiSourceInline",
                  "url": "#/components/schemas/ApiSourceUrl"
                },
                "propertyName": "type"
              },
              "oneOf": [
                {
                  "$ref": "#/components/schemas/ApiSourceUrl"
                },
                {
                  "$ref": "#/components/schemas/ApiSourceInline"
                }
              ]
            },
            "maxItems": 100,
            "minItems": 1,
            "title": "Sources",
            "type": "array"
          }
        },
        "required": [
          "sources"
        ],
        "title": "ApiImportRequest",
        "type": "object"
      },
      "ApiImportResponse": {
        "description": "Acknowledgement payload for an asynchronous import job.",
        "properties": {
          "_links": {
            "$ref": "#/components/schemas/ApiImportLinksResponse"
          },
          "job_id": {
            "title": "Job Id",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          }
        },
        "required": [
          "job_id",
          "status",
          "_links"
        ],
        "title": "ApiImportResponse",
        "type": "object"
      },
      "ApiInfoResponse": {
        "description": "API identification information.",
        "properties": {
          "host": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Host"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "vendor": {
            "title": "Vendor",
            "type": "string"
          },
          "version": {
            "title": "Version",
            "type": "string"
          }
        },
        "required": [
          "vendor",
          "name",
          "version"
        ],
        "title": "ApiInfoResponse",
        "type": "object"
      },
      "ApiKeyCreateRequest": {
        "description": "Create request for api_key credentials.",
        "examples": [
          {
            "api": {
              "name": "stripe",
              "vendor": "stripe.com",
              "version": "2024-04-10"
            },
            "field_name": "Authorization",
            "key": "sk_live_…",
            "location": "header",
            "name": "Stripe live key",
            "provider": "static",
            "type": "api_key"
          }
        ],
        "properties": {
          "api": {
            "$ref": "#/components/schemas/APIReferenceRequest",
            "description": "Loose (vendor, name, version) API identity tuple."
          },
          "field_name": {
            "description": "Header or query-parameter name carrying the key.",
            "title": "Field Name",
            "type": "string"
          },
          "key": {
            "description": "The API key secret. Stored encrypted; never returned after create.",
            "title": "Key",
            "type": "string"
          },
          "location": {
            "$ref": "#/components/schemas/CredentialLocation",
            "description": "Where to inject the key on upstream calls."
          },
          "name": {
            "description": "Human-readable label for the credential.",
            "title": "Name",
            "type": "string"
          },
          "provider": {
            "default": "static",
            "description": "Credential provider; 'static' for stored secrets.",
            "title": "Provider",
            "type": "string"
          },
          "runtime_config": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/RuntimeConfig"
              },
              {
                "type": "null"
              }
            ]
          },
          "server_variables": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Server Variables"
          },
          "type": {
            "const": "api_key",
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "type",
          "name",
          "api",
          "key",
          "location",
          "field_name"
        ],
        "title": "ApiKeyCreateRequest",
        "type": "object"
      },
      "ApiKeyHistoryEntryResponse": {
        "description": "A single event in the API key audit trail.",
        "properties": {
          "action": {
            "title": "Action",
            "type": "string"
          },
          "actor_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Actor Id"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "occurred_at": {
            "format": "date-time",
            "title": "Occurred At",
            "type": "string"
          },
          "reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reason"
          }
        },
        "required": [
          "id",
          "action",
          "occurred_at"
        ],
        "title": "ApiKeyHistoryEntryResponse",
        "type": "object"
      },
      "ApiKeyHistoryResponse": {
        "description": "Audit trail of API key operations.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ApiKeyHistoryEntryResponse"
            },
            "title": "Data",
            "type": "array"
          }
        },
        "required": [
          "data"
        ],
        "title": "ApiKeyHistoryResponse",
        "type": "object"
      },
      "ApiKeyInfoResponse": {
        "description": "API key metadata — retrievable even after revocation.",
        "properties": {
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "created_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Created By"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "rotated_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Rotated At"
          },
          "status": {
            "title": "Status",
            "type": "string"
          }
        },
        "required": [
          "id",
          "status",
          "created_at"
        ],
        "title": "ApiKeyInfoResponse",
        "type": "object"
      },
      "ApiKeyResponse": {
        "description": "Response containing a plaintext API key (shown once).",
        "properties": {
          "key": {
            "title": "Key",
            "type": "string"
          }
        },
        "required": [
          "key"
        ],
        "title": "ApiKeyResponse",
        "type": "object"
      },
      "ApiKeyUpdateRequest": {
        "description": "Update request for api_key credentials.",
        "properties": {
          "active": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Active"
          },
          "field_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Immutable after create. Accepted for backward compatibility; if provided it must equal the stored value, otherwise the request is rejected. Recreate the credential to change the parameter name.",
            "title": "Field Name"
          },
          "key": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Key"
          },
          "location": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/CredentialLocation"
              },
              {
                "type": "null"
              }
            ],
            "description": "Immutable after create. Accepted for backward compatibility; if provided it must equal the stored value, otherwise the request is rejected. Recreate the credential to change the injection binding."
          },
          "name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Name"
          },
          "runtime_config": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/RuntimeConfig"
              },
              {
                "type": "null"
              }
            ]
          },
          "server_variables": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Server Variables"
          },
          "type": {
            "const": "api_key",
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "title": "ApiKeyUpdateRequest",
        "type": "object"
      },
      "ApiLinksResponse": {
        "description": "Hypermedia links for a (local) API resource.",
        "properties": {
          "current_revision": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Current Revision"
          },
          "revisions": {
            "title": "Revisions",
            "type": "string"
          },
          "self": {
            "title": "Self",
            "type": "string"
          }
        },
        "required": [
          "self",
          "revisions"
        ],
        "title": "ApiLinksResponse",
        "type": "object"
      },
      "ApiListResponse": {
        "description": "Cursor-paginated list of APIs.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ApiResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "ApiListResponse",
        "type": "object"
      },
      "ApiReferenceResponse": {
        "description": "Core API identifier triple plus derived host.",
        "properties": {
          "host": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Host"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "vendor": {
            "title": "Vendor",
            "type": "string"
          },
          "version": {
            "title": "Version",
            "type": "string"
          }
        },
        "required": [
          "vendor",
          "name",
          "version",
          "host"
        ],
        "title": "ApiReferenceResponse",
        "type": "object"
      },
      "ApiResponse": {
        "description": "Full API aggregate response.\n\n``GET /apis`` is the local registry — every item is an API imported into\nthis deployment. The public catalog of importable-but-not-yet-imported APIs\nis a separate surface (``GET /catalog``); the two are not blended.",
        "properties": {
          "_links": {
            "$ref": "#/components/schemas/ApiLinksResponse"
          },
          "api": {
            "$ref": "#/components/schemas/ApiReferenceResponse"
          },
          "catalog_api_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Catalog Api Id"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "current_revision_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Current Revision Id"
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "display_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Display Name"
          },
          "icon_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Icon Url"
          },
          "operation_count": {
            "title": "Operation Count",
            "type": "integer"
          },
          "origin": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Provenance of the current revision: `catalog` (imported from the public catalog), `overlay` (materialized from a confirmed overlay), or null (manual import).",
            "title": "Origin"
          },
          "revision_count": {
            "title": "Revision Count",
            "type": "integer"
          },
          "security_schemes": {
            "items": {
              "type": "string"
            },
            "title": "Security Schemes",
            "type": "array"
          },
          "source_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Upstream spec URL backing the current revision, when known (catalog linkage).",
            "title": "Source Url"
          },
          "update_available": {
            "default": false,
            "description": "Whether the upstream spec at `source_url` has a notified update this API hasn't adopted yet (Flow-3). Re-importing clears it.",
            "title": "Update Available",
            "type": "boolean"
          },
          "updated_at": {
            "format": "date-time",
            "title": "Updated At",
            "type": "string"
          }
        },
        "required": [
          "api",
          "catalog_api_id",
          "display_name",
          "description",
          "icon_url",
          "current_revision_id",
          "revision_count",
          "operation_count",
          "security_schemes",
          "created_at",
          "updated_at",
          "_links"
        ],
        "title": "ApiResponse",
        "type": "object"
      },
      "ApiSourceInline": {
        "description": "Import source carrying raw OpenAPI/Arazzo content inline.",
        "properties": {
          "api_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Name"
          },
          "content": {
            "title": "Content",
            "type": "string"
          },
          "filename": {
            "title": "Filename",
            "type": "string"
          },
          "submitted_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Submitted By"
          },
          "type": {
            "const": "inline",
            "title": "Type",
            "type": "string"
          },
          "vendor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Vendor"
          },
          "version": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Version"
          }
        },
        "required": [
          "type",
          "content",
          "filename"
        ],
        "title": "ApiSourceInline",
        "type": "object"
      },
      "ApiSourceUrl": {
        "description": "Import source pointing at a fetchable URL.",
        "properties": {
          "api_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Name"
          },
          "submitted_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Submitted By"
          },
          "type": {
            "const": "url",
            "title": "Type",
            "type": "string"
          },
          "url": {
            "format": "uri",
            "maxLength": 2083,
            "minLength": 1,
            "title": "Url",
            "type": "string"
          },
          "vendor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Vendor"
          },
          "version": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Version"
          }
        },
        "required": [
          "type",
          "url"
        ],
        "title": "ApiSourceUrl",
        "type": "object"
      },
      "ApiUpdateRequest": {
        "additionalProperties": false,
        "description": "Partial update payload for an API's presentation fields.",
        "properties": {
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "display_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Display Name"
          },
          "icon_url": {
            "anyOf": [
              {
                "format": "uri",
                "maxLength": 2083,
                "minLength": 1,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Icon Url"
          }
        },
        "title": "ApiUpdateRequest",
        "type": "object"
      },
      "AuditListResponse": {
        "description": "Paginated list of audit entries.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/AuditResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "AuditListResponse",
        "type": "object"
      },
      "AuditResponse": {
        "description": "Audit entry representation in API responses.",
        "properties": {
          "action": {
            "title": "Action",
            "type": "string"
          },
          "actor_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Actor Id"
          },
          "actor_session_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Actor Session Id"
          },
          "actor_type": {
            "title": "Actor Type",
            "type": "string"
          },
          "after": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "After"
          },
          "before": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Before"
          },
          "diff": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Diff"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "ip_address": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ip Address"
          },
          "job_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Job Id"
          },
          "occurred_at": {
            "format": "date-time",
            "title": "Occurred At",
            "type": "string"
          },
          "origin": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Origin"
          },
          "reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reason"
          },
          "request_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Request Id"
          },
          "target_id": {
            "title": "Target Id",
            "type": "string"
          },
          "target_parent_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Target Parent Id"
          },
          "target_type": {
            "title": "Target Type",
            "type": "string"
          },
          "trace_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Trace Id"
          },
          "user_agent": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "User Agent"
          }
        },
        "required": [
          "id",
          "occurred_at",
          "action",
          "target_type",
          "target_id",
          "actor_type"
        ],
        "title": "AuditResponse",
        "type": "object"
      },
      "AuditTargetType": {
        "description": "Entity types that can be the target of an audited action.",
        "enum": [
          "revision",
          "permission",
          "user",
          "credential",
          "toolkit",
          "agent",
          "job",
          "organisation",
          "invite_token",
          "event",
          "execution_record",
          "service_account",
          "token",
          "overlay",
          "note",
          "api",
          "access_request",
          "toolkit_key",
          "credential_binding",
          "session",
          "provider_config"
        ],
        "title": "AuditTargetType",
        "type": "string"
      },
      "BasicAuthCreateRequest": {
        "description": "Create request for basic credentials.",
        "properties": {
          "api": {
            "$ref": "#/components/schemas/APIReferenceRequest"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "password": {
            "title": "Password",
            "type": "string"
          },
          "provider": {
            "default": "static",
            "title": "Provider",
            "type": "string"
          },
          "runtime_config": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/RuntimeConfig"
              },
              {
                "type": "null"
              }
            ]
          },
          "server_variables": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Server Variables"
          },
          "type": {
            "const": "basic",
            "title": "Type",
            "type": "string"
          },
          "username": {
            "title": "Username",
            "type": "string"
          }
        },
        "required": [
          "type",
          "name",
          "api",
          "username",
          "password"
        ],
        "title": "BasicAuthCreateRequest",
        "type": "object"
      },
      "BasicAuthUpdateRequest": {
        "description": "Update request for basic credentials.",
        "properties": {
          "active": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Active"
          },
          "name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Name"
          },
          "password": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Password"
          },
          "runtime_config": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/RuntimeConfig"
              },
              {
                "type": "null"
              }
            ]
          },
          "server_variables": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Server Variables"
          },
          "type": {
            "const": "basic",
            "title": "Type",
            "type": "string"
          },
          "username": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Username"
          }
        },
        "required": [
          "type"
        ],
        "title": "BasicAuthUpdateRequest",
        "type": "object"
      },
      "BearerTokenCreateRequest": {
        "description": "Create request for bearer_token credentials.",
        "properties": {
          "api": {
            "$ref": "#/components/schemas/APIReferenceRequest"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "provider": {
            "default": "static",
            "title": "Provider",
            "type": "string"
          },
          "runtime_config": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/RuntimeConfig"
              },
              {
                "type": "null"
              }
            ]
          },
          "server_variables": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Server Variables"
          },
          "token": {
            "title": "Token",
            "type": "string"
          },
          "type": {
            "const": "bearer_token",
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "type",
          "name",
          "api",
          "token"
        ],
        "title": "BearerTokenCreateRequest",
        "type": "object"
      },
      "BearerTokenUpdateRequest": {
        "description": "Update request for bearer_token credentials.",
        "properties": {
          "active": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Active"
          },
          "name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Name"
          },
          "runtime_config": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/RuntimeConfig"
              },
              {
                "type": "null"
              }
            ]
          },
          "server_variables": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Server Variables"
          },
          "token": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Token"
          },
          "type": {
            "const": "bearer_token",
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "title": "BearerTokenUpdateRequest",
        "type": "object"
      },
      "BindingWarningSchema": {
        "description": "A non-fatal signal about a bind (or create-time inline bind).",
        "properties": {
          "code": {
            "description": "Stable machine-readable warning code.",
            "title": "Code",
            "type": "string"
          },
          "credential_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Credential the warning applies to; null when the whole binding is meant.",
            "title": "Credential Id"
          },
          "message": {
            "description": "Human-readable explanation with a recovery pointer.",
            "title": "Message",
            "type": "string"
          }
        },
        "required": [
          "code",
          "message"
        ],
        "title": "BindingWarningSchema",
        "type": "object"
      },
      "CatalogEntryLinksResponse": {
        "description": "Hypermedia links for a catalog entry.",
        "examples": [
          {
            "github": "https://github.com/jentic/jentic-public-apis/tree/main/apis/openapi/stripe.com",
            "import": "/catalog/stripe.com:import",
            "operations": "/catalog/stripe.com/operations",
            "self": "/catalog/stripe.com"
          }
        ],
        "properties": {
          "github": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Human-facing GitHub tree URL for the entry, when known.",
            "title": "Github"
          },
          "import": {
            "description": "URL of the catalog import action (`POST /catalog/{api_id}:import`).",
            "title": "Import",
            "type": "string"
          },
          "operations": {
            "description": "URL of the entry's operation preview.",
            "title": "Operations",
            "type": "string"
          },
          "self": {
            "description": "Canonical URL of this catalog entry.",
            "title": "Self",
            "type": "string"
          }
        },
        "required": [
          "self",
          "operations",
          "import"
        ],
        "title": "CatalogEntryLinksResponse",
        "type": "object"
      },
      "CatalogEntryResponse": {
        "description": "A single browsable catalog entry.",
        "examples": [
          {
            "_links": {
              "import": "/catalog/stripe.com:import",
              "operations": "/catalog/stripe.com/operations",
              "self": "/catalog/stripe.com"
            },
            "api_id": "stripe.com",
            "path": "apis/openapi/stripe.com",
            "registered": false,
            "spec_url": "https://raw.githubusercontent.com/jentic/jentic-public-apis/main/apis/openapi/stripe.com/main/2024-01-01/openapi.json",
            "vendor": "stripe.com"
          }
        ],
        "properties": {
          "_links": {
            "$ref": "#/components/schemas/CatalogEntryLinksResponse"
          },
          "api_id": {
            "description": "Catalog identity of the API (manifest domain, e.g. `stripe.com`).",
            "title": "Api Id",
            "type": "string"
          },
          "path": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Manifest path of the entry within the public-APIs repo.",
            "title": "Path"
          },
          "registered": {
            "description": "Whether this entry is already imported locally — its `spec_url` backs a non-archived revision in `GET /apis`.",
            "title": "Registered",
            "type": "boolean"
          },
          "spec_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Fetchable OpenAPI spec URL the entry resolves to (used for import + coverage).",
            "title": "Spec Url"
          },
          "update_available": {
            "default": false,
            "description": "Whether this (registered) entry has an upstream spec update the local revision hasn't adopted yet. Always false for unregistered entries.",
            "title": "Update Available",
            "type": "boolean"
          },
          "vendor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Registrable-domain vendor derived from `api_id` (e.g. `stripe.com`).",
            "title": "Vendor"
          }
        },
        "required": [
          "api_id",
          "vendor",
          "path",
          "spec_url",
          "registered",
          "_links"
        ],
        "title": "CatalogEntryResponse",
        "type": "object"
      },
      "CatalogListResponse": {
        "description": "List of catalog entries plus status fields for the Discover status row.",
        "examples": [
          {
            "catalog_total": 5231,
            "data": [],
            "has_more": true,
            "manifest_age_seconds": 3600,
            "next_cursor": "eyJpZCI6ICJzdHJpcGUuY29tIn0=",
            "registered_count": 12
          }
        ],
        "properties": {
          "catalog_total": {
            "description": "Total entries in the whole manifest (pre-filter, pre-page).",
            "title": "Catalog Total",
            "type": "integer"
          },
          "data": {
            "description": "The page of catalog entries.",
            "items": {
              "$ref": "#/components/schemas/CatalogEntryResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "default": false,
            "description": "Whether another page follows.",
            "title": "Has More",
            "type": "boolean"
          },
          "manifest_age_seconds": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "description": "Age of the cached manifest in seconds, or null when the cache is empty.",
            "title": "Manifest Age Seconds"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Opaque keyset cursor for the next page (null when done).",
            "title": "Next Cursor"
          },
          "outdated_count": {
            "default": 0,
            "description": "Count of whole-manifest registered entries with an upstream update available.",
            "title": "Outdated Count",
            "type": "integer"
          },
          "registered_count": {
            "description": "Count of whole-manifest entries already imported locally.",
            "title": "Registered Count",
            "type": "integer"
          }
        },
        "required": [
          "data",
          "catalog_total",
          "registered_count"
        ],
        "title": "CatalogListResponse",
        "type": "object"
      },
      "CatalogRefreshResponse": {
        "description": "Acknowledgement of a manifest refresh.",
        "examples": [
          {
            "count": 5231,
            "status": "refreshed"
          }
        ],
        "properties": {
          "count": {
            "description": "Number of entries in the freshly fetched manifest.",
            "title": "Count",
            "type": "integer"
          },
          "status": {
            "default": "refreshed",
            "description": "Refresh outcome marker.",
            "title": "Status",
            "type": "string"
          }
        },
        "required": [
          "count"
        ],
        "title": "CatalogRefreshResponse",
        "type": "object"
      },
      "ChangePasswordRequest": {
        "description": "Payload for changing own password.",
        "properties": {
          "current_password": {
            "maxLength": 128,
            "minLength": 1,
            "title": "Current Password",
            "type": "string"
          },
          "new_password": {
            "maxLength": 128,
            "minLength": 12,
            "title": "New Password",
            "type": "string"
          }
        },
        "required": [
          "current_password",
          "new_password"
        ],
        "title": "ChangePasswordRequest",
        "type": "object"
      },
      "ConnectChallengeResponse": {
        "description": "Response from a connect initiation.",
        "properties": {
          "authorize_url": {
            "title": "Authorize Url",
            "type": "string"
          },
          "state": {
            "title": "State",
            "type": "string"
          }
        },
        "required": [
          "authorize_url",
          "state"
        ],
        "title": "ConnectChallengeResponse",
        "type": "object"
      },
      "ConnectRequestBody": {
        "description": "Request body for initiating a credential connect flow.",
        "properties": {
          "extra": {
            "additionalProperties": {
              "type": "string"
            },
            "title": "Extra",
            "type": "object"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "title": "Scopes",
            "type": "array"
          }
        },
        "title": "ConnectRequestBody",
        "type": "object"
      },
      "CreateAdminRequest": {
        "description": "Payload for first-run admin creation (one-time setup).",
        "properties": {
          "email": {
            "maxLength": 320,
            "minLength": 1,
            "title": "Email",
            "type": "string"
          },
          "first_name": {
            "default": "Admin",
            "maxLength": 100,
            "minLength": 1,
            "title": "First Name",
            "type": "string"
          },
          "last_name": {
            "default": "User",
            "maxLength": 100,
            "minLength": 1,
            "title": "Last Name",
            "type": "string"
          },
          "password": {
            "maxLength": 128,
            "minLength": 12,
            "title": "Password",
            "type": "string"
          }
        },
        "required": [
          "email",
          "password"
        ],
        "title": "CreateAdminRequest",
        "type": "object"
      },
      "CredentialCreateResponse": {
        "description": "Create response: redacted + secret shown once.",
        "properties": {
          "credential": {
            "$ref": "#/components/schemas/CredentialRedactedResponse"
          },
          "secret": {
            "additionalProperties": true,
            "title": "Secret",
            "type": "object"
          }
        },
        "required": [
          "credential",
          "secret"
        ],
        "title": "CredentialCreateResponse",
        "type": "object"
      },
      "CredentialListResponse": {
        "description": "Paginated list of credentials.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/CredentialRedactedResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "CredentialListResponse",
        "type": "object"
      },
      "CredentialLocation": {
        "description": "Where an API-key credential is injected into a request.",
        "enum": [
          "header",
          "query",
          "cookie"
        ],
        "title": "CredentialLocation",
        "type": "string"
      },
      "CredentialRedactedResponse": {
        "description": "Redacted credential response (for read/list/patch).",
        "examples": [
          {
            "active": true,
            "api": {
              "name": "stripe",
              "vendor": "stripe.com",
              "version": "2024-04-10"
            },
            "created_at": "2026-01-15T09:30:00Z",
            "credential_id": "cred_01HZX9...",
            "details": {
              "field_name": "Authorization",
              "hint": "…live_abcd",
              "location": "header"
            },
            "name": "Stripe live key",
            "provider": "static",
            "type": "api_key"
          }
        ],
        "properties": {
          "active": {
            "description": "Whether the credential is enabled for injection.",
            "title": "Active",
            "type": "boolean"
          },
          "api": {
            "$ref": "#/components/schemas/APIReference",
            "description": "The (vendor, name, version) API this credential targets."
          },
          "catalog_api_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Catalog identity slug of the target API (`domain[/sub-api]`), when recorded at create time. Display-only; null for older credentials.",
            "title": "Catalog Api Id"
          },
          "created_at": {
            "description": "Creation timestamp (UTC).",
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "created_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Identity that created the credential (its owner).",
            "title": "Created By"
          },
          "credential_id": {
            "description": "Stable credential identifier, prefixed `cred_`.",
            "title": "Credential Id",
            "type": "string"
          },
          "details": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "description": "Redacted, type-specific projection (hints/last-N chars; never the secret). For oauth2: client_id, token_url, grant_type (authorization_code | client_credentials), scopes, and — for authorization_code only — `connected`, whether the interactive sign-in completed and is still usable (null for other grants).",
            "title": "Details"
          },
          "name": {
            "description": "Human-readable label.",
            "title": "Name",
            "type": "string"
          },
          "provider": {
            "description": "Credential provider; 'static' for stored secrets.",
            "title": "Provider",
            "type": "string"
          },
          "provider_account_ref": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Opaque reference to the provider account, when applicable.",
            "title": "Provider Account Ref"
          },
          "server_variables": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "description": "OpenAPI server-variable values for URL template substitution.",
            "title": "Server Variables"
          },
          "type": {
            "$ref": "#/components/schemas/CredentialType",
            "description": "Credential auth type (api_key, bearer_token, basic, oauth2)."
          },
          "updated_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Last update timestamp (UTC).",
            "title": "Updated At"
          }
        },
        "required": [
          "credential_id",
          "type",
          "name",
          "api",
          "provider",
          "active",
          "created_at"
        ],
        "title": "CredentialRedactedResponse",
        "type": "object"
      },
      "CredentialType": {
        "description": "Wire-level credential type used by the provider abstraction.",
        "enum": [
          "bearer_token",
          "api_key",
          "basic",
          "oauth2",
          "no_auth"
        ],
        "title": "CredentialType",
        "type": "string"
      },
      "CurrentUserResponse": {
        "description": "Current user profile.",
        "properties": {
          "active": {
            "title": "Active",
            "type": "boolean"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "email": {
            "title": "Email",
            "type": "string"
          },
          "first_name": {
            "title": "First Name",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "last_name": {
            "title": "Last Name",
            "type": "string"
          },
          "must_change_password": {
            "title": "Must Change Password",
            "type": "boolean"
          },
          "permissions": {
            "items": {
              "type": "string"
            },
            "title": "Permissions",
            "type": "array"
          },
          "updated_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Updated At"
          }
        },
        "required": [
          "id",
          "email",
          "first_name",
          "last_name",
          "active",
          "permissions",
          "must_change_password",
          "created_at"
        ],
        "title": "CurrentUserResponse",
        "type": "object"
      },
      "DailyExecutionBucket": {
        "description": "Execution counts for a single day.",
        "properties": {
          "date": {
            "title": "Date",
            "type": "string"
          },
          "failed": {
            "title": "Failed",
            "type": "integer"
          },
          "success": {
            "title": "Success",
            "type": "integer"
          },
          "total": {
            "title": "Total",
            "type": "integer"
          }
        },
        "required": [
          "date",
          "total",
          "success",
          "failed"
        ],
        "title": "DailyExecutionBucket",
        "type": "object"
      },
      "DecideItemSchema": {
        "description": "A single item decision.",
        "properties": {
          "decision": {
            "enum": [
              "approved",
              "denied"
            ],
            "title": "Decision",
            "type": "string"
          },
          "decision_reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Decision Reason"
          },
          "item_id": {
            "title": "Item Id",
            "type": "string"
          }
        },
        "required": [
          "item_id",
          "decision"
        ],
        "title": "DecideItemSchema",
        "type": "object"
      },
      "DecideRequest": {
        "description": "Request body for the :decide verb.",
        "properties": {
          "items": {
            "items": {
              "$ref": "#/components/schemas/DecideItemSchema"
            },
            "minItems": 1,
            "title": "Items",
            "type": "array"
          }
        },
        "required": [
          "items"
        ],
        "title": "DecideRequest",
        "type": "object"
      },
      "EffectivePermission": {
        "description": "A single effective permission with provenance.",
        "properties": {
          "implied_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Implied By"
          },
          "name": {
            "title": "Name",
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "title": "EffectivePermission",
        "type": "object"
      },
      "ErrorItem": {
        "description": "A granular error detail entry within the errors[] array of a ProblemDetails response.\n\nAt least one of pointer, parameter, or header SHOULD be present to identify the error source.",
        "properties": {
          "code": {
            "anyOf": [
              {
                "maxLength": 50,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "An optional provider-specific code identifying this error in internal taxonomy or documentation.",
            "examples": [
              "JENTIC-V-001"
            ],
            "title": "Code"
          },
          "detail": {
            "description": "A human-readable explanation of this specific error. Be precise — name the field, parameter, or header involved.",
            "examples": [
              "Field 'name' must not be blank."
            ],
            "maxLength": 4096,
            "title": "Detail",
            "type": "string"
          },
          "header": {
            "anyOf": [
              {
                "maxLength": 1024,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "The name of the request header that is the source of this error.",
            "examples": [
              "Authorization"
            ],
            "title": "Header"
          },
          "parameter": {
            "anyOf": [
              {
                "maxLength": 1024,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "The name of the query or path parameter that is the source of this error.",
            "examples": [
              "limit"
            ],
            "title": "Parameter"
          },
          "pointer": {
            "anyOf": [
              {
                "maxLength": 1024,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "A JSON Pointer (RFC 6901) to the specific request body property that is the source of this error.",
            "examples": [
              "#/name"
            ],
            "title": "Pointer"
          }
        },
        "required": [
          "detail"
        ],
        "title": "ErrorItem",
        "type": "object"
      },
      "EvaluationCheckResponse": {
        "description": "A single evaluation check result.",
        "properties": {
          "blocker": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Blocker"
          },
          "check": {
            "title": "Check",
            "type": "string"
          },
          "passed": {
            "title": "Passed",
            "type": "boolean"
          }
        },
        "required": [
          "check",
          "passed"
        ],
        "title": "EvaluationCheckResponse",
        "type": "object"
      },
      "EvaluationResponse": {
        "description": "Computed evaluation of whether the caller can fulfill a request.",
        "properties": {
          "can_fulfill": {
            "title": "Can Fulfill",
            "type": "boolean"
          },
          "checks": {
            "items": {
              "$ref": "#/components/schemas/EvaluationCheckResponse"
            },
            "title": "Checks",
            "type": "array"
          }
        },
        "required": [
          "can_fulfill",
          "checks"
        ],
        "title": "EvaluationResponse",
        "type": "object"
      },
      "EventAcknowledgeRequest": {
        "description": "Request body for acknowledging an event.",
        "properties": {
          "acknowledged": {
            "title": "Acknowledged",
            "type": "boolean"
          },
          "note": {
            "anyOf": [
              {
                "maxLength": 2000,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Note"
          }
        },
        "required": [
          "acknowledged"
        ],
        "title": "EventAcknowledgeRequest",
        "type": "object"
      },
      "EventLinks": {
        "description": "HAL-style links for an event.",
        "properties": {
          "action": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Action"
          },
          "execution": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Execution"
          },
          "job": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Job"
          },
          "self": {
            "title": "Self",
            "type": "string"
          }
        },
        "required": [
          "self"
        ],
        "title": "EventLinks",
        "type": "object"
      },
      "EventListResponse": {
        "description": "Paginated list of events.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/EventResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "EventListResponse",
        "type": "object"
      },
      "EventResponse": {
        "description": "Event representation in API responses.",
        "properties": {
          "_links": {
            "$ref": "#/components/schemas/EventLinks"
          },
          "acknowledged": {
            "title": "Acknowledged",
            "type": "boolean"
          },
          "acknowledged_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Acknowledged At"
          },
          "acknowledged_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Acknowledged By"
          },
          "actor_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Actor Id"
          },
          "actor_type": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Actor Type"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "data": {
            "additionalProperties": true,
            "title": "Data",
            "type": "object"
          },
          "detail": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Detail"
          },
          "event_id": {
            "title": "Event Id",
            "type": "string"
          },
          "requires_action": {
            "title": "Requires Action",
            "type": "boolean"
          },
          "severity": {
            "$ref": "#/components/schemas/EventSeverity"
          },
          "summary": {
            "title": "Summary",
            "type": "string"
          },
          "trace_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Trace Id"
          },
          "type": {
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "event_id",
          "type",
          "severity",
          "summary",
          "requires_action",
          "acknowledged",
          "created_at",
          "_links"
        ],
        "title": "EventResponse",
        "type": "object"
      },
      "EventSeverity": {
        "description": "Severity level for platform events.",
        "enum": [
          "info",
          "warning",
          "error",
          "critical"
        ],
        "title": "EventSeverity",
        "type": "string"
      },
      "ExecutionListResponse": {
        "description": "Paginated list of executions.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ExecutionResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "ExecutionListResponse",
        "type": "object"
      },
      "ExecutionRecordLinks": {
        "description": "HATEOAS links for an execution record.",
        "properties": {
          "self": {
            "title": "Self",
            "type": "string"
          }
        },
        "required": [
          "self"
        ],
        "title": "ExecutionRecordLinks",
        "type": "object"
      },
      "ExecutionResponse": {
        "description": "Execution record representation in API responses.",
        "properties": {
          "_links": {
            "$ref": "#/components/schemas/ExecutionRecordLinks"
          },
          "actor_id": {
            "title": "Actor Id",
            "type": "string"
          },
          "actor_type": {
            "title": "Actor Type",
            "type": "string"
          },
          "api": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/ApiInfoResponse"
              },
              {
                "type": "null"
              }
            ]
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "credential_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Credential Id"
          },
          "credential_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Credential Name"
          },
          "duration_ms": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Duration Ms"
          },
          "error": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Error"
          },
          "execution_id": {
            "title": "Execution Id",
            "type": "string"
          },
          "http_status": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Http Status"
          },
          "operation_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Operation Id"
          },
          "origin": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Origin"
          },
          "pinned_revisions": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Pinned Revisions"
          },
          "started_at": {
            "format": "date-time",
            "title": "Started At",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "toolkit_id": {
            "title": "Toolkit Id",
            "type": "string"
          },
          "toolkit_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Toolkit Name"
          },
          "trace_id": {
            "title": "Trace Id",
            "type": "string"
          }
        },
        "required": [
          "execution_id",
          "toolkit_id",
          "trace_id",
          "started_at",
          "status",
          "created_at",
          "actor_id",
          "actor_type",
          "_links"
        ],
        "title": "ExecutionResponse",
        "type": "object"
      },
      "ExecutionStatsResponse": {
        "description": "Aggregated execution statistics for the dashboard.",
        "properties": {
          "daily_buckets": {
            "items": {
              "$ref": "#/components/schemas/DailyExecutionBucket"
            },
            "title": "Daily Buckets",
            "type": "array"
          },
          "success_rate_percent": {
            "title": "Success Rate Percent",
            "type": "number"
          },
          "top_operations": {
            "items": {
              "$ref": "#/components/schemas/TopOperation"
            },
            "title": "Top Operations",
            "type": "array"
          },
          "total_executions": {
            "title": "Total Executions",
            "type": "integer"
          }
        },
        "required": [
          "total_executions",
          "success_rate_percent",
          "daily_buckets",
          "top_operations"
        ],
        "title": "ExecutionStatsResponse",
        "type": "object"
      },
      "GroupBy": {
        "description": "Grouping dimension for usage statistics.",
        "enum": [
          "api",
          "toolkit",
          "agent"
        ],
        "title": "GroupBy",
        "type": "string"
      },
      "HealthResponse": {
        "description": "Health check response for the admin surface.",
        "properties": {
          "next_step": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Step"
          },
          "setup_required": {
            "title": "Setup Required",
            "type": "boolean"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "surface": {
            "title": "Surface",
            "type": "string"
          }
        },
        "required": [
          "status",
          "surface",
          "setup_required"
        ],
        "title": "HealthResponse",
        "type": "object"
      },
      "InstanceIdentityResponse": {
        "description": "Self-describing identity of the backend serving this request.\n\nA client can compare ``backend``/``canonical_base_url``/``host`` against where\nit *thinks* it is pointed to confirm it is talking to the intended backend\n(e.g. a local install vs. a remote one) before diagnosing \"missing\" data.",
        "properties": {
          "backend": {
            "description": "Operator-declared backend locality (server.backend): 'local' for a self-hosted install on the operator's own machine/network, 'remote' for a hosted install run elsewhere. A hint, not an authorization signal; defaults to 'local'.",
            "enum": [
              "local",
              "remote"
            ],
            "title": "Backend",
            "type": "string"
          },
          "canonical_base_url": {
            "description": "The instance's own canonical base URL (auth.canonical_base_url), with any userinfo stripped; '' if unset.",
            "title": "Canonical Base Url",
            "type": "string"
          },
          "host": {
            "description": "Host (and port, when the canonical base URL declares one) parsed from canonical_base_url; '' if unset or unparseable.",
            "title": "Host",
            "type": "string"
          },
          "instance_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Opaque digest derived from the telemetry instance id — stable per install, but not the telemetry id itself. Null when telemetry has not resolved an id (e.g. telemetry disabled).",
            "title": "Instance Id"
          }
        },
        "required": [
          "backend",
          "canonical_base_url",
          "host"
        ],
        "title": "InstanceIdentityResponse",
        "type": "object"
      },
      "IntrospectRequest": {
        "description": "Introspection endpoint request (form body).",
        "properties": {
          "token": {
            "title": "Token",
            "type": "string"
          },
          "token_type_hint": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Token Type Hint"
          }
        },
        "required": [
          "token"
        ],
        "title": "IntrospectRequest",
        "type": "object"
      },
      "IntrospectResponse": {
        "description": "RFC 7662 introspection response.",
        "properties": {
          "active": {
            "title": "Active",
            "type": "boolean"
          },
          "exp": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Exp"
          },
          "scope": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Scope"
          },
          "sub": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Sub"
          },
          "token_type": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Token Type"
          }
        },
        "required": [
          "active"
        ],
        "title": "IntrospectResponse",
        "type": "object"
      },
      "InviteIssuedResponse": {
        "description": "Response when an invite token is issued.",
        "properties": {
          "expires_at": {
            "format": "date-time",
            "title": "Expires At",
            "type": "string"
          },
          "token": {
            "title": "Token",
            "type": "string"
          }
        },
        "required": [
          "token",
          "expires_at"
        ],
        "title": "InviteIssuedResponse",
        "type": "object"
      },
      "InviteState": {
        "description": "State of a user invitation.",
        "enum": [
          "pending",
          "redeemed",
          "expired",
          "accepted"
        ],
        "title": "InviteState",
        "type": "string"
      },
      "JobLinksResponse": {
        "description": "Hypermedia links for a job.",
        "properties": {
          "execution": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Execution"
          },
          "result": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Result"
          },
          "self": {
            "title": "Self",
            "type": "string"
          }
        },
        "required": [
          "self"
        ],
        "title": "JobLinksResponse",
        "type": "object"
      },
      "JobListResponse": {
        "description": "Paginated list of jobs.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/JobResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "JobListResponse",
        "type": "object"
      },
      "JobResponse": {
        "description": "Job representation in API responses.",
        "properties": {
          "_links": {
            "$ref": "#/components/schemas/JobLinksResponse"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "error": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Error"
          },
          "execution_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Execution Id"
          },
          "job_id": {
            "title": "Job Id",
            "type": "string"
          },
          "kind": {
            "title": "Kind",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "updated_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Updated At"
          }
        },
        "required": [
          "job_id",
          "kind",
          "status",
          "created_at",
          "_links"
        ],
        "title": "JobResponse",
        "type": "object"
      },
      "LoginRequest": {
        "description": "Credentials for login.",
        "properties": {
          "email": {
            "maxLength": 320,
            "minLength": 1,
            "title": "Email",
            "type": "string"
          },
          "password": {
            "maxLength": 128,
            "minLength": 1,
            "title": "Password",
            "type": "string"
          }
        },
        "required": [
          "email",
          "password"
        ],
        "title": "LoginRequest",
        "type": "object"
      },
      "LoginResponse": {
        "description": "JWT token response after successful authentication.",
        "properties": {
          "access_token": {
            "title": "Access Token",
            "type": "string"
          },
          "expires_in": {
            "title": "Expires In",
            "type": "integer"
          },
          "must_change_password": {
            "title": "Must Change Password",
            "type": "boolean"
          },
          "token_type": {
            "title": "Token Type",
            "type": "string"
          }
        },
        "required": [
          "access_token",
          "token_type",
          "expires_in",
          "must_change_password"
        ],
        "title": "LoginResponse",
        "type": "object"
      },
      "MeAgent": {
        "description": "Identity response for an agent actor.",
        "properties": {
          "approved_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Approved By"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "parent_agent_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Parent Agent Id"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "title": "Scopes",
            "type": "array"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "token_scopes": {
            "items": {
              "type": "string"
            },
            "title": "Token Scopes",
            "type": "array"
          },
          "toolkit_bindings": {
            "items": {
              "$ref": "#/components/schemas/ToolkitBindingEntry"
            },
            "title": "Toolkit Bindings",
            "type": "array"
          },
          "type": {
            "const": "agent",
            "default": "agent",
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "status",
          "scopes",
          "token_scopes",
          "toolkit_bindings"
        ],
        "title": "MeAgent",
        "type": "object"
      },
      "MeServiceAccount": {
        "description": "Identity response for a service-account actor.",
        "properties": {
          "approved_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Approved By"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "registered_by": {
            "title": "Registered By",
            "type": "string"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "title": "Scopes",
            "type": "array"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "token_scopes": {
            "items": {
              "type": "string"
            },
            "title": "Token Scopes",
            "type": "array"
          },
          "type": {
            "const": "service_account",
            "default": "service_account",
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "status",
          "scopes",
          "token_scopes",
          "registered_by"
        ],
        "title": "MeServiceAccount",
        "type": "object"
      },
      "MeUser": {
        "description": "Identity response for a user actor.",
        "properties": {
          "admin": {
            "title": "Admin",
            "type": "boolean"
          },
          "email": {
            "title": "Email",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "must_change_password": {
            "title": "Must Change Password",
            "type": "boolean"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "title": "Scopes",
            "type": "array"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "type": {
            "const": "user",
            "default": "user",
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "email",
          "admin",
          "status",
          "scopes",
          "must_change_password"
        ],
        "title": "MeUser",
        "type": "object"
      },
      "MintRequest": {
        "description": "Ephemeral token minting request.",
        "properties": {
          "scope": {
            "title": "Scope",
            "type": "string"
          },
          "target_agent_id": {
            "title": "Target Agent Id",
            "type": "string"
          },
          "ttl_seconds": {
            "anyOf": [
              {
                "maximum": 3600.0,
                "minimum": 1.0,
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ttl Seconds"
          }
        },
        "required": [
          "scope",
          "target_agent_id"
        ],
        "title": "MintRequest",
        "type": "object"
      },
      "MintResponse": {
        "description": "Ephemeral token minting response.",
        "properties": {
          "access_token": {
            "title": "Access Token",
            "type": "string"
          },
          "expires_in": {
            "title": "Expires In",
            "type": "integer"
          },
          "token_type": {
            "default": "bearer",
            "title": "Token Type",
            "type": "string"
          }
        },
        "required": [
          "access_token",
          "expires_in"
        ],
        "title": "MintResponse",
        "type": "object"
      },
      "NoAuthCreateRequest": {
        "description": "Create request for no_auth credentials.\n\nA no-auth credential carries no secret — it represents \"this API is called\nwithout authentication\". It still exists as a credential row so a toolkit\nbinding (and its permission rules) can hang off it, and the broker resolves\nit as a no-op auth (see broker credential resolver / injection).",
        "properties": {
          "api": {
            "$ref": "#/components/schemas/APIReferenceRequest"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "provider": {
            "default": "static",
            "title": "Provider",
            "type": "string"
          },
          "runtime_config": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/RuntimeConfig"
              },
              {
                "type": "null"
              }
            ]
          },
          "server_variables": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Server Variables"
          },
          "type": {
            "const": "no_auth",
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "type",
          "name",
          "api"
        ],
        "title": "NoAuthCreateRequest",
        "type": "object"
      },
      "NoteApiReference": {
        "additionalProperties": false,
        "description": "Loose ``(vendor, name, version)`` identity tuple for a registered API.",
        "properties": {
          "name": {
            "title": "Name",
            "type": "string"
          },
          "vendor": {
            "title": "Vendor",
            "type": "string"
          },
          "version": {
            "title": "Version",
            "type": "string"
          }
        },
        "required": [
          "vendor",
          "name",
          "version"
        ],
        "title": "NoteApiReference",
        "type": "object"
      },
      "NoteConfidence": {
        "description": "Author-supplied confidence in a note (matches the spec ``NoteConfidence`` enum).",
        "enum": [
          "observed",
          "suspected",
          "verified"
        ],
        "title": "NoteConfidence",
        "type": "string"
      },
      "NoteCreateRequest": {
        "additionalProperties": false,
        "description": "Payload for creating a new note.",
        "properties": {
          "body": {
            "maxLength": 4000,
            "title": "Body",
            "type": "string"
          },
          "confidence": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/NoteConfidence"
              },
              {
                "type": "null"
              }
            ]
          },
          "related_execution_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Related Execution Id"
          },
          "resource": {
            "$ref": "#/components/schemas/NoteResource"
          },
          "source": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/NoteSource"
              },
              {
                "type": "null"
              }
            ]
          },
          "type": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/NoteType"
              },
              {
                "type": "null"
              }
            ]
          }
        },
        "required": [
          "resource",
          "body"
        ],
        "title": "NoteCreateRequest",
        "type": "object"
      },
      "NoteResource": {
        "additionalProperties": false,
        "description": "Exactly-one-of resource identifier for a note (request side).",
        "properties": {
          "api": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/NoteApiReference"
              },
              {
                "type": "null"
              }
            ]
          },
          "credential_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Credential Id"
          },
          "execution_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Execution Id"
          },
          "operation_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Operation Id"
          }
        },
        "title": "NoteResource",
        "type": "object"
      },
      "NoteSource": {
        "description": "Origin tag for a note (matches the spec ``NoteSource`` enum).",
        "enum": [
          "agent",
          "human",
          "platform"
        ],
        "title": "NoteSource",
        "type": "string"
      },
      "NoteType": {
        "description": "Category of a note (matches the spec ``NoteType`` enum).",
        "enum": [
          "auth_quirk",
          "usage_hint",
          "execution_feedback",
          "correction"
        ],
        "title": "NoteType",
        "type": "string"
      },
      "NoteUpdateRequest": {
        "additionalProperties": false,
        "description": "Payload for updating an existing note (partial).",
        "properties": {
          "body": {
            "anyOf": [
              {
                "maxLength": 4000,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Body"
          },
          "confidence": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/NoteConfidence"
              },
              {
                "type": "null"
              }
            ]
          },
          "related_execution_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Related Execution Id"
          },
          "source": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/NoteSource"
              },
              {
                "type": "null"
              }
            ]
          },
          "type": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/NoteType"
              },
              {
                "type": "null"
              }
            ]
          }
        },
        "title": "NoteUpdateRequest",
        "type": "object"
      },
      "OAuth2CreateRequest": {
        "description": "Create request for oauth2 credentials.\n\nFor managed providers (e.g. pipedream, direct_oauth2), token_url/client_id/client_secret\nare optional — the connect flow handles authentication without caller-supplied client details.",
        "properties": {
          "api": {
            "$ref": "#/components/schemas/APIReferenceRequest"
          },
          "authorize_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Authorize Url"
          },
          "client_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Client Id"
          },
          "client_secret": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Client Secret"
          },
          "grant_type": {
            "default": "client_credentials",
            "title": "Grant Type",
            "type": "string"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "provider": {
            "default": "static",
            "title": "Provider",
            "type": "string"
          },
          "runtime_config": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/RuntimeConfig"
              },
              {
                "type": "null"
              }
            ]
          },
          "scopes": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Scopes"
          },
          "server_variables": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Server Variables"
          },
          "token_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Token Url"
          },
          "type": {
            "const": "oauth2",
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "type",
          "name",
          "api"
        ],
        "title": "OAuth2CreateRequest",
        "type": "object"
      },
      "OAuth2UpdateRequest": {
        "description": "Update request for oauth2 credentials.",
        "properties": {
          "active": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Active"
          },
          "client_secret": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Client Secret"
          },
          "name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Name"
          },
          "runtime_config": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/RuntimeConfig"
              },
              {
                "type": "null"
              }
            ]
          },
          "scopes": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Scopes"
          },
          "server_variables": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Server Variables"
          },
          "token_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Token Url"
          },
          "type": {
            "const": "oauth2",
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "title": "OAuth2UpdateRequest",
        "type": "object"
      },
      "OperationPreviewListResponse": {
        "description": "Capped, offset-paginated operation preview for a catalog entry.\n\nUnlike list endpoints (cursor-paginated), the preview uses simple\noffset/limit pagination deliberately: it reads a single, already-fetched spec\ndocument and is hard-capped at ``PREVIEW_MAX_OPERATIONS`` operations, so there\nis no large/mutating result set that would justify keyset cursors.",
        "examples": [
          {
            "data": [],
            "info": {
              "description": "Payments.",
              "title": "Stripe",
              "version": "2024-01-01"
            },
            "offset": 0,
            "security_schemes": {},
            "total": 42,
            "truncated": true
          }
        ],
        "properties": {
          "data": {
            "description": "The page of previewed operations.",
            "items": {
              "$ref": "#/components/schemas/PreviewOperationResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "info": {
            "$ref": "#/components/schemas/PreviewInfoResponse",
            "description": "The spec's `info` block."
          },
          "offset": {
            "description": "Offset of the returned window.",
            "title": "Offset",
            "type": "integer"
          },
          "security_schemes": {
            "additionalProperties": {
              "additionalProperties": true,
              "type": "object"
            },
            "description": "Slimmed `components.securitySchemes` projection.",
            "title": "Security Schemes",
            "type": "object"
          },
          "total": {
            "description": "Total operations in the spec (pre-page).",
            "title": "Total",
            "type": "integer"
          },
          "truncated": {
            "description": "Whether more operations follow this window.",
            "title": "Truncated",
            "type": "boolean"
          }
        },
        "required": [
          "data",
          "total",
          "offset",
          "truncated",
          "info",
          "security_schemes"
        ],
        "title": "OperationPreviewListResponse",
        "type": "object"
      },
      "OperationResultResponse": {
        "description": "A single search result matching the OperationResult spec.",
        "properties": {
          "_links": {
            "$ref": "#/components/schemas/SearchLinksResponse"
          },
          "api": {
            "$ref": "#/components/schemas/ApiReferenceResponse"
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "method": {
            "title": "Method",
            "type": "string"
          },
          "name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Name"
          },
          "operation_id": {
            "title": "Operation Id",
            "type": "string"
          },
          "relevance_score": {
            "title": "Relevance Score",
            "type": "number"
          },
          "type": {
            "const": "operation",
            "default": "operation",
            "title": "Type",
            "type": "string"
          },
          "url": {
            "title": "Url",
            "type": "string"
          }
        },
        "required": [
          "api",
          "operation_id",
          "method",
          "url",
          "relevance_score",
          "_links"
        ],
        "title": "OperationResultResponse",
        "type": "object"
      },
      "OperationSummaryLinksResponse": {
        "description": "Hypermedia links for an operation summary.",
        "properties": {
          "inspect": {
            "title": "Inspect",
            "type": "string"
          }
        },
        "required": [
          "inspect"
        ],
        "title": "OperationSummaryLinksResponse",
        "type": "object"
      },
      "OperationSummaryListResponse": {
        "description": "Cursor-paginated list of operations.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/OperationSummaryResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "OperationSummaryListResponse",
        "type": "object"
      },
      "OperationSummaryResponse": {
        "description": "Single operation in a paginated list.",
        "properties": {
          "_links": {
            "$ref": "#/components/schemas/OperationSummaryLinksResponse"
          },
          "api": {
            "$ref": "#/components/schemas/ApiReferenceResponse"
          },
          "deprecated": {
            "default": false,
            "title": "Deprecated",
            "type": "boolean"
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "method": {
            "title": "Method",
            "type": "string"
          },
          "name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Name"
          },
          "operation_id": {
            "title": "Operation Id",
            "type": "string"
          },
          "path": {
            "title": "Path",
            "type": "string"
          },
          "revision_id": {
            "title": "Revision Id",
            "type": "string"
          },
          "tags": {
            "items": {
              "type": "string"
            },
            "title": "Tags",
            "type": "array"
          }
        },
        "required": [
          "operation_id",
          "method",
          "path",
          "api",
          "revision_id",
          "_links"
        ],
        "title": "OperationSummaryResponse",
        "type": "object"
      },
      "OverlayConfirmRequest": {
        "additionalProperties": false,
        "description": "Payload for confirming an overlay.",
        "properties": {
          "execution_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Execution Id"
          }
        },
        "title": "OverlayConfirmRequest",
        "type": "object"
      },
      "OverlaySubmitRequest": {
        "additionalProperties": false,
        "description": "Payload for submitting a new overlay.",
        "properties": {
          "contributed_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Contributed By"
          },
          "document": {
            "additionalProperties": true,
            "title": "Document",
            "type": "object"
          },
          "target_revision_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Target Revision Id"
          }
        },
        "required": [
          "document"
        ],
        "title": "OverlaySubmitRequest",
        "type": "object"
      },
      "OverlayUpdateRequest": {
        "additionalProperties": false,
        "description": "Payload for updating an existing overlay.",
        "properties": {
          "document": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Document"
          },
          "target_revision_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Target Revision Id"
          }
        },
        "title": "OverlayUpdateRequest",
        "type": "object"
      },
      "PermissionListResponse": {
        "description": "List of available permissions.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/PermissionResponse"
            },
            "title": "Data",
            "type": "array"
          }
        },
        "required": [
          "data"
        ],
        "title": "PermissionListResponse",
        "type": "object"
      },
      "PermissionResponse": {
        "description": "A single permission entry from the catalogue.",
        "properties": {
          "description": {
            "title": "Description",
            "type": "string"
          },
          "grantable_by_caller": {
            "title": "Grantable By Caller",
            "type": "boolean"
          },
          "implies": {
            "items": {
              "type": "string"
            },
            "title": "Implies",
            "type": "array"
          },
          "name": {
            "title": "Name",
            "type": "string"
          }
        },
        "required": [
          "name",
          "description",
          "implies",
          "grantable_by_caller"
        ],
        "title": "PermissionResponse",
        "type": "object"
      },
      "PermissionRuleListResponse": {
        "description": "List of permission rules.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/PermissionRuleReadSchema"
            },
            "title": "Data",
            "type": "array"
          }
        },
        "required": [
          "data"
        ],
        "title": "PermissionRuleListResponse",
        "type": "object"
      },
      "PermissionRuleReadSchema": {
        "description": "Permission rule response (includes system fields).",
        "properties": {
          "_comment": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Comment"
          },
          "_system": {
            "default": false,
            "title": "System",
            "type": "boolean"
          },
          "effect": {
            "enum": [
              "allow",
              "deny"
            ],
            "title": "Effect",
            "type": "string"
          },
          "match_mode": {
            "default": "regex",
            "enum": [
              "regex",
              "prefix",
              "exact"
            ],
            "title": "Match Mode",
            "type": "string"
          },
          "methods": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Methods"
          },
          "operations": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Operations"
          },
          "path": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Path"
          }
        },
        "required": [
          "effect"
        ],
        "title": "PermissionRuleReadSchema",
        "type": "object"
      },
      "PermissionTestRequest": {
        "additionalProperties": false,
        "description": "Request body for :test — dry-run a request shape against pooled rules.",
        "properties": {
          "method": {
            "description": "HTTP method of the hypothetical request (case-insensitive).",
            "title": "Method",
            "type": "string"
          },
          "operation_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Optional OpenAPI operation id resolved from the request URL.",
            "title": "Operation Id"
          },
          "path": {
            "description": "Path of the hypothetical request as the broker would see it.",
            "title": "Path",
            "type": "string"
          }
        },
        "required": [
          "method",
          "path"
        ],
        "title": "PermissionTestRequest",
        "type": "object"
      },
      "PermissionTestResponse": {
        "description": "Dry-run result matching :class:`PermissionTestResult`.",
        "properties": {
          "allowed": {
            "description": "Whether the broker would allow this request under the pooled rules.",
            "title": "Allowed",
            "type": "boolean"
          },
          "credential_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Which binding contributed the matching rule — vendor pooling means this may not equal the credential in the request URL.",
            "title": "Credential Id"
          },
          "effect": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Effect of the matching rule (`allow`/`deny`); null when no match.",
            "title": "Effect"
          },
          "is_system": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "description": "True when the matching rule was written by the system; null when no match.",
            "title": "Is System"
          },
          "matched": {
            "description": "Whether any rule matched; when false, the outcome is default-deny.",
            "title": "Matched",
            "type": "boolean"
          },
          "rule_index": {
            "anyOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "description": "Zero-based index in the vendor-pooled rule list; null when no match.",
            "title": "Rule Index"
          }
        },
        "required": [
          "allowed",
          "matched"
        ],
        "title": "PermissionTestResponse",
        "type": "object"
      },
      "Permissions": {
        "description": "Structured permissions view: assigned + effective.",
        "properties": {
          "assigned": {
            "items": {
              "type": "string"
            },
            "title": "Assigned",
            "type": "array"
          },
          "effective": {
            "items": {
              "$ref": "#/components/schemas/EffectivePermission"
            },
            "title": "Effective",
            "type": "array"
          }
        },
        "required": [
          "assigned",
          "effective"
        ],
        "title": "Permissions",
        "type": "object"
      },
      "PermissionsPatchRequest": {
        "description": "Patch permission rules — add and/or remove.",
        "properties": {
          "add": {
            "anyOf": [
              {
                "items": {
                  "$ref": "#/components/schemas/jentic_one__control__web__schemas__toolkits__PermissionRuleSchema"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Add"
          },
          "remove": {
            "anyOf": [
              {
                "items": {
                  "type": "integer"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Remove"
          }
        },
        "title": "PermissionsPatchRequest",
        "type": "object"
      },
      "PreviewInfoResponse": {
        "description": "The `info` block fields surfaced in a preview.",
        "examples": [
          {
            "description": "Payments.",
            "title": "Stripe",
            "version": "2024-01-01"
          }
        ],
        "properties": {
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Spec description.",
            "title": "Description"
          },
          "title": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Spec title.",
            "title": "Title"
          },
          "version": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Spec version.",
            "title": "Version"
          }
        },
        "required": [
          "title",
          "version",
          "description"
        ],
        "title": "PreviewInfoResponse",
        "type": "object"
      },
      "PreviewOperationResponse": {
        "description": "A slimmed operation in a catalog spec preview.",
        "examples": [
          {
            "description": "",
            "method": "GET",
            "operation_id": "listCharges",
            "parameters": [],
            "path": "/v1/charges",
            "security": [
              "BearerAuth"
            ],
            "summary": "List charges",
            "tags": [
              "charges"
            ]
          }
        ],
        "properties": {
          "description": {
            "description": "Operation description (empty string when absent).",
            "title": "Description",
            "type": "string"
          },
          "method": {
            "description": "Upper-case HTTP method.",
            "title": "Method",
            "type": "string"
          },
          "operation_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "OpenAPI operationId, when declared.",
            "title": "Operation Id"
          },
          "parameters": {
            "description": "Merged path- and operation-level parameters.",
            "items": {
              "$ref": "#/components/schemas/PreviewParameterResponse"
            },
            "title": "Parameters",
            "type": "array"
          },
          "path": {
            "description": "Operation path template.",
            "title": "Path",
            "type": "string"
          },
          "security": {
            "description": "Flattened names of the security schemes that apply.",
            "items": {
              "type": "string"
            },
            "title": "Security",
            "type": "array"
          },
          "summary": {
            "description": "Operation summary (empty string when absent).",
            "title": "Summary",
            "type": "string"
          },
          "tags": {
            "description": "Operation tags.",
            "items": {
              "type": "string"
            },
            "title": "Tags",
            "type": "array"
          }
        },
        "required": [
          "method",
          "path",
          "summary",
          "description",
          "operation_id",
          "parameters",
          "security",
          "tags"
        ],
        "title": "PreviewOperationResponse",
        "type": "object"
      },
      "PreviewParameterResponse": {
        "description": "A slimmed parameter in an operation preview.",
        "examples": [
          {
            "description": "Page size.",
            "in": "query",
            "name": "limit",
            "required": false
          }
        ],
        "properties": {
          "description": {
            "description": "Parameter description (empty string when absent).",
            "title": "Description",
            "type": "string"
          },
          "in": {
            "description": "OpenAPI parameter location.",
            "title": "In",
            "type": "string"
          },
          "name": {
            "description": "Parameter name.",
            "title": "Name",
            "type": "string"
          },
          "required": {
            "description": "Whether the parameter is required.",
            "title": "Required",
            "type": "boolean"
          }
        },
        "required": [
          "name",
          "in",
          "required",
          "description"
        ],
        "title": "PreviewParameterResponse",
        "type": "object"
      },
      "ProblemDetail": {
        "description": "RFC 9457 Problem Details for HTTP APIs.\n\nThis is the standard error response format for all Jentic APIs.\nContent-Type: application/problem+json\n\nSee: https://www.rfc-editor.org/rfc/rfc9457.html",
        "examples": [
          {
            "detail": "The request body is missing one or more required fields.",
            "errors": [
              {
                "detail": "Field 'name' is required.",
                "pointer": "#/name"
              }
            ],
            "instance": "/v2/capability-sets",
            "status": 400,
            "title": "Bad Request",
            "type": "about:blank"
          }
        ],
        "properties": {
          "code": {
            "anyOf": [
              {
                "maxLength": 50,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "An optional provider-specific code for internal error taxonomy and observability correlation.",
            "examples": [
              "JENTIC-4001"
            ],
            "title": "Code"
          },
          "detail": {
            "description": "A human-readable explanation specific to this occurrence of the problem. MUST be present. Provide actionable information where possible.",
            "examples": [
              "The request body is missing required field 'name'."
            ],
            "maxLength": 4096,
            "title": "Detail",
            "type": "string"
          },
          "errors": {
            "anyOf": [
              {
                "items": {
                  "$ref": "#/components/schemas/ErrorItem"
                },
                "maxItems": 1000,
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "description": "An array of granular error details. Use when multiple validation errors or field-level problems need to be surfaced in a single response.",
            "title": "Errors"
          },
          "instance": {
            "anyOf": [
              {
                "maxLength": 1024,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "A URI reference identifying the specific occurrence of the problem. Typically the request path.",
            "examples": [
              "/v2/capability-sets"
            ],
            "title": "Instance"
          },
          "status": {
            "anyOf": [
              {
                "maximum": 599.0,
                "minimum": 100.0,
                "type": "integer"
              },
              {
                "type": "null"
              }
            ],
            "description": "The HTTP status code for this occurrence of the problem.",
            "examples": [
              400
            ],
            "title": "Status"
          },
          "title": {
            "anyOf": [
              {
                "maxLength": 1024,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "A short, human-readable summary of the problem type. Should not change between occurrences except for localisation purposes.",
            "examples": [
              "Bad Request"
            ],
            "title": "Title"
          },
          "type": {
            "default": "about:blank",
            "description": "A URI reference identifying the problem type. When set to 'about:blank', the title SHOULD be the standard HTTP status phrase. Use an IANA-registered type URI where one applies.",
            "examples": [
              "about:blank"
            ],
            "maxLength": 1024,
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "detail"
        ],
        "title": "ProblemDetail",
        "type": "object"
      },
      "ProviderConfigListResponse": {
        "description": "A list of stored provider configs (secrets redacted).",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ProviderConfigResponse"
            },
            "title": "Data",
            "type": "array"
          }
        },
        "required": [
          "data"
        ],
        "title": "ProviderConfigListResponse",
        "type": "object"
      },
      "ProviderConfigResponse": {
        "description": "A stored provider config with secret fields redacted.",
        "examples": [
          {
            "config": {
              "client_id": "client_abc123",
              "client_secret": "***",
              "environment": "production",
              "kind": "pipedream",
              "project_id": "proj_abc123"
            },
            "created_at": "2026-06-29T12:00:00Z",
            "name": "pipedream",
            "updated_at": "2026-06-29T12:00:00Z"
          }
        ],
        "properties": {
          "config": {
            "additionalProperties": true,
            "description": "Stored config with secret fields redacted.",
            "title": "Config",
            "type": "object"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "name": {
            "description": "Provider name (e.g. 'pipedream').",
            "title": "Name",
            "type": "string"
          },
          "updated_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Updated At"
          }
        },
        "required": [
          "name",
          "config",
          "created_at"
        ],
        "title": "ProviderConfigResponse",
        "type": "object"
      },
      "ProviderConfigSetRequest": {
        "description": "Request body for setting a provider config.\n\nFields are provider-specific and validated server-side by provider name.\nFor ``pipedream`` the recognised fields are ``project_id``, ``client_id``,\n``client_secret`` (write-only), and optional ``environment``,\n``connect_base_url``, ``expiry_skew_seconds``.",
        "examples": [
          {
            "client_id": "client_abc123",
            "client_secret": "<redacted>",
            "environment": "production",
            "project_id": "proj_abc123"
          }
        ],
        "properties": {
          "config": {
            "additionalProperties": true,
            "description": "Provider-specific configuration fields, validated by provider name.",
            "title": "Config",
            "type": "object"
          }
        },
        "required": [
          "config"
        ],
        "title": "ProviderConfigSetRequest",
        "type": "object"
      },
      "ProviderDiscoveryEntryResponse": {
        "description": "Discovery metadata for a single credential provider.",
        "properties": {
          "callback_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "OAuth2 redirect URI for providers that require it.",
            "title": "Callback Url"
          },
          "configured": {
            "description": "Whether the provider is fully configured and operational.",
            "title": "Configured",
            "type": "boolean"
          },
          "id": {
            "description": "Provider identifier (registry key).",
            "title": "Id",
            "type": "string"
          },
          "label": {
            "description": "Human-readable provider name.",
            "title": "Label",
            "type": "string"
          },
          "managed": {
            "description": "Whether the provider handles vendor sign-in on behalf of the user.",
            "title": "Managed",
            "type": "boolean"
          },
          "types": {
            "description": "Wire-level credential types this provider supports.",
            "items": {
              "$ref": "#/components/schemas/CredentialType"
            },
            "title": "Types",
            "type": "array"
          }
        },
        "required": [
          "id",
          "label",
          "managed",
          "types",
          "configured"
        ],
        "title": "ProviderDiscoveryEntryResponse",
        "type": "object"
      },
      "ProviderDiscoveryResponse": {
        "description": "Discovery response listing all available credential providers.",
        "properties": {
          "providers": {
            "items": {
              "$ref": "#/components/schemas/ProviderDiscoveryEntryResponse"
            },
            "title": "Providers",
            "type": "array"
          }
        },
        "required": [
          "providers"
        ],
        "title": "ProviderDiscoveryResponse",
        "type": "object"
      },
      "RedeemInviteRequest": {
        "description": "Payload for redeeming an invite token.",
        "properties": {
          "invite_token": {
            "maxLength": 512,
            "minLength": 1,
            "title": "Invite Token",
            "type": "string"
          },
          "password": {
            "maxLength": 128,
            "minLength": 12,
            "title": "Password",
            "type": "string"
          }
        },
        "required": [
          "invite_token",
          "password"
        ],
        "title": "RedeemInviteRequest",
        "type": "object"
      },
      "RegisterRequest": {
        "description": "POST /register request body.",
        "properties": {
          "client_name": {
            "maxLength": 255,
            "minLength": 1,
            "title": "Client Name",
            "type": "string"
          },
          "grant_types": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Grant Types"
          },
          "jwks": {
            "additionalProperties": true,
            "title": "Jwks",
            "type": "object"
          },
          "scope": {
            "anyOf": [
              {
                "maxLength": 6500,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Scope"
          },
          "token_endpoint_auth_method": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Token Endpoint Auth Method"
          }
        },
        "required": [
          "client_name",
          "jwks"
        ],
        "title": "RegisterRequest",
        "type": "object"
      },
      "RegisterResponse": {
        "description": "POST /register 201 response.",
        "properties": {
          "client_id": {
            "title": "Client Id",
            "type": "string"
          },
          "grant_types": {
            "default": [
              "urn:ietf:params:oauth:grant-type:jwt-bearer"
            ],
            "items": {
              "type": "string"
            },
            "title": "Grant Types",
            "type": "array"
          },
          "registration_access_token": {
            "title": "Registration Access Token",
            "type": "string"
          },
          "registration_client_uri": {
            "title": "Registration Client Uri",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "token_endpoint_auth_method": {
            "default": "private_key_jwt",
            "title": "Token Endpoint Auth Method",
            "type": "string"
          }
        },
        "required": [
          "client_id",
          "registration_access_token",
          "registration_client_uri",
          "status"
        ],
        "title": "RegisterResponse",
        "type": "object"
      },
      "RegistrationStatusResponse": {
        "description": "GET /register/{agent_id} response.",
        "properties": {
          "client_id": {
            "title": "Client Id",
            "type": "string"
          },
          "grant_types": {
            "default": [
              "urn:ietf:params:oauth:grant-type:jwt-bearer"
            ],
            "items": {
              "type": "string"
            },
            "title": "Grant Types",
            "type": "array"
          },
          "status": {
            "title": "Status",
            "type": "string"
          },
          "token_endpoint_auth_method": {
            "default": "private_key_jwt",
            "title": "Token Endpoint Auth Method",
            "type": "string"
          }
        },
        "required": [
          "client_id",
          "status"
        ],
        "title": "RegistrationStatusResponse",
        "type": "object"
      },
      "RevokeRequest": {
        "description": "Revocation endpoint request (form body).",
        "properties": {
          "token": {
            "title": "Token",
            "type": "string"
          },
          "token_type_hint": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Token Type Hint"
          }
        },
        "required": [
          "token"
        ],
        "title": "RevokeRequest",
        "type": "object"
      },
      "RuntimeConfig": {
        "description": "Optional per-upstream-call overrides.",
        "properties": {
          "headers": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Headers"
          },
          "query_params": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Query Params"
          }
        },
        "title": "RuntimeConfig",
        "type": "object"
      },
      "SearchLinksResponse": {
        "description": "Hypermedia links for a search result row.",
        "properties": {
          "inspect": {
            "title": "Inspect",
            "type": "string"
          }
        },
        "required": [
          "inspect"
        ],
        "title": "SearchLinksResponse",
        "type": "object"
      },
      "SearchRequest": {
        "additionalProperties": false,
        "description": "POST /search request body.",
        "properties": {
          "apis": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Apis"
          },
          "cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Cursor"
          },
          "limit": {
            "default": 10,
            "maximum": 100.0,
            "minimum": 1.0,
            "title": "Limit",
            "type": "integer"
          },
          "query": {
            "minLength": 1,
            "title": "Query",
            "type": "string"
          },
          "revision_pins": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Revision Pins"
          }
        },
        "required": [
          "query"
        ],
        "title": "SearchRequest",
        "type": "object"
      },
      "SearchResponse": {
        "description": "Cursor-paginated search results page.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/OperationResultResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "SearchResponse",
        "type": "object"
      },
      "SecuritySchemeFlowResponse": {
        "description": "A single OAuth2 flow within a security scheme.",
        "properties": {
          "authorization_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Authorization Url"
          },
          "flow_type": {
            "title": "Flow Type",
            "type": "string"
          },
          "refresh_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Refresh Url"
          },
          "scopes": {
            "anyOf": [
              {
                "additionalProperties": {
                  "type": "string"
                },
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Scopes"
          },
          "token_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Token Url"
          }
        },
        "required": [
          "flow_type"
        ],
        "title": "SecuritySchemeFlowResponse",
        "type": "object"
      },
      "SecuritySchemeListResponse": {
        "description": "List of security schemes for an API's current revision.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/SecuritySchemeResponse"
            },
            "title": "Data",
            "type": "array"
          }
        },
        "required": [
          "data"
        ],
        "title": "SecuritySchemeListResponse",
        "type": "object"
      },
      "SecuritySchemeResponse": {
        "description": "Full security scheme detail for a revision.",
        "properties": {
          "bearer_format": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Bearer Format"
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "flows": {
            "items": {
              "$ref": "#/components/schemas/SecuritySchemeFlowResponse"
            },
            "title": "Flows",
            "type": "array"
          },
          "in_location": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "In Location"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "open_id_connect_url": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Open Id Connect Url"
          },
          "param_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Param Name"
          },
          "scheme": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Scheme"
          },
          "type": {
            "title": "Type",
            "type": "string"
          }
        },
        "required": [
          "name",
          "type"
        ],
        "title": "SecuritySchemeResponse",
        "type": "object"
      },
      "ServedApiRef": {
        "description": "An API served by a toolkit's bound credential, keyed by its stored identity.\n\nDistinct from ``APIReference`` on purpose: this carries the *stored* credential\nidentity, where ``api_name``/``api_version`` may be NULL (the \"covers all\nnames/versions\" wildcard, #775) — so they're optional here, unlike the strict\nall-required ``APIReference``. Shared so the auth service schema and the\n``/me`` web schema use ONE model instead of two identical copies.",
        "properties": {
          "api_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Name"
          },
          "api_vendor": {
            "title": "Api Vendor",
            "type": "string"
          },
          "api_version": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Version"
          }
        },
        "required": [
          "api_vendor"
        ],
        "title": "ServedApiRef",
        "type": "object"
      },
      "ServiceAccountCreateRequest": {
        "description": "Request body for creating a service account.",
        "properties": {
          "description": {
            "anyOf": [
              {
                "maxLength": 1024,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "name": {
            "maxLength": 255,
            "minLength": 1,
            "title": "Name",
            "type": "string"
          },
          "scopes": {
            "anyOf": [
              {
                "items": {
                  "maxLength": 64,
                  "minLength": 1,
                  "pattern": "^[a-zA-Z0-9_:./-]+$",
                  "type": "string"
                },
                "maxItems": 100,
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Scopes"
          }
        },
        "required": [
          "name"
        ],
        "title": "ServiceAccountCreateRequest",
        "type": "object"
      },
      "ServiceAccountListResponse": {
        "description": "List of service accounts.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ServiceAccountResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "ServiceAccountListResponse",
        "type": "object"
      },
      "ServiceAccountResponse": {
        "description": "ServiceAccount representation in API responses.",
        "properties": {
          "approved_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Approved At"
          },
          "approved_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Approved By"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "denial_reason": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Denial Reason"
          },
          "denied_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Denied By"
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "owner_id": {
            "title": "Owner Id",
            "type": "string"
          },
          "registered_by": {
            "title": "Registered By",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          }
        },
        "required": [
          "id",
          "name",
          "owner_id",
          "registered_by",
          "status",
          "created_at"
        ],
        "title": "ServiceAccountResponse",
        "type": "object"
      },
      "ServiceAccountScopesRequest": {
        "description": "Request body for replacing a service account's scopes.",
        "properties": {
          "scopes": {
            "items": {
              "maxLength": 64,
              "minLength": 1,
              "pattern": "^[a-zA-Z0-9_:./-]+$",
              "type": "string"
            },
            "maxItems": 100,
            "title": "Scopes",
            "type": "array"
          }
        },
        "required": [
          "scopes"
        ],
        "title": "ServiceAccountScopesRequest",
        "type": "object"
      },
      "ServiceAccountScopesResponse": {
        "description": "Response containing a service account's current scopes.",
        "properties": {
          "scopes": {
            "items": {
              "type": "string"
            },
            "title": "Scopes",
            "type": "array"
          }
        },
        "required": [
          "scopes"
        ],
        "title": "ServiceAccountScopesResponse",
        "type": "object"
      },
      "SetPermissionsRequest": {
        "description": "Request body for setting user permissions.",
        "properties": {
          "permissions": {
            "items": {
              "type": "string"
            },
            "maxItems": 50,
            "title": "Permissions",
            "type": "array"
          }
        },
        "required": [
          "permissions"
        ],
        "title": "SetPermissionsRequest",
        "type": "object"
      },
      "TokenRequest": {
        "description": "Token endpoint request (JSON body — not RFC 6749 form-encoded).",
        "properties": {
          "assertion": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Assertion"
          },
          "client_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Client Id"
          },
          "client_secret": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Client Secret"
          },
          "code": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Code"
          },
          "code_verifier": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Code Verifier"
          },
          "grant_type": {
            "title": "Grant Type",
            "type": "string"
          },
          "redirect_uri": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Redirect Uri"
          },
          "refresh_token": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Refresh Token"
          }
        },
        "required": [
          "grant_type"
        ],
        "title": "TokenRequest",
        "type": "object"
      },
      "TokenResponse": {
        "description": "Token endpoint success response.",
        "properties": {
          "access_token": {
            "title": "Access Token",
            "type": "string"
          },
          "expires_in": {
            "title": "Expires In",
            "type": "integer"
          },
          "id_token": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Id Token"
          },
          "refresh_token": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Refresh Token"
          },
          "token_type": {
            "default": "bearer",
            "title": "Token Type",
            "type": "string"
          }
        },
        "required": [
          "access_token",
          "expires_in"
        ],
        "title": "TokenResponse",
        "type": "object"
      },
      "ToolkitAgentListResponse": {
        "description": "Paginated list of agents bound to a toolkit.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ToolkitAgentResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "ToolkitAgentListResponse",
        "type": "object"
      },
      "ToolkitAgentResponse": {
        "description": "Agent bound to a toolkit.",
        "properties": {
          "agent_id": {
            "title": "Agent Id",
            "type": "string"
          },
          "agent_name": {
            "title": "Agent Name",
            "type": "string"
          },
          "bound_at": {
            "format": "date-time",
            "title": "Bound At",
            "type": "string"
          },
          "status": {
            "title": "Status",
            "type": "string"
          }
        },
        "required": [
          "agent_id",
          "agent_name",
          "status",
          "bound_at"
        ],
        "title": "ToolkitAgentResponse",
        "type": "object"
      },
      "ToolkitBindRequest": {
        "description": "Request body for binding a toolkit.",
        "properties": {
          "toolkit_id": {
            "maxLength": 255,
            "minLength": 1,
            "title": "Toolkit Id",
            "type": "string"
          }
        },
        "required": [
          "toolkit_id"
        ],
        "title": "ToolkitBindRequest",
        "type": "object"
      },
      "ToolkitBindingEntry": {
        "description": "Toolkit binding summary for the /me response.",
        "properties": {
          "bound_at": {
            "format": "date-time",
            "title": "Bound At",
            "type": "string"
          },
          "name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Name"
          },
          "serves": {
            "default": [],
            "items": {
              "$ref": "#/components/schemas/ServedApiRef"
            },
            "title": "Serves",
            "type": "array"
          },
          "toolkit_id": {
            "title": "Toolkit Id",
            "type": "string"
          }
        },
        "required": [
          "toolkit_id",
          "bound_at"
        ],
        "title": "ToolkitBindingEntry",
        "type": "object"
      },
      "ToolkitBindingListResponse": {
        "description": "List of toolkit bindings.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ToolkitBindingResponse"
            },
            "title": "Data",
            "type": "array"
          }
        },
        "required": [
          "data"
        ],
        "title": "ToolkitBindingListResponse",
        "type": "object"
      },
      "ToolkitBindingResponse": {
        "description": "Toolkit binding representation in API responses.",
        "properties": {
          "agent_id": {
            "title": "Agent Id",
            "type": "string"
          },
          "bound_at": {
            "format": "date-time",
            "title": "Bound At",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "toolkit_id": {
            "title": "Toolkit Id",
            "type": "string"
          }
        },
        "required": [
          "id",
          "agent_id",
          "toolkit_id",
          "bound_at"
        ],
        "title": "ToolkitBindingResponse",
        "type": "object"
      },
      "ToolkitCreateRequest": {
        "description": "Create a new toolkit.",
        "properties": {
          "active": {
            "default": true,
            "title": "Active",
            "type": "boolean"
          },
          "credential_ids": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Credential Ids"
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "name": {
            "maxLength": 255,
            "title": "Name",
            "type": "string"
          }
        },
        "required": [
          "name"
        ],
        "title": "ToolkitCreateRequest",
        "type": "object"
      },
      "ToolkitCreateResponse": {
        "description": "Create response: toolkit + api_key shown once.",
        "properties": {
          "api_key": {
            "title": "Api Key",
            "type": "string"
          },
          "toolkit": {
            "$ref": "#/components/schemas/ToolkitResponse"
          },
          "warnings": {
            "description": "Non-fatal signals about the create — e.g. inline-bound credentials that landed with zero permission rules (broker denies by default).",
            "items": {
              "$ref": "#/components/schemas/BindingWarningSchema"
            },
            "title": "Warnings",
            "type": "array"
          }
        },
        "required": [
          "toolkit",
          "api_key"
        ],
        "title": "ToolkitCreateResponse",
        "type": "object"
      },
      "ToolkitCredentialBindRequest": {
        "additionalProperties": false,
        "description": "Bind a credential to a toolkit.",
        "properties": {
          "allow_all": {
            "default": false,
            "description": "Convenience flag: bind with a single `allow` rule that matches every request for this binding's vendor. Mutually exclusive with `permissions`.",
            "title": "Allow All",
            "type": "boolean"
          },
          "credential_id": {
            "title": "Credential Id",
            "type": "string"
          },
          "permissions": {
            "anyOf": [
              {
                "items": {
                  "$ref": "#/components/schemas/jentic_one__control__web__schemas__toolkits__PermissionRuleSchema"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Permissions"
          }
        },
        "required": [
          "credential_id"
        ],
        "title": "ToolkitCredentialBindRequest",
        "type": "object"
      },
      "ToolkitCredentialBindingResponse": {
        "description": "Credential binding response.",
        "properties": {
          "api_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Name"
          },
          "api_vendor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Api Vendor"
          },
          "bound_at": {
            "format": "date-time",
            "title": "Bound At",
            "type": "string"
          },
          "catalog_api_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Catalog identity slug of the bound credential's target API (`domain[/sub-api]`), when recorded. Display-only.",
            "title": "Catalog Api Id"
          },
          "credential_id": {
            "title": "Credential Id",
            "type": "string"
          },
          "credential_type": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Credential Type"
          },
          "label": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Label"
          },
          "permissions": {
            "items": {
              "$ref": "#/components/schemas/PermissionRuleReadSchema"
            },
            "title": "Permissions",
            "type": "array"
          },
          "toolkit_id": {
            "title": "Toolkit Id",
            "type": "string"
          },
          "warnings": {
            "description": "Non-fatal bind-time signals — e.g. a binding that landed with zero permission rules (broker denies by default until rules are added).",
            "items": {
              "$ref": "#/components/schemas/BindingWarningSchema"
            },
            "title": "Warnings",
            "type": "array"
          }
        },
        "required": [
          "toolkit_id",
          "credential_id",
          "bound_at"
        ],
        "title": "ToolkitCredentialBindingResponse",
        "type": "object"
      },
      "ToolkitCredentialListResponse": {
        "description": "Paginated list of credential bindings.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ToolkitCredentialBindingResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "ToolkitCredentialListResponse",
        "type": "object"
      },
      "ToolkitKeyCreateRequest": {
        "description": "Create a new key for a toolkit.",
        "properties": {
          "allowed_ips": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Allowed Ips"
          },
          "label": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Label"
          }
        },
        "title": "ToolkitKeyCreateRequest",
        "type": "object"
      },
      "ToolkitKeyCreateResponse": {
        "description": "Create response: key + plaintext shown once.",
        "properties": {
          "api_key": {
            "title": "Api Key",
            "type": "string"
          },
          "key": {
            "$ref": "#/components/schemas/ToolkitKeyResponse"
          }
        },
        "required": [
          "key",
          "api_key"
        ],
        "title": "ToolkitKeyCreateResponse",
        "type": "object"
      },
      "ToolkitKeyListResponse": {
        "description": "Paginated list of toolkit keys.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ToolkitKeyResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "ToolkitKeyListResponse",
        "type": "object"
      },
      "ToolkitKeyResponse": {
        "description": "Toolkit key response.",
        "properties": {
          "allowed_ips": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Allowed Ips"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "key_id": {
            "title": "Key Id",
            "type": "string"
          },
          "key_preview": {
            "title": "Key Preview",
            "type": "string"
          },
          "label": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Label"
          },
          "last_used_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Last Used At"
          },
          "revoked": {
            "title": "Revoked",
            "type": "boolean"
          },
          "toolkit_id": {
            "title": "Toolkit Id",
            "type": "string"
          }
        },
        "required": [
          "key_id",
          "toolkit_id",
          "revoked",
          "created_at",
          "key_preview"
        ],
        "title": "ToolkitKeyResponse",
        "type": "object"
      },
      "ToolkitKeyUpdateRequest": {
        "description": "Update a toolkit key.",
        "properties": {
          "allowed_ips": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Allowed Ips"
          },
          "label": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Label"
          },
          "revoked": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Revoked"
          }
        },
        "title": "ToolkitKeyUpdateRequest",
        "type": "object"
      },
      "ToolkitListResponse": {
        "description": "Paginated list of toolkits.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/ToolkitResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "ToolkitListResponse",
        "type": "object"
      },
      "ToolkitResponse": {
        "description": "Toolkit response.",
        "properties": {
          "active": {
            "title": "Active",
            "type": "boolean"
          },
          "apis": {
            "description": "Distinct APIs served by this toolkit's credential bindings that are visible to the caller, sorted by vendor/name/version. NULL api_name/api_version mean the credential covers all names/versions for the vendor. Empty when no visible credentials are bound.",
            "items": {
              "$ref": "#/components/schemas/ServedApiRef"
            },
            "title": "Apis",
            "type": "array"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "created_by": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Created By"
          },
          "credential_count": {
            "title": "Credential Count",
            "type": "integer"
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "key_count": {
            "title": "Key Count",
            "type": "integer"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "toolkit_id": {
            "title": "Toolkit Id",
            "type": "string"
          },
          "updated_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Updated At"
          }
        },
        "required": [
          "toolkit_id",
          "name",
          "active",
          "key_count",
          "credential_count",
          "created_at"
        ],
        "title": "ToolkitResponse",
        "type": "object"
      },
      "ToolkitUpdateRequest": {
        "description": "Update a toolkit.",
        "properties": {
          "active": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Active"
          },
          "description": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Description"
          },
          "name": {
            "anyOf": [
              {
                "maxLength": 255,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Name"
          }
        },
        "title": "ToolkitUpdateRequest",
        "type": "object"
      },
      "TopOperation": {
        "description": "Aggregated execution counts for a single operation.",
        "properties": {
          "api_name": {
            "title": "Api Name",
            "type": "string"
          },
          "api_vendor": {
            "title": "Api Vendor",
            "type": "string"
          },
          "failed": {
            "title": "Failed",
            "type": "integer"
          },
          "operation_id": {
            "title": "Operation Id",
            "type": "string"
          },
          "total": {
            "title": "Total",
            "type": "integer"
          }
        },
        "required": [
          "api_vendor",
          "api_name",
          "operation_id",
          "total",
          "failed"
        ],
        "title": "TopOperation",
        "type": "object"
      },
      "UsageBucket": {
        "description": "Execution counts for a single time bucket.",
        "properties": {
          "avg_ms": {
            "title": "Avg Ms",
            "type": "number"
          },
          "failed": {
            "title": "Failed",
            "type": "integer"
          },
          "success": {
            "title": "Success",
            "type": "integer"
          },
          "total": {
            "title": "Total",
            "type": "integer"
          },
          "ts": {
            "title": "Ts",
            "type": "integer"
          }
        },
        "required": [
          "ts",
          "total",
          "success",
          "failed",
          "avg_ms"
        ],
        "title": "UsageBucket",
        "type": "object"
      },
      "UsageResponse": {
        "description": "Full usage statistics response.",
        "properties": {
          "bucket_seconds": {
            "title": "Bucket Seconds",
            "type": "integer"
          },
          "buckets": {
            "items": {
              "$ref": "#/components/schemas/UsageBucket"
            },
            "title": "Buckets",
            "type": "array"
          },
          "group_by": {
            "title": "Group By",
            "type": "string"
          },
          "since": {
            "title": "Since",
            "type": "integer"
          },
          "stats": {
            "$ref": "#/components/schemas/UsageStatsBlock"
          },
          "top": {
            "items": {
              "$ref": "#/components/schemas/UsageTopRow"
            },
            "title": "Top",
            "type": "array"
          },
          "until": {
            "title": "Until",
            "type": "integer"
          }
        },
        "required": [
          "since",
          "until",
          "bucket_seconds",
          "group_by",
          "stats",
          "buckets",
          "top"
        ],
        "title": "UsageResponse",
        "type": "object"
      },
      "UsageStatsBlock": {
        "description": "Overall usage statistics for a time window.",
        "properties": {
          "active_now": {
            "title": "Active Now",
            "type": "integer"
          },
          "avg_ms": {
            "title": "Avg Ms",
            "type": "number"
          },
          "failed": {
            "title": "Failed",
            "type": "integer"
          },
          "p50_ms": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "P50 Ms"
          },
          "p95_ms": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "P95 Ms"
          },
          "pending": {
            "title": "Pending",
            "type": "integer"
          },
          "success": {
            "title": "Success",
            "type": "integer"
          },
          "total": {
            "title": "Total",
            "type": "integer"
          }
        },
        "required": [
          "total",
          "success",
          "failed",
          "pending",
          "avg_ms",
          "p50_ms",
          "p95_ms",
          "active_now"
        ],
        "title": "UsageStatsBlock",
        "type": "object"
      },
      "UsageTopRow": {
        "description": "Top entity row with sparkline trend.",
        "properties": {
          "avg_ms": {
            "title": "Avg Ms",
            "type": "number"
          },
          "failed": {
            "title": "Failed",
            "type": "integer"
          },
          "key": {
            "title": "Key",
            "type": "string"
          },
          "label": {
            "title": "Label",
            "type": "string"
          },
          "success": {
            "title": "Success",
            "type": "integer"
          },
          "total": {
            "title": "Total",
            "type": "integer"
          },
          "trend": {
            "items": {
              "type": "integer"
            },
            "title": "Trend",
            "type": "array"
          }
        },
        "required": [
          "key",
          "label",
          "total",
          "success",
          "failed",
          "avg_ms",
          "trend"
        ],
        "title": "UsageTopRow",
        "type": "object"
      },
      "UserCreateRequest": {
        "description": "Request body for creating a new user.",
        "properties": {
          "email": {
            "maxLength": 320,
            "minLength": 1,
            "title": "Email",
            "type": "string"
          },
          "first_name": {
            "maxLength": 255,
            "minLength": 1,
            "title": "First Name",
            "type": "string"
          },
          "last_name": {
            "maxLength": 255,
            "minLength": 1,
            "title": "Last Name",
            "type": "string"
          },
          "permissions": {
            "default": [],
            "items": {
              "type": "string"
            },
            "title": "Permissions",
            "type": "array"
          }
        },
        "required": [
          "email",
          "first_name",
          "last_name"
        ],
        "title": "UserCreateRequest",
        "type": "object"
      },
      "UserCreatedResponse": {
        "description": "Response after user creation including invite token.",
        "properties": {
          "invite_expires_at": {
            "format": "date-time",
            "title": "Invite Expires At",
            "type": "string"
          },
          "invite_token": {
            "title": "Invite Token",
            "type": "string"
          },
          "user": {
            "$ref": "#/components/schemas/UserResponse"
          }
        },
        "required": [
          "user",
          "invite_token",
          "invite_expires_at"
        ],
        "title": "UserCreatedResponse",
        "type": "object"
      },
      "UserListResponse": {
        "description": "Paginated list of users.",
        "properties": {
          "data": {
            "items": {
              "$ref": "#/components/schemas/UserResponse"
            },
            "title": "Data",
            "type": "array"
          },
          "has_more": {
            "title": "Has More",
            "type": "boolean"
          },
          "next_cursor": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Next Cursor"
          }
        },
        "required": [
          "data",
          "has_more"
        ],
        "title": "UserListResponse",
        "type": "object"
      },
      "UserResponse": {
        "description": "User representation in API responses.",
        "properties": {
          "active": {
            "title": "Active",
            "type": "boolean"
          },
          "auth_provider": {
            "title": "Auth Provider",
            "type": "string"
          },
          "created_at": {
            "format": "date-time",
            "title": "Created At",
            "type": "string"
          },
          "email": {
            "title": "Email",
            "type": "string"
          },
          "external_subject_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "External Subject Id"
          },
          "first_name": {
            "title": "First Name",
            "type": "string"
          },
          "id": {
            "title": "Id",
            "type": "string"
          },
          "invite_state": {
            "title": "Invite State",
            "type": "string"
          },
          "last_name": {
            "title": "Last Name",
            "type": "string"
          },
          "must_change_password": {
            "title": "Must Change Password",
            "type": "boolean"
          },
          "name": {
            "title": "Name",
            "type": "string"
          },
          "permissions": {
            "$ref": "#/components/schemas/Permissions"
          },
          "updated_at": {
            "anyOf": [
              {
                "format": "date-time",
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Updated At"
          }
        },
        "required": [
          "id",
          "email",
          "first_name",
          "last_name",
          "name",
          "active",
          "auth_provider",
          "invite_state",
          "must_change_password",
          "permissions",
          "created_at"
        ],
        "title": "UserResponse",
        "type": "object"
      },
      "UserUpdateRequest": {
        "description": "Request body for updating a user.",
        "properties": {
          "email": {
            "anyOf": [
              {
                "maxLength": 320,
                "minLength": 1,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Email"
          },
          "first_name": {
            "anyOf": [
              {
                "maxLength": 255,
                "minLength": 1,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "First Name"
          },
          "last_name": {
            "anyOf": [
              {
                "maxLength": 255,
                "minLength": 1,
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Last Name"
          }
        },
        "title": "UserUpdateRequest",
        "type": "object"
      },
      "jentic_one__auth__web__schemas__agents__DenyRequest": {
        "description": "Request body for denying an agent.",
        "properties": {
          "reason": {
            "maxLength": 1024,
            "minLength": 1,
            "title": "Reason",
            "type": "string"
          }
        },
        "required": [
          "reason"
        ],
        "title": "DenyRequest",
        "type": "object"
      },
      "jentic_one__auth__web__schemas__service_accounts__DenyRequest": {
        "description": "Request body for denying a service account.",
        "properties": {
          "reason": {
            "maxLength": 1024,
            "minLength": 1,
            "title": "Reason",
            "type": "string"
          }
        },
        "required": [
          "reason"
        ],
        "title": "DenyRequest",
        "type": "object"
      },
      "jentic_one__control__web__schemas__access_requests__PermissionRuleSchema": {
        "additionalProperties": false,
        "description": "Permission rule for an access request item.",
        "properties": {
          "effect": {
            "enum": [
              "allow",
              "deny",
              "require-approval"
            ],
            "title": "Effect",
            "type": "string"
          },
          "match_mode": {
            "default": "regex",
            "description": "How `path` is interpreted: `regex` (full-match), `prefix` (string prefix), or `exact` (equality). Defaults to `regex` for backwards compatibility.",
            "enum": [
              "regex",
              "prefix",
              "exact"
            ],
            "title": "Match Mode",
            "type": "string"
          },
          "methods": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "description": "HTTP methods to match (case-insensitive). None matches all.",
            "title": "Methods"
          },
          "operations": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "description": "OpenAPI operation IDs to match. None matches all operations.",
            "title": "Operations"
          },
          "path": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Path pattern to match. Interpreted per `match_mode`: `regex` uses full-match semantics (the pattern must describe the whole path); `prefix` and `exact` are literal. None matches all paths.",
            "title": "Path"
          }
        },
        "required": [
          "effect"
        ],
        "title": "PermissionRuleSchema",
        "type": "object"
      },
      "jentic_one__control__web__schemas__toolkits__PermissionRuleSchema": {
        "additionalProperties": false,
        "description": "Permission rule for a toolkit-credential binding.\n\nRules are evaluated first-match-wins. If no rule matches, the request is\ndenied (default-deny). A binding with zero rules therefore blocks all\noperations — users must explicitly add at least one allow rule.",
        "properties": {
          "effect": {
            "description": "Whether this rule allows or denies the matched request.",
            "enum": [
              "allow",
              "deny"
            ],
            "title": "Effect",
            "type": "string"
          },
          "match_mode": {
            "default": "regex",
            "description": "How `path` is interpreted: `regex` (full-match), `prefix` (string prefix), or `exact` (equality). Defaults to `regex` for backwards compatibility.",
            "enum": [
              "regex",
              "prefix",
              "exact"
            ],
            "title": "Match Mode",
            "type": "string"
          },
          "methods": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "description": "HTTP methods to match (case-insensitive). None matches all.",
            "title": "Methods"
          },
          "operations": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "description": "OpenAPI operation IDs to match. None matches all operations.",
            "title": "Operations"
          },
          "path": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "description": "Path pattern to match. Interpreted per `match_mode`: `regex` uses full-match semantics (the pattern must describe the whole path); `prefix` and `exact` are literal. None matches all paths.",
            "title": "Path"
          }
        },
        "required": [
          "effect"
        ],
        "title": "PermissionRuleSchema",
        "type": "object"
      }
    },
    "securitySchemes": {
      "BearerAuth": {
        "description": "Opaque bearer access token (prefixed `at_`), sent as `Authorization: Bearer <token>`. It is **not** a JWT — it is a random string validated server-side by lookup, so it cannot be decoded by the client.\n\nObtain one from `POST /oauth/token` using the grant for your actor type:\n- **Agents** — `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer` with a JWT assertion signed by the key registered via `POST /register` (the JWT is the *assertion*, not the resulting access token).\n- **Service accounts** — `grant_type=client_credentials` with `client_id` + `client_secret`.\n- **Users** — `grant_type=authorization_code` (interactive) or `grant_type=password`; refresh either with `grant_type=refresh_token`.\n\nService accounts can also mint short-lived, scope-narrowed task tokens for agents via `POST /oauth/mint`.\n\nPer-endpoint scope and actor-type requirements are not modelled in this document (OpenAPI cannot faithfully express the OR-of-scopes / `org:admin` bypass / service-layer enforcement); see `GET /reference/endpoints.json` for the authoritative authorization reference.",
        "scheme": "bearer",
        "type": "http"
      }
    }
  },
  "info": {
    "contact": {
      "email": "support@jentic.com",
      "name": "Jentic Platform Team",
      "url": "https://jentic.com/"
    },
    "description": "## Overview ##\nThe **Jentic Control Plane API** is the unified HTTP surface of the\nJentic platform's control plane — every administrative and\nmetadata-facing endpoint outside the Broker data plane.\n\nThe control plane is the administrative counterpart to the\n[Broker](../broker/swagger) data plane: where the Broker executes\nupstream API calls on behalf of agents, the control plane is where\nhumans, operators, and agents configure *what* the Broker is\nallowed to do, *for whom*, *with which credentials*, *against\nwhich registered APIs*, and *with what telemetry retained*.\n\n## Components ##\nHigh-level components for the control plane API.\n- **[Core / Access](#tag/Credentials)** — credentials, toolkits,\n  and PBAC grants and runtime params. Owns *who can call what, with which secret*.\n- **[Registry](#tag/APIs)** — registered APIs, immutable\n  revisions, operations, search, lookup. Owns *what APIs are\n  registered for this deployment and what they look like at any\n  given revision*.\n- **[Admin / Audit](#tag/Users)** — users, permissions,\n  execution telemetry, async-job tracker, and dashboard event\n  stream. Owns *who can sign in with what permissions* together\n  with *what actually happened* — the human roster, the\n  append-only records of brokered executions, the unified\n  `Job` resource that both Registry imports and Broker\n  async-execution calls feed into, and a curated `/events`\n  surface for dashboards and operators.\n\n## Authentication ##\n\nToday the platform ships a local username + password identity\nprovider for human users, alongside agent identity (Dynamic Client\nRegistration + RFC 7523 JWT-bearer assertions) and service-account\nclient credentials — every authenticated operation expects\n`Authorization: Bearer <token>` (`BearerAuth`, an opaque `at_`\ntoken) except `GET /health`, `POST /auth/login`,\n`POST /users:create-admin`, and `POST /users:redeem-invite`.\nHuman tokens are issued by `POST /auth/login` with a fixed 1-hour\nTTL and can be re-minted before expiry via `POST /auth/refresh`\n(sliding session, bounded by an absolute window —\n`admin.auth.session_ttl_seconds`, 12 hours by default); agents and\nservice accounts obtain tokens from `POST /oauth/token` (see\n`BearerAuth`). The `permissions` claim on a token is a snapshot at\nissue time; permission changes take effect at the next re-issue —\nthe next refresh or re-login (≤ 1 hour with the default TTL).\n\nThe platform ships **no default credentials**. On a fresh\ninstall the users table is empty, so `GET /health` returns\n`setup_required: true` with `next_step: create_admin`. The\noperator creates the first administrator with `POST\n/users:create-admin {email, password}` — a one-time,\nunauthenticated, self-closing endpoint: it succeeds only while\nthe users table is empty and returns `410 setup_already_complete`\nonce any user exists (a single-row setup sentinel is the\nconcurrency backstop, so two racing callers — even with different\nemails — cannot both bootstrap). It grants `org:admin`, sets the operator's chosen\npassword (so `must_change_password` is **false** — no forced\nrotation), and returns a ready-to-use `LoginResponse`\n(auto-login). After the first user exists `setup_required` flips\nto `false`. See the **Users** tag for the full onboarding\nwalkthrough.\n\nExternal SSO providers (Okta, AWS Cognito, Auth0, Azure AD)\nplug in via the `User.auth_provider: external` hook plus an\n`external_subject_id` mapping; no concrete provider ships in\nthis revision. Agent identity (separate from human users) uses\nDynamic Client Registration (`POST /register`) with the agent's\nJWKS, then RFC 7523 JWT-bearer assertions exchanged at\n`POST /oauth/token` for an opaque access token.\n\n## Cross-cutting conventions\n\n- Every API reference uses the loose\n  `APIReference(vendor, name, version)` data structure. There is no\n  foreign key between Core, Registry, and Admin / Audit — the\n  tuple is the only join.\n- **Error shape.** Every error response is RFC 9457 Problem\n  Details (`application/problem+json`) using the shared\n  `ProblemDetails` schema from\n  [jentic/api-problem-details](https://github.com/jentic/api-problem-details).\n  Field-level validation failures (`422`) populate `errors[]`;\n  transport-level conditions reuse the same shape with status-\n  and `type`-specific payloads.\n- **JSON casing.** Field names in request and response bodies are\n  `snake_case` throughout, including discriminator values\n  (`type: api_key`, `type: bearer_token`, …). The one historical\n  camelCase exception is the OpenAPI keyword `apiKey` itself when\n  it appears in re-exported `securitySchemes.type` values; that's\n  an OpenAPI artefact, not platform style.\n- **Pagination.** List endpoints are cursor-paginated with opaque\n  `next_cursor` round-trips. `has_more=false` means done. List\n  envelopes are intentionally slim — `{data, has_more,\n  next_cursor}` — and **do not** carry HAL-style `_links` (no\n  `self`, `next`, or `prev`); cursors are forward-only and\n  `next_cursor` already encodes the next page. Individual resource\n  responses still use `_links` where it carries non-trivial\n  information (e.g. `Job._links.result`, `AsyncQueuedResponse._links.self`,\n  `Event._links`).\n- **Authentication.** All operations require `Authorization:\n  Bearer <token>` — an opaque access token (prefixed `at_`, not a\n  JWT), obtained from `POST /oauth/token` (see `BearerAuth` for the\n  per-actor grants) — except the unauthenticated\n  `GET /health`, `POST /auth/login`, `POST /users:create-admin`,\n  and `POST /users:redeem-invite`. See the `Users` tag for the\n  first-run setup and invite-redemption flows.\n- **Header namespace.** All Jentic-specific HTTP headers — request\n  and response, broker and control-plane — live under the\n  `Jentic-*` namespace **without** the legacy `X-` prefix\n  (RFC 6648 deprecates `X-` for new protocols). `Jentic-*` is\n  unambiguously a platform header; anything else on a brokered\n  response belongs to the upstream API. Standard headers\n  (`Authorization`, `Prefer`, `Idempotency-Key`, `Accept`,\n  `traceparent`, `tracestate`) keep their RFC names.\n- **Append-only audit.** Admin / Audit records are never mutated\n  after the fact; retention is enforced via purge policy, not\n  edit.\n- **Trace correlation.** Every Broker call records a W3C\n  `trace_id` on its `ExecutionRecord` and on any `Event` derived\n  from it. To walk all executions under one logical request, use\n  `GET /executions?trace_id=…`.\n- **Event stream.** The dashboard / operator UI consumes the\n  `/events` resource (paginated list + SSE stream). Some events\n  are informational, some require action — see the `Events` tag.\n- **Revision pinning.** Every `Api` carries one `published`\n  revision (`current_revision_id`) plus zero or more `draft` and\n  `archived` siblings. The Broker's hot path resolves against\n  `current_revision_id` by default; agents can target a specific\n  `draft` revision per call via the Broker's `Jentic-Revision`\n  header. Control-plane reads (`Search`, `Inspect`,\n  `Lookup`) accept matching `revision_id` / `revision_pins`\n  parameters so dashboards can preview an unpromoted revision\n  before flipping `:promote`.\n- **ID prefixes.** Resource identifiers use a stable short prefix.\n  Treat the prefix as part of the ID — never strip it. The\n  complete table:\n\n  | Prefix | Resource | Notes |\n  |---|---|---|\n  | `tk_` | Toolkit ID | Public; appears in URLs and logs. **Not** the toolkit secret. |\n  | `ck_` | Toolkit-key record | One toolkit can hold many keys; each `ck_…` is a key record (label, IP allowlist, revoked flag). The plaintext key value is `jntc_live_…`. |\n  | `cred_` | Credential ID | |\n  | `exec_` | Execution record | Returned in the `Jentic-Execution-Id` response header on every brokered call. |\n  | `job_` | Async job | UUIDs also accepted on inputs for backward compatibility. |\n  | `evt_` | Event | ULID-shaped. |\n  | `op_` | Registered operation | |\n  | `rev_` | API revision | ULID-shaped. |\n  | `usr_` | User | Org member. Resolves via `GET /users/{user_id}`. Used in `acknowledged_by`, `decided_by`, and similar audit references. |\n  | `inv_` | Invite token | One-time token issued at user creation. Plaintext value shown **once** at issue / re-issue; `:redeem-invite` consumes it. |\n  | `areq_` | Access request | Per-toolkit human-approval ticket; lives on the `Access Requests` sub-tag of `Toolkits`. |\n  | `note_` | Note | ULID-shaped. Free-form annotation attached to a registry resource — see the `Notes` tag. |\n  | `ovr_` | Overlay | ULID-shaped. OpenAPI Overlay 1.0 document attached to an `Api` aggregate — see the `Overlays` tag. |\n  | `jntc_live_` | Plaintext toolkit API key value | The secret. Returned **once** at toolkit creation / key issue. |\n\n  Surfaces still being designed (agent identity, OAuth brokers)\n  will add their own prefixes when they land.\n",
    "license": {
      "identifier": "Apache-2.0",
      "name": "Apache-2.0"
    },
    "summary": "HTTP surface of the Jentic platform's control plane — Core / Access (credentials, toolkits), Registry (registered APIs, operations, search), and Admin / Audit (execution telemetry, async jobs).",
    "title": "Jentic Control Plane API",
    "version": "0.25.0"
  },
  "openapi": "3.1.0",
  "paths": {
    "/.well-known/jwks.json": {
      "get": {
        "description": "Return the JWKS document with the active public signing keys (ES256).",
        "operationId": "jwks",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Jwks",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "JSON Web Key Set",
        "tags": [
          "Discovery"
        ]
      }
    },
    "/.well-known/oauth-authorization-server": {
      "get": {
        "description": "Return RFC 8414 authorization-server metadata (endpoints, grant types, algorithms).",
        "operationId": "oauthAuthorizationServer",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": true,
                  "title": "Response Oauthauthorizationserver",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "OAuth authorization server metadata",
        "tags": [
          "Discovery"
        ]
      }
    },
    "/access-requests": {
      "get": {
        "description": "List access requests with cursor-based pagination.",
        "operationId": "listAccessRequests",
        "parameters": [
          {
            "in": "query",
            "name": "actor_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Actor Id"
            }
          },
          {
            "in": "query",
            "name": "status",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Status"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccessRequestListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List access requests",
        "tags": [
          "Access Requests"
        ]
      },
      "post": {
        "description": "File a new access request.",
        "operationId": "fileAccessRequest",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AccessRequestFileRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccessRequestResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "File access request",
        "tags": [
          "Access Requests"
        ]
      }
    },
    "/access-requests/{request_id}": {
      "get": {
        "description": "Get a single access request by ID.",
        "operationId": "getAccessRequest",
        "parameters": [
          {
            "in": "path",
            "name": "request_id",
            "required": true,
            "schema": {
              "title": "Request Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccessRequestResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get access request",
        "tags": [
          "Access Requests"
        ]
      }
    },
    "/access-requests/{request_id}:amend": {
      "post": {
        "description": "Amend pending items on an access request.",
        "operationId": "amendAccessRequest",
        "parameters": [
          {
            "in": "path",
            "name": "request_id",
            "required": true,
            "schema": {
              "title": "Request Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AmendRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccessRequestResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Amend access request",
        "tags": [
          "Access Requests"
        ]
      }
    },
    "/access-requests/{request_id}:decide": {
      "post": {
        "description": "Decide (approve/deny) items on an access request.",
        "operationId": "decideAccessRequest",
        "parameters": [
          {
            "in": "path",
            "name": "request_id",
            "required": true,
            "schema": {
              "title": "Request Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DecideRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccessRequestResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Decide access request items",
        "tags": [
          "Access Requests"
        ]
      }
    },
    "/access-requests/{request_id}:withdraw": {
      "post": {
        "description": "Withdraw a pending access request.",
        "operationId": "withdrawAccessRequest",
        "parameters": [
          {
            "in": "path",
            "name": "request_id",
            "required": true,
            "schema": {
              "title": "Request Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AccessRequestResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Withdraw access request",
        "tags": [
          "Access Requests"
        ]
      }
    },
    "/actors": {
      "get": {
        "description": "List all actors (users, agents, service accounts) for UI cache hydration.",
        "operationId": "listActors",
        "parameters": [
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 1000,
              "maximum": 5000,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ActorListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Actors",
        "tags": [
          "Actors"
        ]
      }
    },
    "/admin/config/providers": {
      "get": {
        "description": "List all stored provider configs, with secret fields redacted.",
        "operationId": "listProviderConfigs",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProviderConfigListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List credential provider configs",
        "tags": [
          "Configuration"
        ]
      }
    },
    "/admin/config/providers/{name}": {
      "get": {
        "description": "Get a stored provider config by name, with secret fields redacted.",
        "operationId": "getProviderConfig",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProviderConfigResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get a credential provider config",
        "tags": [
          "Configuration"
        ]
      },
      "put": {
        "description": "Set (create or update) a credential provider config at runtime.\n\nThe payload is validated by provider name (e.g. ``pipedream``). Secret fields\nare encrypted at rest. A successful write rebuilds the in-process provider\nregistry so the change takes effect without a restart. The response redacts\nsecret fields.",
        "operationId": "setProviderConfig",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ProviderConfigSetRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProviderConfigResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Set a credential provider config",
        "tags": [
          "Configuration"
        ]
      }
    },
    "/admin/health": {
      "get": {
        "description": "Return admin service health status.",
        "operationId": "health",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HealthResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Health",
        "tags": [
          "System"
        ]
      }
    },
    "/agents": {
      "get": {
        "description": "List agents — scoped by identity via dynamic query scoping.",
        "operationId": "listAgents",
        "parameters": [
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "status",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Status"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AgentListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Agents",
        "tags": [
          "Agents"
        ]
      },
      "post": {
        "description": "Create a new agent manually.",
        "operationId": "createAgent",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AgentCreateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AgentResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Create Agent",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}": {
      "delete": {
        "description": "Soft-archive an agent — revokes scope grants and toolkit bindings.",
        "operationId": "archiveAgent",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Archive Agent",
        "tags": [
          "Agents"
        ]
      },
      "get": {
        "description": "Get agent by ID — requires agents:read or self-read.",
        "operationId": "getAgent",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AgentResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Agent",
        "tags": [
          "Agents"
        ]
      },
      "patch": {
        "description": "Partially update an agent — name, description, or owner_id.",
        "operationId": "updateAgent",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AgentPatchRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AgentResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Update Agent",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}/api-key": {
      "get": {
        "description": "Get API key metadata for an agent. Returns info even after revocation.",
        "operationId": "getAgentApiKeyInfo",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "anyOf": [
                    {
                      "$ref": "#/components/schemas/ApiKeyInfoResponse"
                    },
                    {
                      "type": "null"
                    }
                  ],
                  "title": "Response Getagentapikeyinfo"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Agent Api Key Info",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}/api-key/history": {
      "get": {
        "description": "Get the audit history of API key operations for an agent.",
        "operationId": "getAgentApiKeyHistory",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ApiKeyHistoryResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Agent Api Key History",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}/scopes": {
      "get": {
        "description": "List scopes granted to an agent.",
        "operationId": "getAgentScopes",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AgentScopesResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Agent Scopes",
        "tags": [
          "Agents"
        ]
      },
      "put": {
        "description": "Replace all scopes for an agent.",
        "operationId": "replaceAgentScopes",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AgentScopesRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AgentScopesResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Replace Agent Scopes",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}/toolkits": {
      "get": {
        "description": "List toolkit bindings for an agent — requires agents:read or self.",
        "operationId": "listAgentToolkits",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitBindingListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Toolkits",
        "tags": [
          "Agents"
        ]
      },
      "post": {
        "description": "Bind a toolkit to an agent.",
        "operationId": "bindToolkit",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ToolkitBindRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitBindingResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Bind Toolkit",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}/toolkits/{toolkit_id}": {
      "delete": {
        "description": "Unbind a toolkit from an agent.",
        "operationId": "unbindToolkit",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Unbind Toolkit",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}:approve": {
      "post": {
        "description": "Approve a pending agent.",
        "operationId": "approveAgent",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AgentResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Approve Agent",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}:deny": {
      "post": {
        "description": "Deny a pending agent.",
        "operationId": "denyAgent",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/jentic_one__auth__web__schemas__agents__DenyRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AgentResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Deny Agent",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}:disable": {
      "post": {
        "description": "Disable an active agent.",
        "operationId": "disableAgent",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Disable Agent",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}:enable": {
      "post": {
        "description": "Enable a disabled agent.",
        "operationId": "enableAgent",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Enable Agent",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}:generate-api-key": {
      "post": {
        "description": "Generate a new API key for an active agent. Rotates any existing key.",
        "operationId": "generateAgentApiKey",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ApiKeyResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Generate Agent Api Key",
        "tags": [
          "Agents"
        ]
      }
    },
    "/agents/{agent_id}:revoke-api-key": {
      "post": {
        "description": "Revoke an agent's API key without generating a new one.",
        "operationId": "revokeAgentApiKey",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Revoke Agent Api Key",
        "tags": [
          "Agents"
        ]
      }
    },
    "/apis": {
      "get": {
        "description": "List locally registered APIs with optional vendor filter and pagination.\n\nThis is the **imported** registry — APIs present in this deployment. The\npublic catalog of importable-but-not-yet-imported APIs is a separate surface\n(``GET /catalog``); the two are not blended.",
        "operationId": "listApis",
        "parameters": [
          {
            "in": "query",
            "name": "vendor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Vendor"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ApiListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Apis",
        "tags": [
          "APIs"
        ]
      },
      "post": {
        "description": "Import OpenAPI/Arazzo content as new API revisions (async).",
        "operationId": "importApis",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ApiImportRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Import Apis",
        "tags": [
          "APIs"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}": {
      "delete": {
        "description": "Delete an API and all its revisions.",
        "operationId": "deleteApi",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Delete Api",
        "tags": [
          "APIs"
        ]
      },
      "get": {
        "description": "Retrieve a single API by its (vendor, name, version) identity.",
        "operationId": "getApi",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ApiResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Api",
        "tags": [
          "APIs"
        ]
      },
      "patch": {
        "description": "Partially update an API's presentation fields.",
        "operationId": "updateApi",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ApiUpdateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Update Api",
        "tags": [
          "APIs"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/openapi": {
      "get": {
        "description": "Download the OpenAPI spec for the API's current (live) revision.",
        "operationId": "getApiSpec",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "overlays",
            "required": false,
            "schema": {
              "default": true,
              "title": "Overlays",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Api Spec",
        "tags": [
          "API Spec"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/operations": {
      "get": {
        "description": "List operations for the API's current (live) revision.",
        "operationId": "listApiOperations",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OperationSummaryListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Api Operations",
        "tags": [
          "API Operations"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/overlays": {
      "get": {
        "description": "List overlays for an API with optional status filter and cursor pagination.",
        "operationId": "listOverlays",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "status",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Status"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Overlays",
        "tags": [
          "Overlays"
        ]
      },
      "post": {
        "description": "Submit a new overlay for an API.",
        "operationId": "submitOverlay",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/OverlaySubmitRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Submit Overlay",
        "tags": [
          "Overlays"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/overlays/{overlay_id}": {
      "delete": {
        "description": "Deprecate an overlay (soft delete).",
        "operationId": "deprecateOverlay",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "overlay_id",
            "required": true,
            "schema": {
              "title": "Overlay Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Deprecate Overlay",
        "tags": [
          "Overlays"
        ]
      },
      "get": {
        "description": "Retrieve a single overlay by ID.",
        "operationId": "getOverlay",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "overlay_id",
            "required": true,
            "schema": {
              "title": "Overlay Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Overlay",
        "tags": [
          "Overlays"
        ]
      },
      "patch": {
        "description": "Update an overlay's document or target revision.",
        "operationId": "updateOverlay",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "overlay_id",
            "required": true,
            "schema": {
              "title": "Overlay Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/OverlayUpdateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Update Overlay",
        "tags": [
          "Overlays"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/overlays/{overlay_id}:confirm": {
      "post": {
        "description": "Confirm an overlay, materializing it onto the served spec.\n\nRequires ``overlays:confirm``: confirming rewrites the API's served spec (it\nre-ingests the base spec with the overlay applied and promotes the result to the\ncurrent revision), so it is an operator action, not a contributor one (contributors\n``submit`` overlays with ``apis:write``; an operator reviews and confirms). This is a\npurpose-scoped downgrade from the former ``org:admin`` gate — narrow enough that an\nowner can grant it to a trusted operator without handing over full admin power.\n``org:admin`` still satisfies it (it implies ``overlays:confirm``), and the scope is\ndeliberately excluded from an agent's self-service grantable set so a low-privilege\nagent cannot escalate into it.",
        "operationId": "confirmOverlay",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "overlay_id",
            "required": true,
            "schema": {
              "title": "Overlay Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/OverlayConfirmRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Confirm Overlay",
        "tags": [
          "Overlays"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/revisions": {
      "get": {
        "description": "List revisions for an API with optional state filter and cursor pagination.",
        "operationId": "listApiRevisions",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "state",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                {
                  "type": "null"
                }
              ],
              "title": "State"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Api Revisions",
        "tags": [
          "APIs"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/revisions/{revision_id}": {
      "delete": {
        "description": "Delete an archived revision.",
        "operationId": "deleteRevision",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "revision_id",
            "required": true,
            "schema": {
              "title": "Revision Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Delete Revision",
        "tags": [
          "APIs"
        ]
      },
      "get": {
        "description": "Retrieve a single revision by ID.",
        "operationId": "getApiRevision",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "revision_id",
            "required": true,
            "schema": {
              "title": "Revision Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Api Revision",
        "tags": [
          "APIs"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/revisions/{revision_id}/openapi": {
      "get": {
        "description": "Download the OpenAPI spec for a specific revision.",
        "operationId": "getApiRevisionSpec",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "revision_id",
            "required": true,
            "schema": {
              "title": "Revision Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "overlays",
            "required": false,
            "schema": {
              "default": true,
              "title": "Overlays",
              "type": "boolean"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Api Revision Spec",
        "tags": [
          "API Spec"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/revisions/{revision_id}/operations": {
      "get": {
        "description": "List operations for a specific revision.",
        "operationId": "listApiRevisionOperations",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "revision_id",
            "required": true,
            "schema": {
              "title": "Revision Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Api Revision Operations",
        "tags": [
          "API Operations"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/revisions/{revision_id}:archive": {
      "post": {
        "description": "Archive a draft revision.",
        "operationId": "archiveRevision",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "revision_id",
            "required": true,
            "schema": {
              "title": "Revision Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Archive Revision",
        "tags": [
          "APIs"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/revisions/{revision_id}:promote": {
      "post": {
        "description": "Promote a draft revision to published, archiving the current one.",
        "operationId": "promoteRevision",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "revision_id",
            "required": true,
            "schema": {
              "title": "Revision Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Promote Revision",
        "tags": [
          "APIs"
        ]
      }
    },
    "/apis/{vendor}/{name}/{version}/security-schemes": {
      "get": {
        "description": "List security schemes (with OAuth2 flow URLs) for the API's current revision.",
        "operationId": "listApiSecuritySchemes",
        "parameters": [
          {
            "in": "path",
            "name": "vendor",
            "required": true,
            "schema": {
              "title": "Vendor",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "title": "Name",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "version",
            "required": true,
            "schema": {
              "title": "Version",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SecuritySchemeListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List security schemes for an API",
        "tags": [
          "APIs"
        ]
      }
    },
    "/audit": {
      "get": {
        "description": "List audit entries with optional filters.",
        "operationId": "listAuditEntries",
        "parameters": [
          {
            "in": "query",
            "name": "target_type",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "$ref": "#/components/schemas/AuditTargetType"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Target Type"
            }
          },
          {
            "in": "query",
            "name": "target_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Target Id"
            }
          },
          {
            "in": "query",
            "name": "actor_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Actor Id"
            }
          },
          {
            "in": "query",
            "name": "origin",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Origin"
            }
          },
          {
            "in": "query",
            "name": "since",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "format": "date-time",
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Since"
            }
          },
          {
            "in": "query",
            "name": "until",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "format": "date-time",
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Until"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuditListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Audit Entries",
        "tags": [
          "Audit"
        ]
      }
    },
    "/audit/{audit_id}": {
      "get": {
        "description": "Get a single audit entry by ID.",
        "operationId": "getAuditEntry",
        "parameters": [
          {
            "in": "path",
            "name": "audit_id",
            "required": true,
            "schema": {
              "title": "Audit Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuditResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Audit Entry",
        "tags": [
          "Audit"
        ]
      }
    },
    "/auth/health": {
      "get": {
        "description": "Return service health status for this surface.\n\nUnauthenticated liveness probe. In combined mode this is served under\nthe surface prefix (e.g. ``/control/health``) so surfaces don't collide;\nthe canonical platform probe is the root ``GET /health``.",
        "operationId": "authHealth",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "title": "Response Authhealth",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Auth health",
        "tags": [
          "System"
        ]
      }
    },
    "/auth/login": {
      "post": {
        "description": "Authenticate and return a JWT token bundle.",
        "operationId": "login",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/LoginRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LoginResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Log in",
        "tags": [
          "Users"
        ]
      }
    },
    "/auth/refresh": {
      "post": {
        "description": "Re-mint the caller's login JWT before it expires (sliding session).\n\nOnly user login JWTs are refreshable; permissions and the\n``must_change_password`` gate are re-read from the database at re-mint.\nRefusal modes: 401 ``session_expired`` once the original authentication is\nolder than the absolute window (``admin.auth.session_ttl_seconds``), 401\n``invalid_credentials`` for deactivated users, non-user tokens, or opaque\n(non-JWT) credentials. Clients should then send the user back to login.",
        "operationId": "refreshSession",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LoginResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Refresh session token",
        "tags": [
          "Users"
        ]
      }
    },
    "/authorize": {
      "get": {
        "description": "RFC 6749 Authorization endpoint with PKCE (S256 only).\n\nIf an external IdP is configured, redirects to the upstream provider.\nOtherwise returns an error (direct login requires a separate credential exchange).",
        "operationId": "authorizeEndpoint",
        "parameters": [
          {
            "in": "query",
            "name": "response_type",
            "required": true,
            "schema": {
              "title": "Response Type",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "client_id",
            "required": true,
            "schema": {
              "title": "Client Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "redirect_uri",
            "required": true,
            "schema": {
              "title": "Redirect Uri",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "code_challenge",
            "required": true,
            "schema": {
              "title": "Code Challenge",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "code_challenge_method",
            "required": true,
            "schema": {
              "title": "Code Challenge Method",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "scope",
            "required": false,
            "schema": {
              "default": "openid",
              "title": "Scope",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "state",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "State"
            }
          },
          {
            "in": "query",
            "name": "nonce",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Nonce"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Authorize Endpoint",
        "tags": [
          "OAuth"
        ]
      }
    },
    "/catalog": {
      "get": {
        "description": "List a keyset page of browsable catalog entries (search/filter aware).\n\nThe catalog holds thousands of entries, so this is cursor-paginated like\n``GET /apis``: follow ``next_cursor`` until ``has_more`` is false.\n``catalog_total``/``registered_count``/``outdated_count`` count the whole\nmanifest, not the page, so the Discover status row stays stable while scrolling.",
        "operationId": "listCatalog",
        "parameters": [
          {
            "in": "query",
            "name": "q",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "maxLength": 500,
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Q"
            }
          },
          {
            "in": "query",
            "name": "registered_only",
            "required": false,
            "schema": {
              "default": false,
              "title": "Registered Only",
              "type": "boolean"
            }
          },
          {
            "in": "query",
            "name": "unregistered_only",
            "required": false,
            "schema": {
              "default": false,
              "title": "Unregistered Only",
              "type": "boolean"
            }
          },
          {
            "in": "query",
            "name": "outdated_only",
            "required": false,
            "schema": {
              "default": false,
              "title": "Outdated Only",
              "type": "boolean"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CatalogListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Catalog",
        "tags": [
          "Catalog"
        ]
      }
    },
    "/catalog/{api_id}": {
      "get": {
        "description": "Retrieve a single catalog entry by api_id.",
        "operationId": "getCatalogEntry",
        "parameters": [
          {
            "in": "path",
            "name": "api_id",
            "required": true,
            "schema": {
              "title": "Api Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CatalogEntryResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Catalog Entry",
        "tags": [
          "Catalog"
        ]
      }
    },
    "/catalog/{api_id}/operations": {
      "get": {
        "description": "Preview the operations of a catalog entry's spec (capped, offset-paginated).\n\n``tag`` and ``q`` filter the spec's operations server-side before windowing,\nso the UI's search box covers every operation in the spec and pages the\nfiltered set via ``offset``/``limit`` (\"Load more\").",
        "operationId": "previewCatalogOperations",
        "parameters": [
          {
            "in": "path",
            "name": "api_id",
            "required": true,
            "schema": {
              "title": "Api Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "offset",
            "required": false,
            "schema": {
              "default": 0,
              "minimum": 0,
              "title": "Offset",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 200,
              "maximum": 200,
              "minimum": 0,
              "title": "Limit",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "tag",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Tag"
            }
          },
          {
            "in": "query",
            "name": "q",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "maxLength": 500,
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Q"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OperationPreviewListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Preview Catalog Operations",
        "tags": [
          "Catalog"
        ]
      }
    },
    "/catalog/{api_id}:import": {
      "post": {
        "description": "Enqueue an async import of a catalog entry into the local registry.",
        "operationId": "importCatalogEntry",
        "parameters": [
          {
            "in": "path",
            "name": "api_id",
            "required": true,
            "schema": {
              "title": "Api Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ApiImportResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Import Catalog Entry",
        "tags": [
          "Catalog"
        ]
      }
    },
    "/catalog:refresh": {
      "post": {
        "description": "Force a refresh of the catalog cache from the upstream manifest (org:admin).",
        "operationId": "refreshCatalog",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CatalogRefreshResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Refresh Catalog",
        "tags": [
          "Catalog"
        ]
      }
    },
    "/control/health": {
      "get": {
        "description": "Return service health status for this surface.\n\nUnauthenticated liveness probe. In combined mode this is served under\nthe surface prefix (e.g. ``/control/health``) so surfaces don't collide;\nthe canonical platform probe is the root ``GET /health``.",
        "operationId": "controlHealth",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "title": "Response Controlhealth",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Control health",
        "tags": [
          "System"
        ]
      }
    },
    "/credentials": {
      "get": {
        "description": "List credentials with cursor-based pagination.",
        "operationId": "listCredentials",
        "parameters": [
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "vendor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Vendor"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CredentialListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List credentials",
        "tags": [
          "Credentials"
        ]
      },
      "post": {
        "description": "Create a new credential. The secret is returned once and never readable again.",
        "operationId": "createCredential",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "discriminator": {
                  "mapping": {
                    "api_key": "#/components/schemas/ApiKeyCreateRequest",
                    "basic": "#/components/schemas/BasicAuthCreateRequest",
                    "bearer_token": "#/components/schemas/BearerTokenCreateRequest",
                    "no_auth": "#/components/schemas/NoAuthCreateRequest",
                    "oauth2": "#/components/schemas/OAuth2CreateRequest"
                  },
                  "propertyName": "type"
                },
                "oneOf": [
                  {
                    "$ref": "#/components/schemas/BearerTokenCreateRequest"
                  },
                  {
                    "$ref": "#/components/schemas/ApiKeyCreateRequest"
                  },
                  {
                    "$ref": "#/components/schemas/BasicAuthCreateRequest"
                  },
                  {
                    "$ref": "#/components/schemas/OAuth2CreateRequest"
                  },
                  {
                    "$ref": "#/components/schemas/NoAuthCreateRequest"
                  }
                ],
                "title": "Body"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CredentialCreateResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Create credential",
        "tags": [
          "Credentials"
        ]
      }
    },
    "/credentials/oauth/callback": {
      "get": {
        "description": "Handle the OAuth callback from the IdP.\n\nThis endpoint is intentionally unauthenticated — it receives redirects\nfrom external IdPs where the user has no session cookie. Security\nbinding is provided by the signed, time-limited state JWT which ties\nthe callback to a specific credential and caller.\n\nRedirects the popup the SPA opened to a public SPA route\n(``/app/oauth/connected``) that owns the user-facing \"you can close this\"\nexperience and self-closes. Two variants, distinguished only by a coarse\n``status`` query param:\n\n  * Success: ``?status=ok``.\n  * Failure: ``?status=error`` — no protocol or provider detail is\n    exposed in the redirect URL.\n\nThe parent SPA still learns the real outcome by polling\n``GET /credentials/{id}`` — never from this redirect. The actual cause\n(missing state, connect failure, provider error, etc.) is recorded via\nstructured logging for operators.",
        "operationId": "oauthCallback",
        "parameters": [
          {
            "in": "query",
            "name": "code",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Code"
            }
          },
          {
            "in": "query",
            "name": "state",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "State"
            }
          },
          {
            "in": "query",
            "name": "error",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Error"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "OAuth connect callback",
        "tags": [
          "Credentials"
        ]
      }
    },
    "/credentials/providers": {
      "get": {
        "description": "Return discovery metadata for all configured credential providers.",
        "operationId": "listProviders",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ProviderDiscoveryResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List credential providers",
        "tags": [
          "Credentials"
        ]
      }
    },
    "/credentials/{credential_id}": {
      "delete": {
        "description": "Delete a credential.",
        "operationId": "deleteCredential",
        "parameters": [
          {
            "in": "path",
            "name": "credential_id",
            "required": true,
            "schema": {
              "title": "Credential Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Delete credential",
        "tags": [
          "Credentials"
        ]
      },
      "get": {
        "description": "Get a single credential with redacted secrets.",
        "operationId": "getCredential",
        "parameters": [
          {
            "in": "path",
            "name": "credential_id",
            "required": true,
            "schema": {
              "title": "Credential Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CredentialRedactedResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get credential",
        "tags": [
          "Credentials"
        ]
      },
      "patch": {
        "description": "Update or rotate a credential.",
        "operationId": "updateCredential",
        "parameters": [
          {
            "in": "path",
            "name": "credential_id",
            "required": true,
            "schema": {
              "title": "Credential Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "discriminator": {
                  "mapping": {
                    "api_key": "#/components/schemas/ApiKeyUpdateRequest",
                    "basic": "#/components/schemas/BasicAuthUpdateRequest",
                    "bearer_token": "#/components/schemas/BearerTokenUpdateRequest",
                    "oauth2": "#/components/schemas/OAuth2UpdateRequest"
                  },
                  "propertyName": "type"
                },
                "oneOf": [
                  {
                    "$ref": "#/components/schemas/BearerTokenUpdateRequest"
                  },
                  {
                    "$ref": "#/components/schemas/ApiKeyUpdateRequest"
                  },
                  {
                    "$ref": "#/components/schemas/BasicAuthUpdateRequest"
                  },
                  {
                    "$ref": "#/components/schemas/OAuth2UpdateRequest"
                  }
                ],
                "title": "Body"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CredentialRedactedResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Update or rotate credential",
        "tags": [
          "Credentials"
        ]
      }
    },
    "/credentials/{credential_id}/connect": {
      "post": {
        "description": "Initiate the OAuth connect flow for a credential.",
        "operationId": "connectCredential",
        "parameters": [
          {
            "in": "path",
            "name": "credential_id",
            "required": true,
            "schema": {
              "title": "Credential Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ConnectRequestBody"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ConnectChallengeResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request conflicts with the current state of the resource.",
                  "instance": "/example/path",
                  "status": 409,
                  "title": "Conflict",
                  "type": "conflict"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Credential is not connectable"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Begin OAuth connect flow",
        "tags": [
          "Credentials"
        ]
      }
    },
    "/error": {
      "get": {
        "description": "Minimal error endpoint for browser-facing authorization failures.",
        "operationId": "errorPage",
        "parameters": [
          {
            "in": "query",
            "name": "error",
            "required": false,
            "schema": {
              "default": "unknown_error",
              "title": "Error",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "title": "Response Errorpage",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Error Page",
        "tags": [
          "OAuth"
        ]
      }
    },
    "/events": {
      "get": {
        "description": "List events with optional filters.",
        "operationId": "listEvents",
        "parameters": [
          {
            "in": "query",
            "name": "event_type",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Event Type"
            }
          },
          {
            "in": "query",
            "name": "severity",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "items": {
                    "$ref": "#/components/schemas/EventSeverity"
                  },
                  "type": "array"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Severity"
            }
          },
          {
            "in": "query",
            "name": "requires_action",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "boolean"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Requires Action"
            }
          },
          {
            "in": "query",
            "name": "acknowledged",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "boolean"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Acknowledged"
            }
          },
          {
            "in": "query",
            "name": "from",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "format": "date-time",
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "From"
            }
          },
          {
            "in": "query",
            "name": "to",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "format": "date-time",
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "To"
            }
          },
          {
            "in": "query",
            "name": "trace_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Trace Id"
            }
          },
          {
            "in": "query",
            "name": "actor_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Actor Id"
            }
          },
          {
            "in": "query",
            "name": "actor_type",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Actor Type"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 25,
              "maximum": 100,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EventListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Events",
        "tags": [
          "Events"
        ]
      }
    },
    "/events/stream": {
      "get": {
        "description": "Stream events as Server-Sent Events.",
        "operationId": "streamEvents",
        "parameters": [
          {
            "in": "query",
            "name": "since",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "format": "date-time",
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Since"
            }
          },
          {
            "in": "query",
            "name": "event_type",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Event Type"
            }
          },
          {
            "in": "query",
            "name": "severity",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "items": {
                    "$ref": "#/components/schemas/EventSeverity"
                  },
                  "type": "array"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Severity"
            }
          },
          {
            "in": "query",
            "name": "requires_action",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "boolean"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Requires Action"
            }
          },
          {
            "in": "query",
            "name": "trace_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Trace Id"
            }
          },
          {
            "in": "query",
            "name": "actor_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Actor Id"
            }
          },
          {
            "in": "query",
            "name": "actor_type",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Actor Type"
            }
          },
          {
            "in": "header",
            "name": "Last-Event-ID",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Last-Event-Id"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Stream Events",
        "tags": [
          "Events"
        ]
      }
    },
    "/events/{event_id}": {
      "get": {
        "description": "Get an event by ID.",
        "operationId": "getEvent",
        "parameters": [
          {
            "in": "path",
            "name": "event_id",
            "required": true,
            "schema": {
              "title": "Event Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EventResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Event",
        "tags": [
          "Events"
        ]
      },
      "patch": {
        "description": "Acknowledge an event.",
        "operationId": "acknowledgeEvent",
        "parameters": [
          {
            "in": "path",
            "name": "event_id",
            "required": true,
            "schema": {
              "title": "Event Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/EventAcknowledgeRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EventResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Acknowledge Event",
        "tags": [
          "Events"
        ]
      }
    },
    "/executions": {
      "get": {
        "description": "List execution records with optional filters.",
        "operationId": "listExecutions",
        "parameters": [
          {
            "in": "query",
            "name": "toolkit_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Toolkit Id"
            }
          },
          {
            "in": "query",
            "name": "trace_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Trace Id"
            }
          },
          {
            "in": "query",
            "name": "status",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Status"
            }
          },
          {
            "in": "query",
            "name": "from",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "format": "date-time",
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "From"
            }
          },
          {
            "in": "query",
            "name": "to",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "format": "date-time",
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "To"
            }
          },
          {
            "in": "query",
            "name": "api",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Api"
            }
          },
          {
            "in": "query",
            "name": "actor_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Actor Id"
            }
          },
          {
            "in": "query",
            "name": "origin",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Origin"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 25,
              "maximum": 100,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ExecutionListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Executions",
        "tags": [
          "Executions"
        ]
      }
    },
    "/executions/{execution_id}": {
      "get": {
        "description": "Get an execution record by ID.",
        "operationId": "getExecution",
        "parameters": [
          {
            "in": "path",
            "name": "execution_id",
            "required": true,
            "schema": {
              "title": "Execution Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ExecutionResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Execution",
        "tags": [
          "Executions"
        ]
      }
    },
    "/health": {
      "get": {
        "description": "Liveness probe for the combined control-plane app.\n\nUnauthenticated and dependency-free so orchestrators and load balancers\nhave a stable target. Returns ``{\"status\": \"ok\"}`` when the process is up.",
        "operationId": "getHealth",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          }
        },
        "security": [],
        "summary": "Health",
        "tags": [
          "System"
        ]
      }
    },
    "/inspect": {
      "get": {
        "description": "Inspect an operation — resolve to full structural detail.",
        "operationId": "inspectOperation",
        "parameters": [
          {
            "description": "METHOD URL identifier",
            "in": "query",
            "name": "id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "description": "METHOD URL identifier",
              "title": "Id"
            }
          },
          {
            "description": "Operation ID",
            "in": "query",
            "name": "operation_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "description": "Operation ID",
              "title": "Operation Id"
            }
          },
          {
            "description": "Pin to specific revision",
            "in": "query",
            "name": "revision_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "description": "Pin to specific revision",
              "title": "Revision Id"
            }
          },
          {
            "in": "query",
            "name": "detail",
            "required": false,
            "schema": {
              "default": "summary",
              "enum": [
                "summary",
                "full"
              ],
              "title": "Detail",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Inspect operation",
        "tags": [
          "Inspect"
        ]
      }
    },
    "/instance": {
      "get": {
        "description": "Return this backend's self-describing identity.\n\nUnauthenticated and dependency-free so any client (an MCP server, the\nCLI, an agent) can read which backend it is bound to — local vs. a\nremote install — and label its responses accordingly.",
        "operationId": "getInstance",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstanceIdentityResponse"
                }
              }
            },
            "description": "Successful Response"
          }
        },
        "security": [],
        "summary": "Backend identity",
        "tags": [
          "System"
        ]
      }
    },
    "/jobs": {
      "get": {
        "description": "List jobs with optional filters.",
        "operationId": "listJobs",
        "parameters": [
          {
            "in": "query",
            "name": "kind",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Kind"
            }
          },
          {
            "in": "query",
            "name": "status",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Status"
            }
          },
          {
            "in": "query",
            "name": "from",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "format": "date-time",
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "From"
            }
          },
          {
            "in": "query",
            "name": "to",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "format": "date-time",
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "To"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 25,
              "maximum": 100,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Jobs",
        "tags": [
          "Jobs"
        ]
      }
    },
    "/jobs/{job_id}": {
      "get": {
        "description": "Get a job by ID.",
        "operationId": "getJob",
        "parameters": [
          {
            "in": "path",
            "name": "job_id",
            "required": true,
            "schema": {
              "title": "Job Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Job",
        "tags": [
          "Jobs"
        ]
      }
    },
    "/jobs/{job_id}/result": {
      "get": {
        "description": "Get the result of a completed job — polymorphic by kind.",
        "operationId": "getJobResult",
        "parameters": [
          {
            "in": "path",
            "name": "job_id",
            "required": true,
            "schema": {
              "title": "Job Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Job Result",
        "tags": [
          "Jobs"
        ]
      }
    },
    "/jobs/{job_id}:cancel": {
      "post": {
        "description": "Cancel an active job.",
        "operationId": "cancelJob",
        "parameters": [
          {
            "in": "path",
            "name": "job_id",
            "required": true,
            "schema": {
              "title": "Job Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Cancel Job",
        "tags": [
          "Jobs"
        ]
      }
    },
    "/me": {
      "get": {
        "description": "Return the caller's identity and context, discriminated by actor type.",
        "operationId": "getMe",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "discriminator": {
                    "mapping": {
                      "agent": "#/components/schemas/MeAgent",
                      "service_account": "#/components/schemas/MeServiceAccount",
                      "user": "#/components/schemas/MeUser"
                    },
                    "propertyName": "type"
                  },
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/MeUser"
                    },
                    {
                      "$ref": "#/components/schemas/MeAgent"
                    },
                    {
                      "$ref": "#/components/schemas/MeServiceAccount"
                    }
                  ],
                  "title": "Response Getme"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Me",
        "tags": [
          "Identity"
        ]
      }
    },
    "/monitoring/executions": {
      "get": {
        "description": "Return aggregated execution statistics for the dashboard.",
        "operationId": "getExecutionStats",
        "parameters": [
          {
            "in": "query",
            "name": "days",
            "required": false,
            "schema": {
              "default": 7,
              "maximum": 30,
              "minimum": 1,
              "title": "Days",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ExecutionStatsResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Execution Stats",
        "tags": [
          "Monitoring"
        ]
      }
    },
    "/monitoring/usage": {
      "get": {
        "description": "Return detailed usage statistics for the monitoring overview.",
        "operationId": "getUsageStats",
        "parameters": [
          {
            "in": "query",
            "name": "since",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "integer"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Since"
            }
          },
          {
            "in": "query",
            "name": "until",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "integer"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Until"
            }
          },
          {
            "in": "query",
            "name": "group_by",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "$ref": "#/components/schemas/GroupBy"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Group By"
            }
          },
          {
            "in": "query",
            "name": "top_limit",
            "required": false,
            "schema": {
              "default": 10,
              "maximum": 50,
              "minimum": 1,
              "title": "Top Limit",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "toolkit_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Toolkit Id"
            }
          },
          {
            "in": "query",
            "name": "api_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Api Id"
            }
          },
          {
            "in": "query",
            "name": "agent_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Agent Id"
            }
          },
          {
            "in": "query",
            "name": "status",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Status"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UsageResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Usage Stats",
        "tags": [
          "Monitoring"
        ]
      }
    },
    "/notes": {
      "get": {
        "description": "List notes with optional filters and cursor pagination.",
        "operationId": "listNotes",
        "parameters": [
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "api",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Api"
            }
          },
          {
            "in": "query",
            "name": "operation_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Operation Id"
            }
          },
          {
            "in": "query",
            "name": "execution_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Execution Id"
            }
          },
          {
            "in": "query",
            "name": "credential_id",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Credential Id"
            }
          },
          {
            "in": "query",
            "name": "type",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Type"
            }
          },
          {
            "in": "query",
            "name": "created_by",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Created By"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Notes",
        "tags": [
          "Notes"
        ]
      },
      "post": {
        "description": "Create a new note attached to a registry resource.",
        "operationId": "createNote",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/NoteCreateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Create Note",
        "tags": [
          "Notes"
        ]
      }
    },
    "/notes/{note_id}": {
      "delete": {
        "description": "Delete a note. Supports optimistic concurrency via If-Match.",
        "operationId": "deleteNote",
        "parameters": [
          {
            "in": "path",
            "name": "note_id",
            "required": true,
            "schema": {
              "title": "Note Id",
              "type": "string"
            }
          },
          {
            "in": "header",
            "name": "if-match",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "If-Match"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Delete Note",
        "tags": [
          "Notes"
        ]
      },
      "get": {
        "description": "Retrieve a single note by ID.",
        "operationId": "getNote",
        "parameters": [
          {
            "in": "path",
            "name": "note_id",
            "required": true,
            "schema": {
              "title": "Note Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Note",
        "tags": [
          "Notes"
        ]
      },
      "patch": {
        "description": "Update a note (partial). Supports optimistic concurrency via If-Match.",
        "operationId": "updateNote",
        "parameters": [
          {
            "in": "path",
            "name": "note_id",
            "required": true,
            "schema": {
              "title": "Note Id",
              "type": "string"
            }
          },
          {
            "in": "header",
            "name": "if-match",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "If-Match"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/NoteUpdateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Update Note",
        "tags": [
          "Notes"
        ]
      }
    },
    "/oauth/callback": {
      "get": {
        "description": "External IdP callback — exchanges upstream code and issues platform auth code.",
        "operationId": "authorizeOauthCallback",
        "parameters": [
          {
            "in": "query",
            "name": "code",
            "required": true,
            "schema": {
              "title": "Code",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "state",
            "required": true,
            "schema": {
              "title": "State",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Oauth Callback",
        "tags": [
          "OAuth"
        ]
      }
    },
    "/oauth/introspect": {
      "post": {
        "description": "Introspect a token (RFC 7662).",
        "operationId": "introspectEndpoint",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/IntrospectRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/IntrospectResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Introspect Endpoint",
        "tags": [
          "OAuth"
        ]
      }
    },
    "/oauth/mint": {
      "post": {
        "description": "Mint a short-lived ephemeral token for a task agent.\n\nThe caller must be an authenticated service account. The requested scopes\nmust be a subset of the caller's own scopes.",
        "operationId": "mintEndpoint",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/MintRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/MintResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Mint Endpoint",
        "tags": [
          "OAuth"
        ]
      }
    },
    "/oauth/revoke": {
      "post": {
        "description": "Revoke a token (RFC 7009). Always returns 200.",
        "operationId": "revokeEndpoint",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RevokeRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Revoke Endpoint",
        "tags": [
          "OAuth"
        ]
      }
    },
    "/oauth/token": {
      "post": {
        "description": "Exchange a refresh token, JWT assertion, authorization code, or client creds for tokens.",
        "operationId": "tokenEndpoint",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TokenRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Token Endpoint",
        "tags": [
          "OAuth"
        ]
      }
    },
    "/permissions": {
      "get": {
        "description": "List the permission catalogue visible to the caller.",
        "operationId": "listPermissions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PermissionListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Permissions",
        "tags": [
          "Permissions"
        ]
      }
    },
    "/register": {
      "post": {
        "description": "Register a new agent client (RFC 7591).",
        "operationId": "registerEndpoint",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RegisterRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RegisterResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Register Endpoint",
        "tags": [
          "Agent Registration"
        ]
      }
    },
    "/register/{agent_id}": {
      "delete": {
        "description": "Client deletion not supported — returns 403.",
        "operationId": "deleteRegistrationEndpoint",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Delete Registration Endpoint",
        "tags": [
          "Agent Registration"
        ]
      },
      "get": {
        "description": "Poll registration status (RFC 7592).",
        "operationId": "pollStatusEndpoint",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RegistrationStatusResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Poll Status Endpoint",
        "tags": [
          "Agent Registration"
        ]
      },
      "put": {
        "description": "Client update not supported — returns 403.",
        "operationId": "updateRegistrationEndpoint",
        "parameters": [
          {
            "in": "path",
            "name": "agent_id",
            "required": true,
            "schema": {
              "title": "Agent Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Update Registration Endpoint",
        "tags": [
          "Agent Registration"
        ]
      }
    },
    "/registry/health": {
      "get": {
        "description": "Return service health status for this surface.\n\nUnauthenticated liveness probe. In combined mode this is served under\nthe surface prefix (e.g. ``/control/health``) so surfaces don't collide;\nthe canonical platform probe is the root ``GET /health``.",
        "operationId": "registryHealth",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "title": "Response Registryhealth",
                  "type": "object"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Registry health",
        "tags": [
          "System"
        ]
      }
    },
    "/search": {
      "post": {
        "description": "Lexical (full-text) search over registered API operations.",
        "operationId": "searchOperations",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SearchRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SearchResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Search operations",
        "tags": [
          "Search"
        ]
      }
    },
    "/service-accounts": {
      "get": {
        "description": "List service accounts — owner-scoped unless caller is org:admin.",
        "operationId": "listServiceAccounts",
        "parameters": [
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "status",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Status"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceAccountListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Service Accounts",
        "tags": [
          "Service Accounts"
        ]
      },
      "post": {
        "description": "Create a new service account.",
        "operationId": "createServiceAccount",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ServiceAccountCreateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceAccountResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Create Service Account",
        "tags": [
          "Service Accounts"
        ]
      }
    },
    "/service-accounts/{service_account_id}": {
      "delete": {
        "description": "Soft-archive a service account — revokes scope grants.",
        "operationId": "archiveServiceAccount",
        "parameters": [
          {
            "in": "path",
            "name": "service_account_id",
            "required": true,
            "schema": {
              "title": "Service Account Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Archive Service Account",
        "tags": [
          "Service Accounts"
        ]
      },
      "get": {
        "description": "Get service account by ID — requires service-accounts:read or self-read.",
        "operationId": "getServiceAccount",
        "parameters": [
          {
            "in": "path",
            "name": "service_account_id",
            "required": true,
            "schema": {
              "title": "Service Account Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceAccountResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Service Account",
        "tags": [
          "Service Accounts"
        ]
      }
    },
    "/service-accounts/{service_account_id}/scopes": {
      "get": {
        "description": "List scopes granted to a service account.",
        "operationId": "getServiceAccountScopes",
        "parameters": [
          {
            "in": "path",
            "name": "service_account_id",
            "required": true,
            "schema": {
              "title": "Service Account Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceAccountScopesResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get Service Account Scopes",
        "tags": [
          "Service Accounts"
        ]
      },
      "put": {
        "description": "Replace all scopes for a service account.",
        "operationId": "replaceServiceAccountScopes",
        "parameters": [
          {
            "in": "path",
            "name": "service_account_id",
            "required": true,
            "schema": {
              "title": "Service Account Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ServiceAccountScopesRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceAccountScopesResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Replace Service Account Scopes",
        "tags": [
          "Service Accounts"
        ]
      }
    },
    "/service-accounts/{service_account_id}:approve": {
      "post": {
        "description": "Approve a pending service account.",
        "operationId": "approveServiceAccount",
        "parameters": [
          {
            "in": "path",
            "name": "service_account_id",
            "required": true,
            "schema": {
              "title": "Service Account Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceAccountResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Approve Service Account",
        "tags": [
          "Service Accounts"
        ]
      }
    },
    "/service-accounts/{service_account_id}:deny": {
      "post": {
        "description": "Deny a pending service account.",
        "operationId": "denyServiceAccount",
        "parameters": [
          {
            "in": "path",
            "name": "service_account_id",
            "required": true,
            "schema": {
              "title": "Service Account Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/jentic_one__auth__web__schemas__service_accounts__DenyRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ServiceAccountResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Deny Service Account",
        "tags": [
          "Service Accounts"
        ]
      }
    },
    "/service-accounts/{service_account_id}:disable": {
      "post": {
        "description": "Disable an active service account.",
        "operationId": "disableServiceAccount",
        "parameters": [
          {
            "in": "path",
            "name": "service_account_id",
            "required": true,
            "schema": {
              "title": "Service Account Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Disable Service Account",
        "tags": [
          "Service Accounts"
        ]
      }
    },
    "/service-accounts/{service_account_id}:enable": {
      "post": {
        "description": "Enable a disabled service account.",
        "operationId": "enableServiceAccount",
        "parameters": [
          {
            "in": "path",
            "name": "service_account_id",
            "required": true,
            "schema": {
              "title": "Service Account Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Enable Service Account",
        "tags": [
          "Service Accounts"
        ]
      }
    },
    "/service-accounts/{service_account_id}:generate-api-key": {
      "post": {
        "description": "Generate a new API key for a service account. Rotates any existing key.",
        "operationId": "generateServiceAccountApiKey",
        "parameters": [
          {
            "in": "path",
            "name": "service_account_id",
            "required": true,
            "schema": {
              "title": "Service Account Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ApiKeyResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Generate Service Account Api Key",
        "tags": [
          "Service Accounts"
        ]
      }
    },
    "/toolkits": {
      "get": {
        "description": "List toolkits with cursor-based pagination.",
        "operationId": "listToolkits",
        "parameters": [
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List toolkits",
        "tags": [
          "Toolkits"
        ]
      },
      "post": {
        "description": "Create a toolkit and issue its first API key.\n\nThe plaintext key (`jntc_live_…`) is returned **once** in `api_key` and is\nnever retrievable again. Optional `credential_ids` bind existing credentials\nat creation time; each inline bind emits a ``no_permission_rules`` warning\nbecause the broker denies by default until rules are added.",
        "operationId": "createToolkit",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ToolkitCreateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitCreateResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Create toolkit",
        "tags": [
          "Toolkits"
        ]
      }
    },
    "/toolkits/{toolkit_id}": {
      "delete": {
        "description": "Permanently delete a toolkit and cascade-remove its keys, bindings, and permission rules.",
        "operationId": "deleteToolkit",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Delete toolkit",
        "tags": [
          "Toolkits"
        ]
      },
      "get": {
        "description": "Get a single toolkit by its `tk_…` ID.",
        "operationId": "getToolkit",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get toolkit",
        "tags": [
          "Toolkits"
        ]
      },
      "patch": {
        "description": "Update a toolkit's name, description, or active flag.",
        "operationId": "updateToolkit",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ToolkitUpdateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Update toolkit",
        "tags": [
          "Toolkits"
        ]
      }
    },
    "/toolkits/{toolkit_id}/agents": {
      "get": {
        "description": "List agents bound to a toolkit with cursor-based pagination.",
        "operationId": "listToolkitAgents",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitAgentListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List agents bound to toolkit",
        "tags": [
          "Toolkits"
        ]
      }
    },
    "/toolkits/{toolkit_id}/credentials": {
      "get": {
        "description": "List the credentials bound to a toolkit with cursor-based pagination.",
        "operationId": "listBindings",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitCredentialListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List toolkit credential bindings",
        "tags": [
          "Toolkit Credentials"
        ]
      },
      "post": {
        "description": "Bind an existing credential to a toolkit, optionally with inline permission rules.",
        "operationId": "bindCredential",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ToolkitCredentialBindRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitCredentialBindingResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request conflicts with the current state of the resource.",
                  "instance": "/example/path",
                  "status": 409,
                  "title": "Conflict",
                  "type": "conflict"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Credential already bound"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Bind credential to toolkit",
        "tags": [
          "Toolkit Credentials"
        ]
      }
    },
    "/toolkits/{toolkit_id}/credentials/{credential_id}": {
      "delete": {
        "description": "Remove a credential binding from a toolkit (the credential itself is untouched).",
        "operationId": "unbindCredential",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "credential_id",
            "required": true,
            "schema": {
              "title": "Credential Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Unbind credential from toolkit",
        "tags": [
          "Toolkit Credentials"
        ]
      }
    },
    "/toolkits/{toolkit_id}/credentials/{credential_id}/permissions": {
      "get": {
        "description": "List the fine-grained PBAC rules for a `(toolkit, credential)` binding.",
        "operationId": "listToolkitPermissions",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "credential_id",
            "required": true,
            "schema": {
              "title": "Credential Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PermissionRuleListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List binding permission rules",
        "tags": [
          "Toolkit Permissions"
        ]
      },
      "patch": {
        "description": "Additively add and/or remove permission rules on a binding.",
        "operationId": "patchPermissions",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "credential_id",
            "required": true,
            "schema": {
              "title": "Credential Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PermissionsPatchRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PermissionRuleListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Patch binding permission rules",
        "tags": [
          "Toolkit Permissions"
        ]
      },
      "put": {
        "description": "Replace the full set of permission rules for a binding (idempotent PUT).",
        "operationId": "replacePermissions",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "credential_id",
            "required": true,
            "schema": {
              "title": "Credential Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "items": {
                  "$ref": "#/components/schemas/jentic_one__control__web__schemas__toolkits__PermissionRuleSchema"
                },
                "maxItems": 100,
                "title": "Body",
                "type": "array"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PermissionRuleListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Replace binding permission rules",
        "tags": [
          "Toolkit Permissions"
        ]
      }
    },
    "/toolkits/{toolkit_id}/credentials/{credential_id}/permissions:test": {
      "post": {
        "description": "Answer \"what would the broker do for this request?\" without calling upstream.\n\nEvaluates the same **vendor-pooled** rule set the broker sees at request\ntime — rules from all same-vendor bindings on this toolkit compete in one\nordered list. The response names which binding contributed the matching\nrule, which is not obvious from the toolkit id alone under pooling.",
        "operationId": "testToolkitPermissions",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "credential_id",
            "required": true,
            "schema": {
              "title": "Credential Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PermissionTestRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PermissionTestResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Dry-run permission evaluation",
        "tags": [
          "Toolkit Permissions"
        ]
      }
    },
    "/toolkits/{toolkit_id}/keys": {
      "get": {
        "description": "List a toolkit's API keys (redacted; only `key_preview` is shown).",
        "operationId": "listKeys",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitKeyListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List toolkit keys",
        "tags": [
          "Toolkit Keys"
        ]
      },
      "post": {
        "description": "Issue a new API key for a toolkit.\n\nThe plaintext value (`jntc_live_…`) is returned **once** in `api_key`. Issue\na fresh key, switch callers, then revoke the old one (do-and-then-revoke).",
        "operationId": "createKey",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ToolkitKeyCreateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitKeyCreateResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Issue toolkit key",
        "tags": [
          "Toolkit Keys"
        ]
      }
    },
    "/toolkits/{toolkit_id}/keys/{key_id}": {
      "delete": {
        "description": "Revoke (delete) a toolkit API key. Callers using it are rejected immediately.",
        "operationId": "deleteKey",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key_id",
            "required": true,
            "schema": {
              "title": "Key Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Revoke toolkit key",
        "tags": [
          "Toolkit Keys"
        ]
      },
      "patch": {
        "description": "Update a key's label, IP allowlist, or revoked flag.",
        "operationId": "updateKey",
        "parameters": [
          {
            "in": "path",
            "name": "toolkit_id",
            "required": true,
            "schema": {
              "title": "Toolkit Id",
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key_id",
            "required": true,
            "schema": {
              "title": "Key Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ToolkitKeyUpdateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ToolkitKeyResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The requested resource does not exist or is not visible to you.",
                  "instance": "/example/path",
                  "status": 404,
                  "title": "Not Found",
                  "type": "not_found"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Not Found"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Update toolkit key",
        "tags": [
          "Toolkit Keys"
        ]
      }
    },
    "/users": {
      "get": {
        "description": "List all users with cursor-based pagination.",
        "operationId": "listUsers",
        "parameters": [
          {
            "in": "query",
            "name": "cursor",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Cursor"
            }
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "default": 50,
              "maximum": 200,
              "minimum": 1,
              "title": "Limit",
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "invite_state",
            "required": false,
            "schema": {
              "anyOf": [
                {
                  "$ref": "#/components/schemas/InviteState"
                },
                {
                  "type": "null"
                }
              ],
              "title": "Invite State"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserListResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "List Users",
        "tags": [
          "Users"
        ]
      },
      "post": {
        "description": "Create a new user and issue an invite token.",
        "operationId": "createUser",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UserCreateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserCreatedResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Create User",
        "tags": [
          "Users"
        ]
      }
    },
    "/users/me": {
      "get": {
        "description": "Return the authenticated user's profile.",
        "operationId": "getCurrentUser",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CurrentUserResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get current user",
        "tags": [
          "Users"
        ]
      }
    },
    "/users/me:change-password": {
      "post": {
        "description": "Change the authenticated user's password and return a fresh token.\n\nA new token is required because the caller's current token still carries the\nstale ``must_change_password`` claim; returning a re-minted token is what\nactually clears the rotation gate client-side.",
        "operationId": "changePassword",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ChangePasswordRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LoginResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Change own password",
        "tags": [
          "Users"
        ]
      }
    },
    "/users/{user_id}": {
      "delete": {
        "description": "Soft-delete a user.",
        "operationId": "deleteUser",
        "parameters": [
          {
            "in": "path",
            "name": "user_id",
            "required": true,
            "schema": {
              "title": "User Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Delete User",
        "tags": [
          "Users"
        ]
      },
      "get": {
        "description": "Get a user by ID.",
        "operationId": "getUser",
        "parameters": [
          {
            "in": "path",
            "name": "user_id",
            "required": true,
            "schema": {
              "title": "User Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Get User",
        "tags": [
          "Users"
        ]
      },
      "patch": {
        "description": "Update a user's profile fields.",
        "operationId": "updateUser",
        "parameters": [
          {
            "in": "path",
            "name": "user_id",
            "required": true,
            "schema": {
              "title": "User Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/UserUpdateRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Update User",
        "tags": [
          "Users"
        ]
      }
    },
    "/users/{user_id}/permissions": {
      "put": {
        "description": "Set the assigned permissions for a user.",
        "operationId": "setUserPermissions",
        "parameters": [
          {
            "in": "path",
            "name": "user_id",
            "required": true,
            "schema": {
              "title": "User Id",
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SetPermissionsRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/UserResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Set User Permissions",
        "tags": [
          "Users"
        ]
      }
    },
    "/users/{user_id}:disable": {
      "post": {
        "description": "Disable a user account.",
        "operationId": "disableUser",
        "parameters": [
          {
            "in": "path",
            "name": "user_id",
            "required": true,
            "schema": {
              "title": "User Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Disable User",
        "tags": [
          "Users"
        ]
      }
    },
    "/users/{user_id}:enable": {
      "post": {
        "description": "Enable a user account.",
        "operationId": "enableUser",
        "parameters": [
          {
            "in": "path",
            "name": "user_id",
            "required": true,
            "schema": {
              "title": "User Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Enable User",
        "tags": [
          "Users"
        ]
      }
    },
    "/users/{user_id}:reissue-invite": {
      "post": {
        "description": "Reissue an invite token for a user.",
        "operationId": "reissueInvite",
        "parameters": [
          {
            "in": "path",
            "name": "user_id",
            "required": true,
            "schema": {
              "title": "User Id",
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InviteIssuedResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Authentication is required or the bearer token is invalid.",
                  "instance": "/example/path",
                  "status": 401,
                  "title": "Unauthorized",
                  "type": "unauthorized"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The authenticated principal lacks the required permission.",
                  "instance": "/example/path",
                  "status": 403,
                  "title": "Forbidden",
                  "type": "forbidden"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Forbidden"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [
          {
            "BearerAuth": []
          }
        ],
        "summary": "Reissue Invite",
        "tags": [
          "Users"
        ]
      }
    },
    "/users:create-admin": {
      "post": {
        "description": "First-run setup: create the first admin user and auto-login.\n\nUnauthenticated by design — there is no admin to authenticate as yet. The\noperation self-closes once any user exists (returns 410 ``setup_already_complete``\nthereafter), so it is safe to expose only during first boot.",
        "operationId": "createAdmin",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateAdminRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LoginResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "410": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The resource is no longer available and the operation has self-closed.",
                  "instance": "/example/path",
                  "status": 410,
                  "title": "Gone",
                  "type": "gone"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Setup already complete — the first admin exists and this endpoint is closed."
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Create first admin (one-time setup)",
        "tags": [
          "Users"
        ]
      }
    },
    "/users:redeem-invite": {
      "post": {
        "description": "Redeem an invite token, set password, and return a JWT.",
        "operationId": "redeemInvite",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/RedeemInviteRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/LoginResponse"
                }
              }
            },
            "description": "Successful Response"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The request was malformed or failed a precondition.",
                  "instance": "/example/path",
                  "status": 400,
                  "title": "Bad Request",
                  "type": "bad_request"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Bad Request"
          },
          "422": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "Request validation failed; see errors[] for details.",
                  "errors": [
                    {
                      "detail": "Field 'name' must not be blank.",
                      "pointer": "#/name"
                    }
                  ],
                  "instance": "/example/path",
                  "status": 422,
                  "title": "Unprocessable Entity",
                  "type": "validation_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Unprocessable Entity"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "An unexpected error occurred.",
                  "instance": "/example/path",
                  "status": 500,
                  "title": "Internal Server Error",
                  "type": "server_error"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "example": {
                  "detail": "The database is temporarily unavailable; please retry.",
                  "instance": "/example/path",
                  "status": 503,
                  "title": "Service Unavailable",
                  "type": "database_unavailable"
                },
                "schema": {
                  "$ref": "#/components/schemas/ProblemDetail"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Redeem invite",
        "tags": [
          "Users"
        ]
      }
    }
  },
  "security": [
    {
      "BearerAuth": []
    }
  ],
  "servers": [
    {
      "description": "Same-origin (relative)",
      "url": "/"
    }
  ],
  "tags": [
    {
      "description": "Part of the **Core / Access** bounded context — the authoritative record of \"who can call what, with which secret\". A `Credential` is the auth secret + header configuration the Broker injects on the way out to an upstream API. Credentials reference registry content via the loose `(vendor, name, version)` identity tuple (see `APIReference`) — there is no foreign key between Core and Registry, by design. Cleartext secret material is returned **exactly once** at creation (and on rotation via `PATCH`). Read paths return a redacted projection — last-N characters, hints, never the secret itself.",
      "name": "Credentials"
    },
    {
      "description": "Part of the **Core / Access** bounded context — a `Toolkit` is a scoped bundle of credentials and permissions issued to an agent or service. This tag covers **toolkit lifecycle**: list, create, read, update, delete. Sub-resources (keys, credential bindings, per-binding permission rules) live under the sibling tags `Toolkit Keys`, `Toolkit Credentials`, and `Toolkit Permissions`.\n\nTwo distinct values are involved: the **toolkit ID** is `tk_…` (public; appears in URLs, logs, and `Jentic-Toolkit-Id` headers), and the **toolkit secret** is `jntc_live_…` (private; the plaintext API key shown exactly once at toolkit creation or when a new key is issued).",
      "name": "Toolkits"
    },
    {
      "description": "Sub-resource of **Toolkits** (Core / Access bounded context). A toolkit can hold many API keys at once — different agents, machines, or environments typically each get their own. Each key record (`ck_…`) carries a label, optional CIDR allowlist, and a revoked flag. The plaintext value (`jntc_live_…`) is shown exactly once at creation and never returned afterwards (only `key_preview` exposes the last few characters).\n\nRotation is do-and-then-revoke: issue a fresh key, switch callers, then `DELETE` the old key. There is no in-place rotate operation — multi-key rotation is always do-and-then-revoke so live callers never see a window where every key is invalid.",
      "name": "Toolkit Keys"
    },
    {
      "description": "Sub-resource of **Toolkits** (Core / Access bounded context). A toolkit doesn't own credentials directly — it **binds** to credentials that already exist in `/credentials`. The binding is the link record that authorises the Broker to inject a specific credential on calls made under this toolkit. The same credential can be bound to many toolkits.\n\nBindings can carry initial fine-grained permission rules inline via `ToolkitCredentialBindRequest.permissions[]`; subsequent changes go through the `Toolkit Permissions` sub-resource.",
      "name": "Toolkit Credentials"
    },
    {
      "description": "Sub-resource of **Toolkits** (Core / Access bounded context). The fine-grained PBAC tier — per-`(toolkit, credential)` allow / deny / require-approval rules evaluated server-side. Rules use a priority model: `deny` > `require-approval` > `allow` — the strictest matching rule wins. Absence of a matching rule is an implicit deny. System rules (`_system: true`) participate in the same priority pool as user rules.\n\nToolkits have no separate scope tier of their own: a toolkit API key is minted with the fixed broker-execute scope (`capabilities:execute`), and every gated operation is decided by these per-binding rules.",
      "name": "Toolkit Permissions"
    },
    {
      "description": "Actor-agnostic, multi-item access-request surface (Core / Access bounded context). When an agent's brokered call is rejected by a permission rule — or the agent needs access it doesn't yet have — the agent files an `AccessRequest` containing one or more line items (`AccessRequestItem`). The request enters `pending` state and surfaces an `approve_url` that the agent presents to a human reviewer.\n\nReviewers `:decide` individual items (approve or deny each); filers can `:amend` pending items (adjust rules or target) or `:withdraw` the entire request. Each item transitions independently; the envelope status reflects the aggregate (`pending` while any item is pending, `partially_approved` when some items are decided but others remain, terminal once all items resolve).\n\nPending requests carry a TTL (default 7 days, configurable). Envelope lifecycle: `pending → partially_approved → approved | denied | withdrawn | expired`.\n\n**Identity scoping.** List and get operations are identity-scoped: filers see their own requests, reviewers see their inbox, `org:admin` sees all. Non-owners receive `404` (not `403`) to avoid leaking existence.\n\n**Security.** Mutating operations (`POST`, `:decide`, `:amend`, `:withdraw`) require `agents:write`; read operations require `agents:read`.",
      "name": "Access Requests"
    },
    {
      "description": "The `Api` aggregate root — what APIs are registered for this deployment, addressable by the loose `(vendor, name, version)` tuple. Every successful import lands a new immutable `ApiRevision`; the `Api` carries the live `current_revision_id` plus presentation metadata (`display_name`, `description`, `icon_url`).\n\nMutation surfaces:\n\n- `POST /apis` — async import (url / inline). Returns 202 + `Job (kind=import)`.\n- `PATCH /apis/{vendor}/{name}/{version}` — metadata-only updates (display name, description, icon). Cannot mutate revisions or spec content.\n- `POST /apis/{vendor}/{name}/{version}/revisions/{revision_id}:promote` — make a draft revision live.\n- `POST /apis/{vendor}/{name}/{version}/revisions/{revision_id}:archive` — retire a draft revision.\n- `DELETE /apis/{vendor}/{name}/{version}` — deregister the API and all its revisions.\n\nNewly imported revisions are **never auto-promoted** — callers must explicitly `:promote` to flip the live pointer. Hot-path Broker calls can pin to a specific revision via the `Jentic-Revision` request header for testing without flipping the pointer.\n\nSub-resources of an `Api` live under sibling tags: `API Operations` enumerates the operations exposed by a registered revision; `API Spec` returns the underlying OpenAPI document for tooling.",
      "name": "APIs"
    },
    {
      "description": "Sub-resource of **APIs** (Registry bounded context). Enumerate the operations exposed by a registered API — either the live (`current_revision_id`) view or a specific revision. Complements `Search` (ranked discovery) and `Inspect` (single-operation detail) by giving callers the deterministic list of every registered operation under one API without ranking, paging through `Search`, or parsing the spec.\n\nEach row is slim — the structural detail (parameters, response schema, security scheme) lives behind `_links.inspect` for callers that need it.",
      "name": "API Operations"
    },
    {
      "description": "Sub-resource of **APIs** (Registry bounded context). Download the underlying OpenAPI document for a registered API — either the live (`current_revision_id`) view or a specific revision. Supports `application/json`, `application/openapi+yaml`, and `application/yaml` via `Accept`-header content negotiation, with `Content-Disposition: attachment; filename=\"...\"` so browser downloads work cleanly.\n\nBy default the response includes any deployment-local overlays merged on top of the imported base. Pass `?overlays=false` to download the raw imported spec instead.",
      "name": "API Spec"
    },
    {
      "description": "The public API **catalog** — a registry-side browse/preview/import surface over the Jentic public-APIs GitHub manifest. Powers the Discover experience: list importable APIs (`GET /catalog`, keyset cursor-paginated), preview an entry's operations (`GET /catalog/{api_id}/operations`), refresh the cached manifest (`POST /catalog:refresh`, `org:admin`), and import an entry into the local registry (`POST /catalog/{api_id}:import`).\n\nThe catalog is a cache of an upstream document, distinct from the local registry (`GET /apis`): `/apis` is what this deployment has imported, `/catalog` is what it *could* import. Each entry's `registered` flag reflects whether its `spec_url` already backs a local API revision. Import resolves to a plain fetchable spec URL and reuses the standard async import job — no catalog identity ever crosses into the importer.",
      "name": "Catalog"
    },
    {
      "description": "Lexical (full-text) search across registered operations, ranked by relevance. Returns a slim row per operation; each row carries `_links.inspect` pointing into the `Inspect` tag for full structural detail.",
      "name": "Search"
    },
    {
      "description": "Resolve a single registered operation to its full structural detail — parameters, response schema, security scheme, server URL. Heavier than `Lookup` (which is the Broker hot path) and separate from `Search` (which only returns ranked summaries). Supports JSON, Markdown, and OpenAPI YAML response formats via `Accept`-header content negotiation.",
      "name": "Inspect"
    },
    {
      "description": "The Broker's read interface into Registry — fast, narrow lookup from a real-world URL to a Jentic `operation_id`. Hot path; not for human use. The capability map names this as the Execution → Registry read interface.",
      "name": "Lookup"
    },
    {
      "description": "Free-form annotations attached to registry resources — an `Api`, an `ApiRevision`, a registered `operation_id`, an `ExecutionRecord`, or a `Credential`. Used to capture human or agent observations about quirks: *\"this endpoint silently truncates email addresses to 64 chars\"*, *\"this credential rejects calls outside US business hours\"*, *\"this operation needs `Accept: application/json` even though the spec doesn't say so\"*.\n\nNotes are an information surface for agents — they accumulate over time as the platform learns from real executions and surface back through `_links.notes` on the resources they annotate (woven in by individual surfaces as they need it).\n\n**Edit model.** Notes are editable via `PATCH`; each successful edit bumps a monotonic `revision` counter on the `Note`. Use the `If-Match` header on `PATCH` and `DELETE` to guard against concurrent modification.\n\n**Confidence promotion.** Notes carry both a `confidence` value (`observed | suspected | verified`) and a `confidence_source` (`client | platform_promoted`). Today only `client` is written by callers; the `platform_promoted` value is reserved for a future surface that auto-promotes `observed` notes to `verified` once enough matching `execution_feedback` accumulates.\n\n**Authentication.** Any authenticated principal (agent or human) can post any note type. Per-type policy (e.g. only humans may file `correction`) is enforced platform-side and not modelled in the spec.",
      "name": "Notes"
    },
    {
      "description": "OpenAPI Overlay 1.0 (`https://spec.openapis.org/overlay/v1.0.0`) documents that correct an imported spec without rewriting it. Overlays capture wrong required fields, missing security schemes, undocumented headers, silent payload truncation, and other places where the upstream spec disagrees with the upstream API's actual behaviour — without forking the spec or waiting for an upstream fix.\n\nOverlays attach to the `Api` aggregate (not to a specific `ApiRevision`) and continue to apply across revision bumps until materially superseded. The optional `target_revision_id` records the revision the overlay was authored against, for auditing.\n\n**Lifecycle.** New overlays start in `pending`. The Broker calls `POST /apis/{vendor}/{name}/{version}/overlays/{overlay_id}:confirm` after the first successful upstream execution that exercised an overlay-patched operation, transitioning the overlay to `confirmed`. This is the platform's only documented data-plane → control-plane writeback. Once `confirmed`, an overlay stays `confirmed` — repeated `:confirm` calls return `200` with the existing record unchanged.\n\n**Edit model.** Overlay documents are editable via `PATCH` only while `pending`. Once `confirmed` (or `deprecated`), the document is immutable — to change a confirmed overlay, submit a new one and let the old one age out via `DELETE` (which soft-deprecates).\n\n**Deletion.** `DELETE` is a **soft-deprecation** — the row is preserved with `status: deprecated` for audit. Deprecated overlays no longer apply to spec-download merges (`?overlays=false` becomes the default for that overlay) but stay queryable via `GET`. There is no hard-delete in this surface.\n\n**Authentication.** Any authenticated principal (agent or human) can submit, edit, confirm, or deprecate overlays. Platform-side rate limits gate abuse.",
      "name": "Overlays"
    },
    {
      "description": "Append-only audit log of every Broker call (sync or async) — timing, status, trace IDs, and the upstream API reference (`vendor:name:version`). Bodies are not stored. Records are written by the Broker; this surface is read-only. To walk the history of a single logical request that fanned out into multiple upstream calls, list with `?trace_id={trace_id}`.",
      "name": "Executions"
    },
    {
      "description": "In-flight async-job tracker for both Registry import jobs and Broker async-execution jobs — one uniform `Job` shape keyed by `kind`. Lifecycle only — type-specific result payloads (the imported revisions for `import`, upstream response body for `execution`) live under `/jobs/{job_id}/result`. Result availability follows the organisation-level retention policy (one-shot or TTL); once that expires, both `/jobs/{job_id}` and `/jobs/{job_id}/result` `404`.",
      "name": "Jobs"
    },
    {
      "description": "Curated, severity-tagged event stream surfaced to dashboards and operators. Each event is either **informational** (no action required, e.g. `import.completed`) or **actionable** (requires operator follow-up, e.g. `credential.expiring_soon`, `execution.repeated_failure`). Events reference the underlying `ExecutionRecord` or `Job` via `_links` and share `trace_id` for correlation. Subscribe live via `GET /events/stream` (Server-Sent Events) or poll `GET /events` with a `since=` filter.",
      "name": "Events"
    },
    {
      "description": "Part of the **Admin / Audit** bounded context — the human roster of the organisation. One organisation, many users; admin surfaces here cover create / list / read / update / delete plus the AIP-style action verbs (`:disable`, `:enable`, `:reissue-invite`). Self-service is intentionally minimal: `GET /users/me` to introspect, `POST /users/me:change-password` to rotate (which re-mints and returns a fresh token, clearing any `must_change_password` gate so the caller need not re-login).\n\n**First-run setup (no default credentials).** The platform ships with an empty users table — there is no seeded `admin@local` account. On a fresh install `GET /health` reports `setup_required: true` (with `next_step: create_admin`). The operator creates the first administrator via `POST /users:create-admin {email, password}`: a one-time, unauthenticated endpoint that succeeds only while no user exists, grants `org:admin`, and returns an auto-login `LoginResponse` with `must_change_password: false` (the operator chose the password, so there is no forced rotation). It **self-closes** — once any user exists it returns `410 setup_already_complete`, so it is safe to leave exposed during first boot; a single-row setup sentinel is the concurrency backstop against racing callers (even ones using different emails). After the first user exists, `setup_required` flips to `false`.\n\n**Onboarding flow.** Admins create new users via `POST /users` (no password supplied). The response carries a one-time `inv_…` invite token shown **once**; the admin hands it off out-of-band (Slack, 1Password, email — there is no platform-side email infrastructure in this revision). The new user redeems via `POST /users:redeem-invite {invite_token, password}` and is auto-logged-in via the returned `LoginResponse`. Tokens default to a 7-day TTL and are single-use; `:reissue-invite` issues a fresh one if the original is lost or expired.\n\n**Authentication.** Today only local (username + password) identity ships. The `User` schema carries `auth_provider: local | external` and an `external_subject_id` field reserved for future SSO integrations (Okta, Cognito, Azure AD); when SSO arrives, those users will be created via a separate provider-specific router. The on-the-wire token contract — `Authorization: Bearer <jwt>` — is unchanged either way.\n\n**Disabling and revocation.** `:disable` flips `active=false` and rejects subsequent `POST /auth/login` **and** `POST /auth/refresh`. **Existing JWTs keep working until they expire** (≤ 1 hour with the platform's default TTL). This is a deliberate trade-off; sub-minute revocation would require a server-side session table.\n\n**Session lifetime.** Login JWTs carry a 1-hour TTL. The UI keeps an active session alive by calling `POST /auth/refresh` before expiry (sliding session); refresh re-reads permissions and the `must_change_password` gate from the database and is refused with 401 `session_expired` once the original authentication is older than the absolute window (`admin.auth.session_ttl_seconds`, 12 hours by default), forcing a fresh login.",
      "name": "Users"
    },
    {
      "description": "Part of the **Admin / Audit** bounded context — the catalogue of grantable permission strings. Permissions are namespaced `resource:action` strings (`users:write`, `capabilities:execute`, `credentials:read`, …) gating every other surface in the API. The set is platform-defined and small; `GET /permissions` returns it in full, with each entry describing what it does, what it implies (the static implication map; e.g. `capabilities:execute` implies `apis:read` and `executions:read`), and whether the calling user is authorised to grant it.\n\nOne reserved superpower short-circuits individual checks in code: `org:admin` (full deployment-wide access, granted via direct DB action). It is not enumerated to non-holders by `GET /permissions`, and is rejected by `PUT /users/{user_id}/permissions` from any caller who doesn't already hold it.\n\nThe same vocabulary is used for `User.permissions` — coarse JWT-embedded scopes — so the catalogue below covers user assignment. Toolkits have no separate scope tier of their own: a toolkit API key is minted with the fixed broker-execute scope, and the per-binding fine-grained `PermissionRule[]` (the inner PBAC tier) lives separately under the `Toolkit Permissions` tag.",
      "name": "Permissions"
    },
    {
      "description": "Operational endpoints for service health and platform tooling. Not part of any bounded context — surfaced here so orchestrators and load balancers have a stable probe target.",
      "name": "System"
    },
    {
      "description": "Identity introspection for the calling principal (human, agent, or service account) — `GET /me` returns the resolved subject, scopes, and permissions behind the presented token.",
      "name": "Identity"
    },
    {
      "description": "Agent actors — autonomous principals that call the Broker. Covers the agent lifecycle (list, read, approve / deny, enable / disable, archive) and the toolkits bound to each agent.",
      "name": "Agents"
    },
    {
      "description": "Machine principals for non-interactive integrations — lifecycle (create, list, read, approve / deny, enable / disable, archive) mirroring the agent surface.",
      "name": "Service Accounts"
    },
    {
      "description": "OAuth 2.0 / OIDC endpoints exposed by the platform authorization server — the authorize, token, introspection, revocation, and assertion-mint endpoints plus the redirect callback.",
      "name": "OAuth"
    },
    {
      "description": "Dynamic agent registration (RFC 7591-style) — register a new agent client, poll registration status, update, or delete a registration.",
      "name": "Agent Registration"
    },
    {
      "description": "Unauthenticated metadata discovery — the JWKS document and OAuth authorization server metadata under `/.well-known/*`.",
      "name": "Discovery"
    },
    {
      "description": "Unified actor directory — a lightweight read-only view across all actor types (users, agents, service accounts). Returns ID-to-name mappings for UI cache hydration so dashboards can display friendly names wherever an `actor_id` appears.",
      "name": "Actors"
    },
    {
      "description": "Append-only administrative audit trail — who did what, when. Distinct from `Executions` (brokered upstream calls); this records control-plane mutations.",
      "name": "Audit"
    },
    {
      "description": "Dashboard-oriented aggregation endpoints — execution volume, success/failure ratios, and top operations over a bounded time window. Results are cached in-process (TTL ~120 s) so concurrent dashboard viewers never stampede the database.",
      "name": "Monitoring"
    },
    {
      "description": "Runtime, DB-backed platform configuration. Lets an operator set, read, and list configuration that previously required hand-editing backend YAML and restarting the server — starting with credential provider configs (e.g. Pipedream). A successful write rebuilds the in-process provider registry so the change takes effect without a restart. Secret fields (e.g. `client_secret`) are encrypted at rest and redacted on read. **Topology note:** in the combined (single-process) deployment a write takes effect immediately for all surfaces. In a multi-process deployment the control/broker processes pick up the new config at their next boot, not the instant the admin write lands; cross-process propagation is a tracked follow-up.",
      "name": "Configuration"
    }
  ],
  "x-tagGroups": [
    {
      "name": "Core / Access",
      "tags": [
        "Credentials",
        "Toolkits",
        "Toolkit Keys",
        "Toolkit Credentials",
        "Toolkit Permissions",
        "Access Requests"
      ]
    },
    {
      "name": "Registry",
      "tags": [
        "APIs",
        "API Operations",
        "API Spec",
        "Catalog",
        "Search",
        "Inspect",
        "Lookup",
        "Notes",
        "Overlays"
      ]
    },
    {
      "name": "Admin / Audit",
      "tags": [
        "Users",
        "Actors",
        "Permissions",
        "Executions",
        "Jobs",
        "Events",
        "Audit",
        "Monitoring",
        "Configuration"
      ]
    },
    {
      "name": "Platform Actors",
      "tags": [
        "Identity",
        "Agents",
        "Service Accounts",
        "OAuth",
        "Agent Registration",
        "Discovery"
      ]
    },
    {
      "name": "Operations",
      "tags": [
        "System"
      ]
    }
  ]
}