{
  "basePath": "/api/v2",
  "definitions": {
    "ApiKey": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "expiresAt": {
          "description": "ExpiresAt is the key's expiration time (RFC3339), or nil if it never expires.",
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "lastUsedAt": {
          "type": "string"
        },
        "maskedValue": {
          "type": "string"
        },
        "token": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "Cluster": {
      "properties": {
        "clusterConfig": {
          "allOf": [
            {
              "$ref": "#/definitions/config.ClusterConfig"
            }
          ],
          "description": "Cluster config read from the cluster"
        },
        "createdAt": {
          "description": "The time when this cluster was registered with Signadot.",
          "type": "string"
        },
        "name": {
          "description": "The name of the cluster.",
          "type": "string"
        },
        "operator": {
          "allOf": [
            {
              "$ref": "#/definitions/cluster.Operator"
            }
          ],
          "description": "Information about the Signadot Operator in this cluster."
        }
      },
      "type": "object"
    },
    "ClusterToken": {
      "properties": {
        "createdAt": {
          "description": "The time when this cluster was registered with Signadot.",
          "type": "string"
        },
        "id": {
          "description": "The ID of this token",
          "type": "string"
        },
        "maskedValue": {
          "description": "A Masked token value.",
          "type": "string"
        },
        "status": {
          "allOf": [
            {
              "$ref": "#/definitions/ClusterTokenStatus"
            }
          ],
          "description": "Token status."
        },
        "token": {
          "description": "The token value.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ClusterTokenStatus": {
      "properties": {
        "lastConnectedAt": {
          "description": "The last time at which this token was used to connect.",
          "type": "string"
        },
        "lastConnectedIp": {
          "description": "The last IP address from which this token connected.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ConnectSession": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "renewedAt": {
          "type": "string"
        },
        "validUntil": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "Connection": {
      "properties": {
        "devboxId": {
          "description": "Required: deterministic ID from user+metadata hash",
          "type": "string"
        }
      },
      "type": "object"
    },
    "CreateApiKeyRequest": {
      "properties": {
        "description": {
          "description": "Description is an optional human-readable description.",
          "type": "string"
        },
        "expiresAt": {
          "description": "ExpiresAt is the key's expiration time (RFC3339 timestamp). Omitting the\nfield, or sending an explicit JSON null, both mean the key never\nexpires \u2014 so callers that predate this field keep their old behavior\nwith no changes required.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "CreatedBy": {
      "properties": {
        "kind": {
          "description": "Kind is \"User\", \"ServiceAccount\", or \"System\".",
          "type": "string"
        },
        "name": {
          "description": "Name is the user email or service-account name; empty for System.",
          "type": "string"
        },
        "publicId": {
          "description": "PublicID is the principal's public ID; empty for System.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "Devbox": {
      "properties": {
        "id": {
          "description": "Deterministic ID derived from the owning principal + metadata (\"name\"/\"machine-id\").",
          "type": "string"
        },
        "metadata": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Only \"name\" and \"machine-id\" are used for ID generation.",
          "type": "object"
        },
        "principal": {
          "allOf": [
            {
              "$ref": "#/definitions/DevboxPrincipal"
            }
          ],
          "description": "Owning principal."
        },
        "status": {
          "$ref": "#/definitions/DevboxStatus"
        },
        "user": {
          "description": "DEPRECATED: owner email for User-owned devboxes, empty otherwise; use principal instead.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "DevboxPrincipal": {
      "properties": {
        "kind": {
          "description": "Principal kind: \"User\" or \"ServiceAccount\".",
          "type": "string"
        },
        "name": {
          "description": "Display name: user email or service-account name.",
          "type": "string"
        },
        "publicId": {
          "description": "Principal public ID.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "DevboxRegistration": {
      "properties": {
        "claim": {
          "type": "boolean"
        },
        "metadata": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Required: metadata key-value pairs. Only \"name\" and \"machine-id\" are used for ID generation.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "DevboxStatus": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "session": {
          "$ref": "#/definitions/ConnectSession"
        },
        "updatedAt": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "DiffOp": {
      "properties": {
        "classification": {
          "$ref": "#/definitions/DiffOpClassification"
        },
        "oldValue": {},
        "op": {
          "$ref": "#/definitions/trafficmodels.DiffOperation"
        },
        "path": {
          "type": "string"
        },
        "value": {}
      },
      "type": "object"
    },
    "DiffOpClassification": {
      "properties": {
        "noise": {
          "type": "number"
        }
      },
      "type": "object"
    },
    "EmptyResponse": {
      "type": "object"
    },
    "ErrorResponse": {
      "properties": {
        "code": {
          "type": "integer"
        },
        "error": {
          "type": "string"
        },
        "requestId": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "EventAuthContext": {
      "properties": {
        "apiKeyMasked": {
          "description": "present when method == \"api_key\"",
          "type": "string"
        },
        "method": {
          "description": "\"jwt\" | \"api_key\" | \"system\"",
          "type": "string"
        }
      },
      "type": "object"
    },
    "EventPrincipal": {
      "properties": {
        "kind": {
          "description": "\"User\" | \"ServiceAccount\"",
          "type": "string"
        },
        "name": {
          "description": "user email or SA name (display)",
          "type": "string"
        },
        "publicId": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "EventQueryResult": {
      "properties": {
        "auth": {
          "allOf": [
            {
              "$ref": "#/definitions/EventAuthContext"
            }
          ],
          "description": "Auth is always present. Principal and OnBehalfOf are rendered as explicit\nnull (not omitted) when there is no principal — these are not omitempty so\nthe null is discoverable: principal is null for system actions and older\nevents whose user is gone; onBehalfOf is reserved (currently always null)."
        },
        "cursor": {
          "type": "string"
        },
        "data": {},
        "id": {
          "type": "string"
        },
        "onBehalfOf": {
          "$ref": "#/definitions/EventPrincipal"
        },
        "principal": {
          "$ref": "#/definitions/EventPrincipal"
        },
        "timestamp": {
          "type": "string"
        },
        "type": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "ExternalSpec": {
      "properties": {
        "branch": {
          "type": "string"
        },
        "commitSHA": {
          "type": "string"
        },
        "path": {
          "type": "string"
        },
        "repo": {
          "type": "string"
        },
        "script": {
          "type": "string"
        },
        "testName": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "HostedSpec": {
      "properties": {
        "testName": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "Job": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "deletedAt": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "spec": {
          "$ref": "#/definitions/job.Spec"
        },
        "status": {
          "$ref": "#/definitions/jobs.Status"
        }
      },
      "type": "object"
    },
    "JobArtifact": {
      "properties": {
        "lastModified": {
          "type": "string"
        },
        "path": {
          "type": "string"
        },
        "size": {
          "type": "integer"
        },
        "space": {
          "$ref": "#/definitions/artifacts.JobArtifactSpace"
        }
      },
      "type": "object"
    },
    "JobArtifactInfo": {
      "properties": {
        "checksumSHA256": {
          "type": "string"
        },
        "contentEncoding": {
          "type": "string"
        },
        "contentLength": {
          "type": "integer"
        },
        "contentType": {
          "type": "string"
        },
        "lastModified": {
          "type": "string"
        },
        "metadata": {
          "additionalProperties": {
            "type": "string"
          },
          "type": "object"
        }
      },
      "type": "object"
    },
    "JobRunnerGroup": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "deletedAt": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "spec": {
          "$ref": "#/definitions/jobRunnerGroup.Spec"
        },
        "status": {
          "$ref": "#/definitions/jobRunnerGroup.Status"
        },
        "updatedAt": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "ListApiKeysResponse": {
      "properties": {
        "apiKeys": {
          "items": {
            "$ref": "#/definitions/ApiKey"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "ListEventsResponse": {
      "properties": {
        "events": {
          "items": {
            "$ref": "#/definitions/EventQueryResult"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "PhaseCounts": {
      "properties": {
        "completed": {
          "description": "Completed is the number of steps that finished successfully.",
          "type": "integer"
        },
        "failed": {
          "description": "Failed is the number of steps that finished with an error.",
          "type": "integer"
        },
        "init": {
          "description": "Init is the number of steps that have not yet started.",
          "type": "integer"
        },
        "running": {
          "description": "Running is the number of steps currently executing.",
          "type": "integer"
        },
        "skipped": {
          "description": "Skipped is the number of steps that were not executed.",
          "type": "integer"
        },
        "waiting": {
          "description": "Waiting is the number of steps waiting for routing context readiness.",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "PlanAction": {
      "properties": {
        "id": {
          "type": "string"
        },
        "managedBy": {
          "description": "ManagedBy indicates whether this action is managed by the system\n(synced from git) or by an org (created via API).",
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "spec": {
          "$ref": "#/definitions/PlanActionSpec"
        },
        "status": {
          "$ref": "#/definitions/PlanActionStatus"
        }
      },
      "type": "object"
    },
    "PlanActionSpec": {
      "properties": {
        "body": {
          "description": "Body is the action implementation as markdown with code blocks.\nInputs and outputs are declared inline via \\input{...} and \\output{...} syntax.",
          "type": "string"
        },
        "published": {
          "description": "Published controls whether this action is visible and usable.",
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "PlanActionStatus": {
      "properties": {
        "bodyImage": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanImageRef"
            }
          ],
          "description": "BodyImage is the image directive parsed from \\image{...} in the body, if any."
        },
        "bodyOutputs": {
          "description": "BodyOutputs are the output fields parsed from \\output{...} directives in the body.",
          "items": {
            "$ref": "#/definitions/PlanField"
          },
          "type": "array"
        },
        "bodyParams": {
          "description": "BodyParams are the input parameters parsed from \\input{...} directives in the body.",
          "items": {
            "$ref": "#/definitions/PlanField"
          },
          "type": "array"
        },
        "createdAt": {
          "description": "CreatedAt is when the action was created. Serialized as RFC3339.",
          "type": "string"
        },
        "description": {
          "description": "Description is a short one-line description parsed from the \\description{...} directive in the body.",
          "type": "string"
        },
        "enabled": {
          "description": "Enabled is the org's effective view on whether this action can be used.\nResolved from per-org overrides and system defaults via the same\nprecedence the compile path applies. Distinct from Spec.Published,\nwhich is the action author's intent.",
          "type": "boolean"
        },
        "extraInputsSchemaPolicy": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanExtraInputsSchemaPolicy"
            }
          ],
          "description": "ExtraInputsSchemaPolicy is parsed from the \\extra_inputs_schema{...}\ndirective in the body. nil when the action did not declare one."
        },
        "revision": {
          "type": "integer"
        },
        "updatedAt": {
          "description": "UpdatedAt is when the action was last updated. Serialized as RFC3339.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanArgs": {
      "properties": {
        "refs": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Refs maps param names to reference expressions (e.g. \"params.cluster\", \"steps.foo.outputs.bar\").",
          "type": "object"
        },
        "values": {
          "description": "Values maps param names to literal JSON values.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "PlanArtifactRef": {
      "properties": {
        "checksum": {
          "description": "Checksum is the base64-encoded SHA-256 digest.",
          "type": "string"
        },
        "error": {
          "description": "Error is set if the artifact upload failed.",
          "type": "string"
        },
        "ready": {
          "description": "Ready is true once the artifact has been uploaded to S3.",
          "type": "boolean"
        },
        "size": {
          "description": "Size is the artifact size in bytes.",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "PlanClusterAffinity": {
      "properties": {
        "fromAnyTarget": {
          "description": "FromAnyTarget names a plan param whose value is a RoutingTarget.\nThe cluster is inferred from the variant provided at execution time\n(sandbox → sandbox cluster, routeGroup → RG cluster).",
          "type": "string"
        },
        "fromCluster": {
          "description": "FromCluster names a plan param whose value is a cluster name directly.",
          "type": "string"
        },
        "fromRouteGroup": {
          "description": "FromRouteGroup names a plan param whose value is a route group name.\nIf the route group is bound to a single cluster, it resolves automatically.\nIf the route group spans multiple clusters, the execution must specify\na cluster (validated against the route group's cluster set).",
          "type": "string"
        },
        "fromSandbox": {
          "description": "FromSandbox names a plan param whose value is a sandbox name.\nThe cluster is inferred from the sandbox's single cluster.",
          "type": "string"
        },
        "pattern": {
          "description": "Pattern is a glob pattern matched against cluster names (e.g. \"prod-*\",\n\"*\"). If the pattern matches exactly one connected cluster with an\navailable runner, it is used automatically. Otherwise, the execution\nmust specify a cluster.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanCompileInput": {
      "properties": {
        "prompt": {
          "description": "Prompt is the markdown source to compile into a Plan.",
          "type": "string"
        },
        "selectionHint": {
          "description": "SelectionHint, if set, is written onto the resulting plan's\nPlanSpec.SelectionHint field (the agent-readable \"when to pick\nthis plan\" hint surfaced on tag-list responses). Optional;\npreserved across `plan recompile`.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanDesiredImagesResponse": {
      "properties": {
        "images": {
          "items": {
            "$ref": "#/definitions/PlanImageSpec"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "PlanExecution": {
      "properties": {
        "id": {
          "type": "string"
        },
        "spec": {
          "$ref": "#/definitions/PlanExecutionSpec"
        },
        "status": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanExecutionStatus"
            }
          ],
          "description": "Status is the runtime execution state."
        }
      },
      "type": "object"
    },
    "PlanExecutionQueryResult": {
      "properties": {
        "cursor": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "spec": {
          "$ref": "#/definitions/PlanExecutionSpec"
        },
        "status": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanExecutionStatus"
            }
          ],
          "description": "Status is the runtime execution state."
        }
      },
      "type": "object"
    },
    "PlanExecutionSpec": {
      "properties": {
        "cluster": {
          "description": "Cluster is the target cluster for this execution.",
          "type": "string"
        },
        "params": {
          "description": "Params are the actual values bound to the plan's declared parameters.",
          "type": "object"
        },
        "planID": {
          "description": "PlanID is the ID of the compiled plan being executed.",
          "type": "string"
        },
        "runner": {
          "description": "Runner is the runner group name assigned to execute the plan.",
          "type": "string"
        },
        "secrets": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Secrets maps plan param names to org secret names. At dispatch time,\nthe control plane resolves each secret name to its decrypted value and\ndelivers it to the runner alongside regular params.\nAPI responses return the name mapping (never decrypted values).",
          "type": "object"
        }
      },
      "type": "object"
    },
    "PlanExecutionStatus": {
      "properties": {
        "completedAt": {
          "description": "CompletedAt is when the execution finished. Serialized as RFC3339.",
          "type": "string"
        },
        "createdAt": {
          "description": "CreatedAt is when the execution was created. Serialized as RFC3339.",
          "type": "string"
        },
        "error": {
          "description": "Error is a human-readable error message for execution-level failures\n(e.g. artifact upload failures, plan output resolution errors).\nStep-level errors are in StepStatus.Error.",
          "type": "string"
        },
        "inputs": {
          "description": "Inputs records how each plan-level input was resolved at dispatch\ntime. Populated at the transition to dispatching. Mirrors Outputs.",
          "items": {
            "$ref": "#/definitions/PlanInputStatus"
          },
          "type": "array"
        },
        "outputs": {
          "description": "Outputs contains the resolved plan-level outputs, populated on completion.",
          "items": {
            "$ref": "#/definitions/PlanOutputStatus"
          },
          "type": "array"
        },
        "phase": {
          "allOf": [
            {
              "$ref": "#/definitions/plans.ExecutionPhase"
            }
          ],
          "description": "Phase is the overall execution state."
        },
        "runnerHost": {
          "description": "RunnerHost is the hostname of the runner executing the plan.",
          "type": "string"
        },
        "stepCounts": {
          "allOf": [
            {
              "$ref": "#/definitions/PhaseCounts"
            }
          ],
          "description": "StepCounts contains the count of steps in each step phase."
        },
        "steps": {
          "description": "Steps contains the per-step runtime status.",
          "items": {
            "$ref": "#/definitions/PlanStepStatus"
          },
          "type": "array"
        },
        "updatedAt": {
          "description": "UpdatedAt is when the execution status was last updated. Serialized as RFC3339.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanExtraInputsSchemaPolicy": {
      "properties": {
        "default": {
          "description": "Default is the schema to apply when the plan author omitted one.\nEmpty (nil) when this primitive is not set.",
          "type": "object"
        },
        "require": {
          "description": "Require, when true, makes plan compile fail if any extra_input on\na step of this action is schemaless.",
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "PlanField": {
      "properties": {
        "default": {
          "description": "Default is the default value used when the field is not provided. Must conform to Schema if set.",
          "type": "object"
        },
        "metadata": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Metadata carries presentation hints and additional key-value pairs.\nWell-known keys: \"contentType\" (MIME type), \"displayName\" (UI label),\n\"encoding\" (e.g. \"base64\" for inlined binary values).",
          "type": "object"
        },
        "name": {
          "description": "Name is the field identifier, unique within the resource's params or outputs.",
          "type": "string"
        },
        "required": {
          "description": "Required indicates whether the field must be provided.",
          "type": "boolean"
        },
        "schema": {
          "description": "Schema is an optional JSON Schema describing the field's type and constraints.",
          "type": "object"
        },
        "schemaRef": {
          "description": "SchemaRef is an optional reference to an external schema (name, file, or URL).",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanImageRef": {
      "properties": {
        "env": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Env carries env entries with literal values (KEY -\u003e literal).\nApplies in both paths. Reserved runner-set keys (SIGNADOT_*, HOME,\nTMPDIR, PATH) silently lose to the runner's values on collision.",
          "type": "object"
        },
        "envFromInput": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "EnvFromInput carries env entries whose values resolve from a\ndeclared input at run time (KEY -\u003e input name). Applies in both\npaths. Same reserved-key filtering as Env. The same KEY may not\nappear in both Env and EnvFromInput.",
          "type": "object"
        },
        "inputName": {
          "description": "InputName names a declared input whose value at run time is the\nimage reference. Set when the action declared\n\\image{ref={\"input\":\"NAME\"}}. If the input resolves to the empty\nstring, the action runs in the runner's base image.",
          "type": "string"
        },
        "literal": {
          "description": "Literal is the image reference itself, e.g. \"alpine:3.19\". Set when\nthe action declared \\image{\"...\"} or \\image{ref=\"...\"}. An empty\nliteral means \"run in the runner's base image\".",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanImageSpec": {
      "properties": {
        "lastReferencedAt": {
          "description": "LastReferencedAt is the most recent timestamp at which a plan\nexecution or visible action referenced this ref, computed at the\napiserver. Zero when neither source supplies a timestamp.",
          "type": "string"
        },
        "ref": {
          "description": "Ref is the canonicalized image reference, e.g.\n\"index.docker.io/library/alpine:3.19\".",
          "type": "string"
        },
        "referenceCount": {
          "description": "ReferenceCount is the number of distinct plan executions and\nactions that referenced this ref over the apiserver's window.\nZero when neither source supplies a count.",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "PlanInputStatus": {
      "properties": {
        "name": {
          "description": "Name is the plan param name.",
          "type": "string"
        },
        "resolvedVia": {
          "allOf": [
            {
              "$ref": "#/definitions/plans.InputResolvedVia"
            }
          ],
          "description": "ResolvedVia is the source that populated the value. Valid values at\nplan scope: literal, callerSecret, default, unbound."
        },
        "secretName": {
          "description": "SecretName is the caller-supplied secret name when\nResolvedVia == callerSecret. Empty otherwise.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanLogStatus": {
      "properties": {
        "artifact": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanArtifactRef"
            }
          ],
          "description": "Artifact is a reference to the log stored in S3."
        },
        "stream": {
          "allOf": [
            {
              "$ref": "#/definitions/logs.LogType"
            }
          ],
          "description": "Stream is the log stream type (\"stdout\" or \"stderr\")."
        },
        "value": {
          "description": "Value holds the log content inline if small enough.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanOutputStatus": {
      "properties": {
        "artifact": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanArtifactRef"
            }
          ],
          "description": "Artifact holds a reference to the S3-stored output."
        },
        "drill": {
          "description": "Drill is the path of segments to walk inside the source step\noutput's parsed JSON to extract the actual plan output value. Set\nonly for drill plan outputs (e.g. [\"response\", \"statusCode\"] for\n\"steps.send.outputs.capture.response.statusCode\"). The drill is\napplied at download time by the apiserver — the runner records\nit but does not materialize the drilled value, so the source\nstep's existing artifact (or inline Value) is reused without any\nextra upload.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "metadata": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Metadata carries presentation hints (e.g. contentType, displayName).",
          "type": "object"
        },
        "name": {
          "description": "Name is the output field name.",
          "type": "string"
        },
        "stepRef": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanStepOutputRef"
            }
          ],
          "description": "StepRef identifies the source step output for alias and drill plan\noutputs. Set when the plan output is a direct reference to a step\noutput (steps.X.outputs.Y), regardless of whether the value is\ninlined or stored as an artifact, AND for drill outputs\n(steps.X.outputs.Y.field) where it identifies the source whose\nbytes the apiserver will fetch and walk via Drill."
        },
        "value": {
          "description": "Value holds the inlined output value (small text/JSON).",
          "type": "object"
        }
      },
      "type": "object"
    },
    "PlanRoutingContext": {
      "properties": {
        "literal": {
          "allOf": [
            {
              "$ref": "#/definitions/RoutingTarget"
            }
          ],
          "description": "Literal is an inline routing target."
        },
        "ref": {
          "allOf": [
            {
              "$ref": "#/definitions/RoutingTargetRef"
            }
          ],
          "description": "Ref contains reference expressions that resolve to a routing target."
        }
      },
      "type": "object"
    },
    "PlanRunnerGroup": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "deletedAt": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "spec": {
          "$ref": "#/definitions/planRunnerGroup.Spec"
        },
        "status": {
          "$ref": "#/definitions/planRunnerGroup.Status"
        },
        "updatedAt": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanRunnerGroupSettingsResponse": {
      "properties": {
        "clusters": {
          "items": {
            "$ref": "#/definitions/planRunnerGroup.ClusterSettings"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "PlanSpec": {
      "properties": {
        "cluster": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanClusterAffinity"
            }
          ],
          "description": "Cluster declares the plan's cluster affinity. If nil, the plan is\ncluster-agnostic and runs on any cluster with an available runner."
        },
        "output": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Output maps output names to reference expressions wiring step outputs to the plan's external interface.",
          "type": "object"
        },
        "params": {
          "description": "Params are the external parameters the plan accepts from its caller.",
          "items": {
            "$ref": "#/definitions/PlanField"
          },
          "type": "array"
        },
        "prompt": {
          "description": "Prompt is the natural-language prompt body that was compiled to produce this plan.\nEmpty for hand-created plans.",
          "type": "string"
        },
        "runner": {
          "description": "Runner is the plan author's preferred runner group name.\nIf set, this runner is used directly at execution time. Conflicts\nwith an execution-level runner.",
          "type": "string"
        },
        "selectionHint": {
          "description": "SelectionHint is a one-line agent-readable description of when to\npick this plan. Surfaced on tag-list responses so an agent\nscanning the catalog of tagged plans can pick by purpose\n(analogous to how an action's Description carries \"what this\naction does\"). Free-form prose; aim for one sentence.",
          "type": "string"
        },
        "steps": {
          "description": "Steps are the action invocations that make up the plan's DAG.",
          "items": {
            "$ref": "#/definitions/PlanStep"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "PlanStatus": {
      "properties": {
        "compiledFrom": {
          "description": "CompiledFrom is the planID of the source plan, if this plan was produced\nby recompiling an existing plan via POST /plans/{id}/compile.",
          "type": "string"
        },
        "createdAt": {
          "description": "CreatedAt is when the plan was created. Serialized as RFC3339.",
          "type": "string"
        },
        "createdBy": {
          "allOf": [
            {
              "$ref": "#/definitions/CreatedBy"
            }
          ],
          "description": "CreatedBy describes who created this plan."
        },
        "executions": {
          "type": "integer"
        },
        "stepDependencies": {
          "additionalProperties": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "description": "StepDependencies is the step dependency graph, computed from ref expressions.\nKeys are step IDs; values are the step IDs that step depends on.",
          "type": "object"
        }
      },
      "type": "object"
    },
    "PlanStep": {
      "properties": {
        "action": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanStepAction"
            }
          ],
          "description": "Action is the inlined action contract for this step."
        },
        "args": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanArgs"
            }
          ],
          "description": "Args provides the refs and literal values bound to the action's params\nand extra inputs."
        },
        "condition": {
          "description": "Condition is an expr-lang expression evaluated against the step's resolved\nargs. Must evaluate to true for the step to execute.",
          "type": "string"
        },
        "extraInputs": {
          "description": "ExtraInputs declares additional named inputs for this step beyond\nthe action's declared params. These are wired via Args.Refs like\nregular params and become part of the action's eval environment.",
          "items": {
            "$ref": "#/definitions/PlanField"
          },
          "type": "array"
        },
        "extraOutputs": {
          "description": "ExtraOutputs declares additional named outputs for this step beyond\nthe action's declared outputs. The action writes these to ./outputs/\u003cname\u003e\nand the runner reads them back according to their schema declarations.\nNames must not shadow the action's declared outputs.",
          "items": {
            "$ref": "#/definitions/PlanField"
          },
          "type": "array"
        },
        "id": {
          "description": "ID is the unique identifier for this step within the plan.",
          "type": "string"
        },
        "routingContext": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanRoutingContext"
            }
          ],
          "description": "RoutingContext specifies the sandbox or route group this step targets."
        }
      },
      "type": "object"
    },
    "PlanStepAction": {
      "properties": {
        "actionID": {
          "description": "ActionID is the action's ID. The only field a hand-authored plan\nmust set on a step's action; the server hydrates the rest.",
          "type": "string"
        },
        "body": {
          "description": "Body is the action implementation (markdown with code blocks).",
          "type": "string"
        },
        "extraInputsSchemaPolicy": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanExtraInputsSchemaPolicy"
            }
          ],
          "description": "ExtraInputsSchemaPolicy declares how missing schemas on this\nstep's extra_inputs are resolved. Nil when the action did not\ndeclare an \\extra_inputs_schema{...} directive."
        },
        "image": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanImageRef"
            }
          ],
          "description": "Image, if set, declares that the action's shell fenced block runs\ninside an OCI image via actionbox run-image. Either Literal or\nInputName is set; never both."
        },
        "name": {
          "description": "Name is the action's name at the time the snapshot was taken.\nDisplay label, not the canonical identifier — ActionID is. At\ncreate time the snapshot must round-trip the registry (an\nexplicitly supplied Name that doesn't match is rejected); at\nexecute time the snapshot is honored as-is so renames in the\nregistry don't break stored plans. Filled from the registry when\nomitted on input; otherwise preserved as supplied.",
          "type": "string"
        },
        "outputs": {
          "description": "Outputs are the output fields parsed from the action's body.",
          "items": {
            "$ref": "#/definitions/PlanField"
          },
          "type": "array"
        },
        "params": {
          "description": "Params are the input parameters parsed from the action's body.",
          "items": {
            "$ref": "#/definitions/PlanField"
          },
          "type": "array"
        },
        "revision": {
          "description": "Revision is the registered action revision the snapshot was taken\nfrom. Optional on input — set to pin the step to a historical\nrevision; otherwise the action's current revision is recorded.",
          "type": "integer"
        },
        "timeout": {
          "description": "Timeout is a literal wall-clock duration string (parsed via\ntime.ParseDuration, e.g. \"60s\", \"5m\") parsed from the top-level\n\\timeout{\"...\"} directive. Empty means the system default cap\napplies. Mutually exclusive with TimeoutInputName.",
          "type": "string"
        },
        "timeoutInputName": {
          "description": "TimeoutInputName names a declared input whose value at run time is\nthe duration string. Set when the action declared\n\\timeout{{\"input\":\"NAME\"}}. Mutually exclusive with Timeout.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanStepInputStatus": {
      "properties": {
        "name": {
          "description": "Name is the step input name (action param or extra input).",
          "type": "string"
        },
        "ref": {
          "description": "Ref is the ref expression text when ResolvedVia == ref\n(e.g. \"params.region\", \"steps.s1.outputs.token\").",
          "type": "string"
        },
        "resolvedVia": {
          "allOf": [
            {
              "$ref": "#/definitions/plans.InputResolvedVia"
            }
          ],
          "description": "ResolvedVia is the source that populated the value. Valid values at\nstep scope: literal, ref, default, unbound."
        }
      },
      "type": "object"
    },
    "PlanStepOutputRef": {
      "properties": {
        "outputName": {
          "type": "string"
        },
        "stepID": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanStepOutputStatus": {
      "properties": {
        "artifact": {
          "allOf": [
            {
              "$ref": "#/definitions/PlanArtifactRef"
            }
          ],
          "description": "Artifact holds a reference to the S3-stored output."
        },
        "metadata": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Metadata carries presentation hints (e.g. contentType, displayName).",
          "type": "object"
        },
        "name": {
          "description": "Name is the output field name.",
          "type": "string"
        },
        "value": {
          "description": "Value holds the inlined output value (small text/JSON).",
          "type": "object"
        }
      },
      "type": "object"
    },
    "PlanStepStatus": {
      "properties": {
        "error": {
          "description": "Error is a human-readable error message, populated when Phase is failed.",
          "type": "string"
        },
        "id": {
          "description": "ID is the step identifier, matching the corresponding Step.ID in the spec.",
          "type": "string"
        },
        "inputs": {
          "description": "Inputs records how each of this step's declared inputs was resolved.\nPopulated at the transition to running. Mirrors Outputs.",
          "items": {
            "$ref": "#/definitions/PlanStepInputStatus"
          },
          "type": "array"
        },
        "logs": {
          "description": "Logs contains the step's captured log streams (stdout, stderr),\npopulated when the step reaches a terminal phase.",
          "items": {
            "$ref": "#/definitions/PlanLogStatus"
          },
          "type": "array"
        },
        "outputs": {
          "description": "Outputs contains the step's output statuses, populated when Phase is completed.",
          "items": {
            "$ref": "#/definitions/PlanStepOutputStatus"
          },
          "type": "array"
        },
        "phase": {
          "allOf": [
            {
              "$ref": "#/definitions/plans.StepPhase"
            }
          ],
          "description": "Phase is the current execution state of the step."
        }
      },
      "type": "object"
    },
    "PlanTag": {
      "properties": {
        "history": {
          "items": {
            "$ref": "#/definitions/TagMapping"
          },
          "type": "array"
        },
        "name": {
          "description": "Name is the unique tag name within the org.",
          "type": "string"
        },
        "plan": {
          "allOf": [
            {
              "$ref": "#/definitions/RunnablePlan"
            }
          ],
          "description": "Plan is the resolved plan this tag points to. Populated in responses."
        },
        "spec": {
          "$ref": "#/definitions/PlanTagSpec"
        },
        "status": {
          "$ref": "#/definitions/PlanTagStatus"
        }
      },
      "type": "object"
    },
    "PlanTagSpec": {
      "properties": {
        "planID": {
          "description": "PlanID is the ID of the plan this tag points to.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PlanTagStatus": {
      "properties": {
        "createdAt": {
          "description": "CreatedAt is when the tag was created. Serialized as RFC3339.",
          "type": "string"
        },
        "updatedAt": {
          "description": "UpdatedAt is when the tag was last updated. Serialized as RFC3339.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "RequestDiff": {
      "properties": {
        "baseline": {
          "$ref": "#/definitions/capture.Request"
        },
        "diffOps": {
          "items": {
            "$ref": "#/definitions/DiffOp"
          },
          "type": "array"
        },
        "target": {
          "$ref": "#/definitions/capture.Request"
        }
      },
      "type": "object"
    },
    "ResourceInfo": {
      "properties": {
        "cluster": {
          "description": "Cluster that the resource is created in",
          "type": "string"
        },
        "name": {
          "description": "Name of the created resource",
          "type": "string"
        },
        "sandbox": {
          "description": "Name of the sandbox containing the resource",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ResourcePlugin": {
      "properties": {
        "createdAt": {
          "description": "The time at which the resource plugin was created",
          "type": "string"
        },
        "name": {
          "description": "Plugin identity of the form `bareName[@semver]`. The bare-name\nform (no `@`) means the default version (0.0.0); responses\nfor plugins at the default version use this bare form for\nbackward compatibility with pre-versioning clients.",
          "example": "my-plugin@1.2.0",
          "type": "string"
        },
        "spec": {
          "allOf": [
            {
              "$ref": "#/definitions/resourceplugin.Spec"
            }
          ],
          "description": "Specification for the resource plugin"
        },
        "status": {
          "allOf": [
            {
              "$ref": "#/definitions/resourceplugin.Status"
            }
          ],
          "description": "Status of the resource plugin"
        },
        "updatedAt": {
          "description": "The time at which the resource plugin was last updated",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ResponseDiff": {
      "properties": {
        "baseline": {
          "$ref": "#/definitions/capture.Response"
        },
        "diffOps": {
          "items": {
            "$ref": "#/definitions/DiffOp"
          },
          "type": "array"
        },
        "target": {
          "$ref": "#/definitions/capture.Response"
        }
      },
      "type": "object"
    },
    "RouteGroup": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "defaults": {
          "$ref": "#/definitions/defaults.CompositeDefaults"
        },
        "endpoints": {
          "items": {
            "$ref": "#/definitions/routegroups.EndpointURL"
          },
          "type": "array",
          "x-omitempty": true
        },
        "name": {
          "type": "string"
        },
        "routingKey": {
          "type": "string"
        },
        "spec": {
          "$ref": "#/definitions/routeGroup.Spec"
        },
        "status": {
          "$ref": "#/definitions/routeGroup.Status"
        },
        "updatedAt": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "RoutingTarget": {
      "properties": {
        "routeGroup": {
          "description": "RouteGroup is the name of the target route group.",
          "type": "string"
        },
        "routingKey": {
          "description": "RoutingKey is the routing key used to direct traffic.",
          "type": "string"
        },
        "sandbox": {
          "description": "Sandbox is the name of the target sandbox.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "RoutingTargetRef": {
      "properties": {
        "anyRef": {
          "description": "AnyRef is a reference to a plan param whose value is a RoutingTarget\n(polymorphic — the caller decides sandbox, routeGroup, or routingKey).",
          "type": "string"
        },
        "routeGroupRef": {
          "description": "RouteGroupRef is a reference expression that resolves to a route group name.",
          "type": "string"
        },
        "routingKeyRef": {
          "description": "RoutingKeyRef is a reference expression that resolves to a routing key.",
          "type": "string"
        },
        "sandboxRef": {
          "description": "SandboxRef is a reference expression that resolves to a sandbox name.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "RunnablePlan": {
      "properties": {
        "id": {
          "type": "string"
        },
        "spec": {
          "$ref": "#/definitions/PlanSpec"
        },
        "status": {
          "$ref": "#/definitions/PlanStatus"
        }
      },
      "type": "object"
    },
    "Sandbox": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "defaults": {
          "$ref": "#/definitions/defaults.CompositeDefaults"
        },
        "endpoints": {
          "items": {
            "$ref": "#/definitions/sandbox.Endpoint"
          },
          "type": "array"
        },
        "name": {
          "description": "Human-readable name of this sandbox",
          "type": "string"
        },
        "routingKey": {
          "type": "string"
        },
        "spec": {
          "$ref": "#/definitions/sandbox.Spec"
        },
        "status": {
          "allOf": [
            {
              "$ref": "#/definitions/sandbox.Readiness"
            }
          ],
          "description": "Status *sdv1.SandboxReadiness `json:\"status,omitempty\"`"
        },
        "updatedAt": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "Secret": {
      "properties": {
        "createdAt": {
          "description": "CreatedAt is when the secret was created. Read-only.",
          "type": "string"
        },
        "description": {
          "description": "Description is an optional human-readable description.",
          "type": "string"
        },
        "name": {
          "description": "Name is the unique identifier within the org.",
          "type": "string"
        },
        "updatedAt": {
          "description": "UpdatedAt is when the secret was last updated. Read-only.",
          "type": "string"
        },
        "value": {
          "description": "Value is the secret plaintext. Write-only: accepted on create/update,\nnever returned in any API response.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ServiceAccount": {
      "properties": {
        "createdAt": {
          "description": "CreatedAt is when the service account was created. Read-only.",
          "type": "string"
        },
        "description": {
          "description": "Description is an optional human-readable description.",
          "type": "string"
        },
        "name": {
          "description": "Name is the unique identifier within the org.",
          "type": "string"
        },
        "role": {
          "description": "Role is the authorization role for the service account: \"admin\" or\n\"member\".",
          "type": "string"
        },
        "updatedAt": {
          "description": "UpdatedAt is when the service account was last updated. Read-only.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "Source": {
      "properties": {
        "id": {
          "type": "string"
        },
        "requestName": {
          "type": "string"
        },
        "scriptRef": {
          "$ref": "#/definitions/capturemeta.ScriptRef"
        }
      },
      "type": "object"
    },
    "TagMapping": {
      "properties": {
        "planID": {
          "description": "PlanID is the plan this tag pointed to during this period.",
          "type": "string"
        },
        "taggedAt": {
          "description": "TaggedAt is when the tag was assigned to this plan. Serialized as RFC3339.",
          "type": "string"
        },
        "untaggedAt": {
          "description": "UntaggedAt is when the tag was moved or deleted. Empty if current.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "Test": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "spec": {
          "$ref": "#/definitions/TestSpec"
        },
        "status": {
          "$ref": "#/definitions/TestStatus"
        },
        "updatedAt": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "TestExecution": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "results": {
          "$ref": "#/definitions/TestExecutionResults"
        },
        "spec": {
          "$ref": "#/definitions/TestExecutionSpec"
        },
        "status": {
          "$ref": "#/definitions/TestExecutionStatus"
        }
      },
      "type": "object"
    },
    "TestExecutionAutoDiff": {
      "properties": {
        "enabled": {
          "description": "Enabled = true, requires the definition of a valid routing context",
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "TestExecutionCanceledState": {
      "properties": {
        "canceledAt": {
          "type": "string"
        },
        "canceledBy": {
          "$ref": "#/definitions/jobs.CanceledBy"
        },
        "message": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "TestExecutionContext": {
      "properties": {
        "autoDiff": {
          "$ref": "#/definitions/TestExecutionAutoDiff"
        },
        "cluster": {
          "type": "string"
        },
        "publish": {
          "description": "Publish represents whether the test execution will show up by default\nin the UI, i.e. to filter out ad-hoc and test the test usage.",
          "type": "boolean"
        },
        "routing": {
          "$ref": "#/definitions/job.RoutingContext"
        },
        "runID": {
          "type": "string"
        },
        "timeout": {
          "description": "Timeout represents an optional timeout for the test execution.\nIf not supplied, it defaults to the DefaultTimeout of the associated\ntest, if that is present.  If that is not present, it defaults to \"5m\".\nIt should be a string representing an unsigned integer not exceeding 32 bits followed by\na units character, which can be one of the following.\n  - 'm' for minutes\n  - 'h' for hours\n  - 'd' for days\n  - 'w' for weeks",
          "type": "string"
        }
      },
      "type": "object"
    },
    "TestExecutionFailedState": {
      "properties": {
        "message": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "TestExecutionResults": {
      "properties": {
        "checks": {
          "$ref": "#/definitions/testexecutions.Checks"
        },
        "trafficDiff": {
          "$ref": "#/definitions/TrafficDiff"
        }
      },
      "type": "object"
    },
    "TestExecutionSpec": {
      "properties": {
        "executionContext": {
          "allOf": [
            {
              "$ref": "#/definitions/TestExecutionContext"
            }
          ],
          "description": "Execution context"
        },
        "external": {
          "$ref": "#/definitions/ExternalSpec"
        },
        "hosted": {
          "allOf": [
            {
              "$ref": "#/definitions/HostedSpec"
            }
          ],
          "description": "Hosted/External source information, these are one or the other"
        },
        "labels": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Labels",
          "type": "object"
        }
      },
      "type": "object"
    },
    "TestExecutionState": {
      "properties": {
        "canceled": {
          "$ref": "#/definitions/TestExecutionCanceledState"
        },
        "failed": {
          "$ref": "#/definitions/TestExecutionFailedState"
        }
      },
      "type": "object"
    },
    "TestExecutionStatus": {
      "properties": {
        "baselineJob": {
          "type": "string"
        },
        "finalState": {
          "$ref": "#/definitions/TestExecutionState"
        },
        "finishedAt": {
          "type": "string"
        },
        "phase": {
          "$ref": "#/definitions/testexecutions.Phase"
        },
        "startedAt": {
          "type": "string"
        },
        "targetJob": {
          "type": "string"
        },
        "testDeletedAt": {
          "type": "string"
        },
        "triggeredBy": {
          "allOf": [
            {
              "$ref": "#/definitions/TestExecutionTriggeredBy"
            }
          ],
          "description": "info about the trigger of the execution, empty means a manual trigger"
        }
      },
      "type": "object"
    },
    "TestExecutionTemplate": {
      "properties": {
        "autoDiff": {
          "$ref": "#/definitions/TestExecutionAutoDiff"
        },
        "cluster": {
          "type": "string"
        },
        "publish": {
          "description": "Publish represents whether the test execution will show up by default\nin the UI, i.e. to filter out ad-hoc and test the test usage.",
          "type": "boolean"
        },
        "timeout": {
          "description": "Timeout represents an optional timeout for the test execution.\nIf not supplied, it defaults to the DefaultTimeout of the associated\ntest, if that is present.  If that is not present, it defaults to \"5m\".\nIt should be a string representing an unsigned integer not exceeding 32 bits followed by\na units character, which can be one of the following.\n  - 'm' for minutes\n  - 'h' for hours\n  - 'd' for days\n  - 'w' for weeks",
          "type": "string"
        }
      },
      "type": "object"
    },
    "TestExecutionTriggeredBy": {
      "properties": {
        "sandbox": {
          "type": "string"
        },
        "trigger": {
          "$ref": "#/definitions/TestTrigger"
        }
      },
      "type": "object"
    },
    "TestSpec": {
      "properties": {
        "defaultTimeout": {
          "description": "DefaultTimeout represents an optional default timeout for the test\nexecutions associated with this test, which can override this value.\nIf not supplied, it defaults to \"5m\".  It should be a string\nrepresenting an unsigned integer in decimal not exceeding 32 bits\nfollowed by a units character, which can be one of the following.\n  - 'm' for minutes\n  - 'h' for hours\n  - 'd' for days\n  - 'w' for weeks",
          "type": "string"
        },
        "script": {
          "type": "string"
        },
        "triggers": {
          "items": {
            "$ref": "#/definitions/TestTrigger"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "TestStatus": {
      "type": "object"
    },
    "TestTrigger": {
      "properties": {
        "executionTemplate": {
          "allOf": [
            {
              "$ref": "#/definitions/TestExecutionTemplate"
            }
          ],
          "description": "ExecutionTemplate specifies a template for creating the actual execution"
        },
        "id": {
          "type": "string"
        },
        "sandboxOf": {
          "allOf": [
            {
              "$ref": "#/definitions/workload.Workload"
            }
          ],
          "description": "SandboxOf specifies a workload that when being sandboxed, will\ntrigger an execution of the test (for now, only forks are supported)"
        }
      },
      "type": "object"
    },
    "TrafficDiff": {
      "properties": {
        "additions": {
          "type": "integer"
        },
        "baselineSession": {
          "type": "string"
        },
        "capturePoints": {
          "items": {
            "$ref": "#/definitions/trafficmodels.By"
          },
          "type": "array"
        },
        "captures": {
          "type": "integer"
        },
        "green": {
          "$ref": "#/definitions/TrafficDiffSummary"
        },
        "maxRelevance": {
          "type": "number"
        },
        "red": {
          "$ref": "#/definitions/TrafficDiffSummary"
        },
        "removals": {
          "type": "integer"
        },
        "replacements": {
          "type": "integer"
        },
        "targetSession": {
          "type": "string"
        },
        "unpairedCaptures": {
          "items": {
            "$ref": "#/definitions/testexecutions.UnpairedCapture"
          },
          "type": "array"
        },
        "yellow": {
          "$ref": "#/definitions/TrafficDiffSummary"
        }
      },
      "type": "object"
    },
    "TrafficDiffPairedDiff": {
      "properties": {
        "baselineCaptureID": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "request": {
          "$ref": "#/definitions/RequestDiff"
        },
        "response": {
          "$ref": "#/definitions/ResponseDiff"
        },
        "source": {
          "$ref": "#/definitions/Source"
        },
        "targetCaptureID": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "TrafficDiffPointResult": {
      "properties": {
        "by": {
          "$ref": "#/definitions/trafficmodels.By"
        },
        "diffs": {
          "items": {
            "$ref": "#/definitions/TrafficDiffPairedDiff"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "TrafficDiffResult": {
      "properties": {
        "baseline": {
          "type": "string"
        },
        "results": {
          "items": {
            "$ref": "#/definitions/TrafficDiffPointResult"
          },
          "type": "array"
        },
        "target": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "TrafficDiffSummary": {
      "properties": {
        "additions": {
          "type": "integer"
        },
        "captures": {
          "type": "integer"
        },
        "maxRelevance": {
          "type": "number"
        },
        "removals": {
          "type": "integer"
        },
        "replacements": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "artifacts.JobArtifactSpace": {
      "enum": [
        "user",
        "system"
      ],
      "type": "string",
      "x-enum-varnames": [
        "UserSpace",
        "SystemSpace"
      ]
    },
    "authdevices.Code": {
      "properties": {
        "deviceCode": {
          "type": "string"
        },
        "expiresIn": {
          "type": "integer"
        },
        "interval": {
          "type": "integer"
        },
        "userCode": {
          "type": "string"
        },
        "verificationURI": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "authdevices.Status": {
      "enum": [
        "pending",
        "slow_down",
        "completed"
      ],
      "type": "string",
      "x-enum-varnames": [
        "PendingStatus",
        "SlowDownStatus",
        "CompletedStatus"
      ]
    },
    "authdevices.Token": {
      "properties": {
        "accessToken": {
          "type": "string"
        },
        "expiresIn": {
          "type": "integer"
        },
        "refreshToken": {
          "type": "string"
        },
        "status": {
          "$ref": "#/definitions/authdevices.Status"
        }
      },
      "type": "object"
    },
    "authdevices.TokenInput": {
      "properties": {
        "deviceCode": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "authtypes.UserFlags": {
      "additionalProperties": {
        "type": "boolean"
      },
      "type": "object"
    },
    "capture.Message": {
      "properties": {
        "body": {},
        "finishedAt": {
          "type": "string"
        },
        "headers": {
          "$ref": "#/definitions/capture.Values"
        },
        "startedAt": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "capture.Request": {
      "properties": {
        "host": {
          "type": "string"
        },
        "message": {
          "$ref": "#/definitions/capture.Message"
        },
        "method": {
          "type": "string"
        },
        "proto": {
          "type": "string"
        },
        "query": {
          "additionalProperties": {
            "type": "string"
          },
          "type": "object"
        },
        "uri": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "capture.Response": {
      "properties": {
        "error": {
          "type": "string"
        },
        "message": {
          "$ref": "#/definitions/capture.Message"
        },
        "proto": {
          "type": "string"
        },
        "statusCode": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "capture.Values": {
      "additionalProperties": {
        "type": "string"
      },
      "type": "object"
    },
    "capturemeta.ScriptRef": {
      "properties": {
        "callNum": {
          "description": "call number",
          "type": "integer"
        },
        "col": {
          "description": "1-based column (rune) number; 0 if column unknown",
          "type": "integer"
        },
        "file": {
          "description": "filename",
          "type": "string"
        },
        "line": {
          "description": "1-based line number; 0 if line unknown",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "cluster.Operator": {
      "properties": {
        "version": {
          "description": "The operator version of the cluster.  This may be\nnil if the cluster has not yet connected to Signadot.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "clusters.DevMeshEnabledWorkload": {
      "properties": {
        "statusCounts": {
          "items": {
            "$ref": "#/definitions/clusters.DevMeshWorkloadStatusCount"
          },
          "type": "array"
        },
        "workload": {
          "$ref": "#/definitions/workload.Workload"
        }
      },
      "type": "object"
    },
    "clusters.DevMeshWorkloadStatus": {
      "enum": [
        "ok",
        "missing",
        "needs_update"
      ],
      "type": "string",
      "x-enum-varnames": [
        "OKDevMeshWorkloadStatus",
        "MissingDevMeshWorkloadStatus",
        "NeedsUpdateDevMeshWorkloadStatus"
      ]
    },
    "clusters.DevMeshWorkloadStatusCount": {
      "properties": {
        "count": {
          "type": "integer"
        },
        "status": {
          "$ref": "#/definitions/clusters.DevMeshWorkloadStatus"
        }
      },
      "type": "object"
    },
    "config.ClusterConfig": {
      "properties": {
        "allowOrphanedResources": {
          "type": "boolean"
        },
        "allowedNamespaces": {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "controlPlane": {
          "$ref": "#/definitions/config.ControlPlaneConfig"
        },
        "routing": {
          "$ref": "#/definitions/config.RoutingConfig"
        },
        "sandboxTrafficManager": {
          "allOf": [
            {
              "$ref": "#/definitions/config.SandboxTrafficManagerConfig"
            }
          ],
          "description": "Deprecated field"
        },
        "trafficCapture": {
          "$ref": "#/definitions/config.TrafficCaptureConfig"
        },
        "trafficManager": {
          "$ref": "#/definitions/config.TrafficManagerConfig"
        }
      },
      "type": "object"
    },
    "config.ControlPlaneConfig": {
      "properties": {
        "disabled": {
          "description": "control plane can be disabled",
          "type": "boolean"
        },
        "proxy": {
          "description": "control plane proxy can be \"enabled\" or \"disabled\"",
          "type": "string"
        },
        "tunnelAddr": {
          "type": "string"
        },
        "tunnelTLS": {
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "config.DefaultHeaderClass": {
      "enum": [
        "baggage",
        "tracestate"
      ],
      "type": "string",
      "x-enum-varnames": [
        "DefaultHeaderBaggage",
        "DefaultHeaderTraceState"
      ]
    },
    "config.GatewayAPIConfig": {
      "properties": {
        "enabled": {
          "type": "boolean"
        },
        "preservedAnnotations": {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "preservedLabels": {
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "config.IstioConfig": {
      "properties": {
        "enableHostRouting": {
          "description": "Deprecated fields",
          "type": "boolean"
        },
        "enabled": {
          "type": "boolean"
        },
        "operator": {
          "$ref": "#/definitions/config.IstioSignadotOperator"
        }
      },
      "type": "object"
    },
    "config.IstioSignadotOperator": {
      "properties": {
        "podLabels": {
          "additionalProperties": {
            "type": "string"
          },
          "type": "object"
        }
      },
      "type": "object"
    },
    "config.LinkerdConfig": {
      "properties": {
        "enabled": {
          "type": "boolean"
        },
        "operator": {
          "$ref": "#/definitions/config.LinkerdSignadotOperator"
        }
      },
      "type": "object"
    },
    "config.LinkerdSignadotOperator": {
      "properties": {
        "podAnnotations": {
          "additionalProperties": {
            "type": "string"
          },
          "type": "object"
        }
      },
      "type": "object"
    },
    "config.QueryParamRoutingConfig": {
      "properties": {
        "enabled": {
          "type": "boolean"
        },
        "paramName": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "config.RoutingConfig": {
      "properties": {
        "customHeaders": {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "defaultHeaders": {
          "items": {
            "$ref": "#/definitions/config.DefaultHeaderClass"
          },
          "type": "array"
        },
        "gatewayAPI": {
          "$ref": "#/definitions/config.GatewayAPIConfig"
        },
        "iptablesMode": {
          "type": "string"
        },
        "istio": {
          "$ref": "#/definitions/config.IstioConfig"
        },
        "linkerd": {
          "$ref": "#/definitions/config.LinkerdConfig"
        },
        "queryParamRouting": {
          "$ref": "#/definitions/config.QueryParamRoutingConfig"
        }
      },
      "type": "object"
    },
    "config.SandboxTrafficManagerConfig": {
      "properties": {
        "enabled": {
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "config.TrafficCaptureConfig": {
      "properties": {
        "enabled": {
          "type": "boolean"
        },
        "requestHeadersElide": {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "responseHeadersElide": {
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "config.TrafficManagerConfig": {
      "properties": {
        "enabled": {
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "defaults.CompositeDefaults": {
      "properties": {
        "cluster": {
          "items": {
            "$ref": "#/definitions/defaults.Default"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "defaults.Default": {
      "properties": {
        "class": {
          "$ref": "#/definitions/defaults.DefaultClass"
        },
        "createdAt": {
          "type": "string"
        },
        "resourceKind": {
          "$ref": "#/definitions/defaults.ResourceKind"
        },
        "updatedAt": {
          "type": "string"
        },
        "value": {}
      },
      "type": "object"
    },
    "defaults.DefaultClass": {
      "enum": [
        "ttl"
      ],
      "type": "string",
      "x-enum-varnames": [
        "TTL"
      ]
    },
    "defaults.ResourceKind": {
      "enum": [
        "sandbox",
        "routegroup"
      ],
      "type": "string",
      "x-enum-varnames": [
        "SandboxResourceKind",
        "RouteGroupResourceKind"
      ]
    },
    "endpoints.Endpoint": {
      "properties": {
        "name": {
          "type": "string"
        },
        "target": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "job.EnvItem": {
      "properties": {
        "name": {
          "type": "string"
        },
        "value": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "job.RoutingContext": {
      "properties": {
        "routegroup": {
          "type": "string"
        },
        "sandbox": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "job.Spec": {
      "properties": {
        "command": {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "env": {
          "items": {
            "$ref": "#/definitions/job.EnvItem"
          },
          "type": "array"
        },
        "labels": {
          "additionalProperties": {
            "type": "string"
          },
          "type": "object"
        },
        "namePrefix": {
          "type": "string"
        },
        "routingContext": {
          "$ref": "#/definitions/job.RoutingContext"
        },
        "runnerGroup": {
          "type": "string"
        },
        "script": {
          "type": "string"
        },
        "trafficManager": {
          "$ref": "#/definitions/job.TrafficManager"
        },
        "uploadArtifact": {
          "items": {
            "$ref": "#/definitions/job.UploadArtifact"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "job.TrafficManager": {
      "properties": {
        "enabled": {
          "description": "Explicitly enable traffic manager in runner pods for this job.",
          "type": "boolean"
        },
        "injectRoutingKey": {
          "description": "InjectRoutingKey indicates if the system should perform automatic\ninjection of routing key headers or not.  It may be the empty string,\n\"auto\" or \"disabled\".  The empty string defaults to meaning \"disabled\".\nThe \"auto\" value will overwrite the value of the Enabled field, setting\nit to true.",
          "enum": [
            "disabled",
            "auto"
          ],
          "type": "string"
        }
      },
      "type": "object"
    },
    "job.UploadArtifact": {
      "properties": {
        "meta": {
          "additionalProperties": {
            "type": "string"
          },
          "type": "object"
        },
        "path": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "jobRunnerGroup.AutoScaling": {
      "properties": {
        "maxPods": {
          "type": "integer"
        },
        "minPods": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "jobRunnerGroup.ExecutionsStatus": {
      "properties": {
        "queued": {
          "type": "integer"
        },
        "running": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "jobRunnerGroup.ManualScaling": {
      "properties": {
        "desiredPods": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "jobRunnerGroup.PodsStatus": {
      "properties": {
        "idle": {
          "type": "integer"
        },
        "notReady": {
          "type": "integer"
        },
        "ready": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "jobRunnerGroup.Scaling": {
      "properties": {
        "auto": {
          "$ref": "#/definitions/jobRunnerGroup.AutoScaling"
        },
        "manual": {
          "$ref": "#/definitions/jobRunnerGroup.ManualScaling"
        }
      },
      "type": "object"
    },
    "jobRunnerGroup.Spec": {
      "properties": {
        "cluster": {
          "type": "string"
        },
        "image": {
          "type": "string"
        },
        "jobTimeout": {
          "description": "JobTimeout specifies the max job execution time of jobs running with this\nRunnerGroup.  If not specified, it defaults to 30 minutes (\"30m\")",
          "type": "string"
        },
        "labels": {
          "additionalProperties": {
            "type": "string"
          },
          "type": "object"
        },
        "namespace": {
          "type": "string"
        },
        "podTemplate": {},
        "reusePods": {
          "description": "ReusePods specifies whether JRG pods are reused after job executions.\nIf false (default), JRG pods are always recreated after each job.",
          "type": "boolean"
        },
        "scaling": {
          "$ref": "#/definitions/jobRunnerGroup.Scaling"
        }
      },
      "type": "object"
    },
    "jobRunnerGroup.Status": {
      "properties": {
        "executions": {
          "$ref": "#/definitions/jobRunnerGroup.ExecutionsStatus"
        },
        "pods": {
          "$ref": "#/definitions/jobRunnerGroup.PodsStatus"
        }
      },
      "type": "object"
    },
    "jobs.Attempt": {
      "properties": {
        "createdAt": {
          "type": "string"
        },
        "executionCount": {
          "type": "integer"
        },
        "finishedAt": {
          "type": "string"
        },
        "id": {
          "type": "integer"
        },
        "phase": {
          "$ref": "#/definitions/jobs.Phase"
        },
        "startedAt": {
          "type": "string"
        },
        "state": {
          "$ref": "#/definitions/jobs.State"
        }
      },
      "type": "object"
    },
    "jobs.CanceledBy": {
      "enum": [
        "timeout",
        "apiRequest",
        "internal"
      ],
      "type": "string",
      "x-enum-varnames": [
        "CanceledByTimeout",
        "CanceledByAPIRequest",
        "CanceledByInternal"
      ]
    },
    "jobs.CanceledState": {
      "properties": {
        "canceledAt": {
          "type": "string"
        },
        "canceledBy": {
          "$ref": "#/definitions/jobs.CanceledBy"
        },
        "inCluster": {
          "type": "boolean"
        },
        "message": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "jobs.FailedState": {
      "properties": {
        "exitCode": {
          "type": "integer",
          "x-nullable": true
        },
        "message": {
          "type": "string"
        },
        "retryAttempt": {
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "jobs.Phase": {
      "enum": [
        "queued",
        "running",
        "failed",
        "succeeded",
        "canceled"
      ],
      "type": "string",
      "x-enum-varnames": [
        "QueuedPhase",
        "RunningPhase",
        "FailedPhase",
        "SucceededPhase",
        "CanceledPhase"
      ]
    },
    "jobs.PhaseCount": {
      "properties": {
        "count": {
          "type": "integer"
        },
        "phase": {
          "$ref": "#/definitions/jobs.Phase"
        }
      },
      "type": "object"
    },
    "jobs.QueuedState": {
      "properties": {
        "lastMessage": {
          "type": "string"
        },
        "message": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "jobs.RunningState": {
      "properties": {
        "podName": {
          "type": "string"
        },
        "podNamespace": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "jobs.State": {
      "properties": {
        "canceled": {
          "$ref": "#/definitions/jobs.CanceledState"
        },
        "failed": {
          "$ref": "#/definitions/jobs.FailedState"
        },
        "queued": {
          "$ref": "#/definitions/jobs.QueuedState"
        },
        "running": {
          "$ref": "#/definitions/jobs.RunningState"
        },
        "succeeded": {
          "$ref": "#/definitions/jobs.SucceededState"
        }
      },
      "type": "object"
    },
    "jobs.Status": {
      "properties": {
        "attempts": {
          "items": {
            "$ref": "#/definitions/jobs.Attempt"
          },
          "type": "array"
        },
        "routingKey": {
          "type": "string"
        },
        "runnerGroupDeletionCompletedAt": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "jobs.SucceededState": {
      "properties": {
        "exitCode": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "local": {
      "properties": {
        "env": {
          "items": {
            "$ref": "#/definitions/sandbox.EnvVar"
          },
          "type": "array"
        },
        "files": {
          "items": {
            "$ref": "#/definitions/sandbox.FileOp"
          },
          "type": "array"
        },
        "from": {
          "$ref": "#/definitions/local.From"
        },
        "mappings": {
          "items": {
            "$ref": "#/definitions/local.PortMapping"
          },
          "type": "array"
        },
        "name": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "local.From": {
      "properties": {
        "kind": {
          "description": "Kind of the baseline workload.",
          "example": "Deployment",
          "type": "string"
        },
        "name": {
          "description": "Name of the entity within the Kubernetes cluster.",
          "example": "my-frontend",
          "type": "string"
        },
        "namespace": {
          "description": "Namespace within which the entity lives in the Kubernetes cluster.",
          "example": "default",
          "type": "string"
        }
      },
      "required": [
        "kind",
        "name",
        "namespace"
      ],
      "type": "object"
    },
    "local.PortMapping": {
      "properties": {
        "appProtocol": {
          "type": "string"
        },
        "port": {
          "type": "integer"
        },
        "toLocal": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "logs.ContainerLogs": {
      "properties": {
        "container": {
          "type": "string"
        },
        "logs": {
          "items": {
            "$ref": "#/definitions/logs.LogItem"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "logs.LogItem": {
      "properties": {
        "message": {
          "type": "string"
        },
        "time": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "logs.LogType": {
      "enum": [
        "stdout",
        "stderr"
      ],
      "type": "string",
      "x-enum-varnames": [
        "StdOutType",
        "StdErrType"
      ]
    },
    "orgs.GetOrgNameResponse": {
      "properties": {
        "clusterID": {
          "description": "ID of Authenticated Cluster, if any (via signadot-cluster-token header)",
          "type": "string"
        },
        "featureFlags": {
          "additionalProperties": {
            "type": "boolean"
          },
          "description": "Feature Flags as result of authentication",
          "type": "object"
        },
        "orgs": {
          "items": {
            "$ref": "#/definitions/orgs.Org"
          },
          "type": "array"
        },
        "user": {
          "allOf": [
            {
              "$ref": "#/definitions/orgs.User"
            }
          ],
          "description": "Authenticated User, if any"
        },
        "userFlags": {
          "allOf": [
            {
              "$ref": "#/definitions/authtypes.UserFlags"
            }
          ],
          "description": "Flags of authenticated user, if any"
        }
      },
      "type": "object"
    },
    "orgs.Org": {
      "properties": {
        "displayName": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "orgs.User": {
      "properties": {
        "avatar": {
          "type": "string"
        },
        "createdAt": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "firstName": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "lastName": {
          "type": "string"
        },
        "role": {
          "type": "string"
        },
        "updatedAt": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "planRunnerGroup.CacheSpec": {
      "properties": {
        "size": {
          "description": "Size is the requested PVC capacity, e.g. \"10Gi\".",
          "type": "string"
        },
        "storageClass": {
          "description": "StorageClass is the Kubernetes storage class name. Empty string\nuses the cluster default.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "planRunnerGroup.ClusterSettings": {
      "properties": {
        "cluster": {
          "type": "string"
        },
        "eligible": {
          "type": "boolean"
        },
        "notes": {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "runnerGroups": {
          "items": {
            "$ref": "#/definitions/PlanRunnerGroup"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "planRunnerGroup.ManualScaling": {
      "properties": {
        "desiredPods": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "planRunnerGroup.PodsStatus": {
      "properties": {
        "notReady": {
          "type": "integer"
        },
        "ready": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "planRunnerGroup.Scaling": {
      "properties": {
        "manual": {
          "$ref": "#/definitions/planRunnerGroup.ManualScaling"
        }
      },
      "type": "object"
    },
    "planRunnerGroup.Spec": {
      "properties": {
        "cache": {
          "$ref": "#/definitions/planRunnerGroup.CacheSpec"
        },
        "cluster": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "image": {
          "type": "string"
        },
        "labels": {
          "additionalProperties": {
            "type": "string"
          },
          "type": "object"
        },
        "podTemplate": {},
        "scaling": {
          "$ref": "#/definitions/planRunnerGroup.Scaling"
        }
      },
      "type": "object"
    },
    "planRunnerGroup.Status": {
      "properties": {
        "pods": {
          "$ref": "#/definitions/planRunnerGroup.PodsStatus"
        }
      },
      "type": "object"
    },
    "plans.ExecutionPhase": {
      "enum": [
        "pending",
        "dispatching",
        "running",
        "finalizing",
        "completed",
        "failed",
        "cancelled",
        "redispatch-needed"
      ],
      "type": "string",
      "x-enum-varnames": [
        "ExecutionPending",
        "ExecutionDispatching",
        "ExecutionRunning",
        "ExecutionFinalizing",
        "ExecutionCompleted",
        "ExecutionFailed",
        "ExecutionCancelled",
        "ExecutionRedispatchNeeded"
      ]
    },
    "plans.InputResolvedVia": {
      "enum": [
        "literal",
        "callerSecret",
        "ref",
        "default",
        "unbound"
      ],
      "type": "string",
      "x-enum-varnames": [
        "InputResolvedViaLiteral",
        "InputResolvedViaCallerSecret",
        "InputResolvedViaRef",
        "InputResolvedViaDefault",
        "InputResolvedViaUnbound"
      ]
    },
    "plans.StepPhase": {
      "enum": [
        "init",
        "waiting",
        "running",
        "completed",
        "failed",
        "skipped"
      ],
      "type": "string",
      "x-enum-varnames": [
        "StepInit",
        "StepWaiting",
        "StepRunning",
        "StepCompleted",
        "StepFailed",
        "StepSkipped"
      ]
    },
    "resourceplugin.Runner": {
      "properties": {
        "image": {
          "description": "Image for the runner instance",
          "type": "string"
        },
        "namespace": {
          "description": "Namespace to create this runner instance in",
          "type": "string"
        },
        "podTemplateOverlay": {
          "description": "Pod template overlay",
          "type": "string"
        }
      },
      "type": "object"
    },
    "resourceplugin.Spec": {
      "properties": {
        "create": {
          "description": "Create refers to the `create` steps for spinning up the resource",
          "items": {
            "$ref": "#/definitions/resourceplugin.Step"
          },
          "type": "array"
        },
        "delete": {
          "description": "Delete refers to the `delete` steps for spinning up the resource",
          "items": {
            "$ref": "#/definitions/resourceplugin.Step"
          },
          "type": "array"
        },
        "description": {
          "description": "Description for the resource",
          "type": "string"
        },
        "runner": {
          "allOf": [
            {
              "$ref": "#/definitions/resourceplugin.Runner"
            }
          ],
          "description": "Runner for the resource plugin"
        }
      },
      "type": "object"
    },
    "resourceplugin.Status": {
      "properties": {
        "resources": {
          "description": "Resources created using the resource plugin",
          "items": {
            "$ref": "#/definitions/ResourceInfo"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "resourceplugin.Step": {
      "properties": {
        "inputs": {
          "description": "Inputs for the step",
          "items": {
            "$ref": "#/definitions/resourceplugin.StepInput"
          },
          "type": "array"
        },
        "name": {
          "description": "Name for the step",
          "type": "string"
        },
        "outputs": {
          "description": "Outputs for the step",
          "items": {
            "$ref": "#/definitions/resourceplugin.StepOut"
          },
          "type": "array"
        },
        "script": {
          "description": "Script to execute in the step",
          "type": "string"
        }
      },
      "type": "object"
    },
    "resourceplugin.StepInput": {
      "properties": {
        "as": {
          "allOf": [
            {
              "$ref": "#/definitions/resourceplugin.StepInputTo"
            }
          ],
          "description": "If the As field is not speficied, we will take the input name\nuppercase it, convert \"-\" to \"_\", and inject it as an env var into\nthe main container"
        },
        "name": {
          "description": "Name for the input",
          "type": "string"
        },
        "type": {
          "description": "Type of input",
          "type": "string"
        },
        "valueFromSandbox": {
          "description": "ValueFromSandbox defines whether or not to source value from the sandbox spec",
          "type": "boolean"
        },
        "valueFromStep": {
          "allOf": [
            {
              "$ref": "#/definitions/resourceplugin.ValueFromStep"
            }
          ],
          "description": "ValueFromStep is an optional string specifying the output of\nanother step when not nil.  Exactly one of ValueFromSandbox\nand 'ValueFromStep != nil' must hold."
        }
      },
      "type": "object"
    },
    "resourceplugin.StepInputTo": {
      "properties": {
        "env": {
          "description": "Inject the input as an env variable with name Env inside the\nmain container",
          "type": "string"
        },
        "path": {
          "description": "Expose the input as a file at Path inside the main container",
          "type": "string"
        }
      },
      "type": "object"
    },
    "resourceplugin.StepOut": {
      "properties": {
        "description": {
          "description": "Description for the output",
          "type": "string"
        },
        "name": {
          "description": "Name of the output variable",
          "type": "string"
        },
        "type": {
          "description": "Type of output",
          "type": "string"
        },
        "valueFromPath": {
          "description": "Path within the main container from where the output will be read",
          "type": "string"
        }
      },
      "type": "object"
    },
    "resourceplugin.ValueFromStep": {
      "properties": {
        "name": {
          "description": "Name of the step",
          "type": "string"
        },
        "output": {
          "description": "Name of the variable from the step",
          "type": "string"
        }
      },
      "type": "object"
    },
    "routeGroup.Match": {
      "properties": {
        "all": {
          "description": "When All is non-nil, T matches a set of labels if and only if every element of All matches them.\nOnly one field may be non-nil.",
          "items": {
            "$ref": "#/definitions/routeGroup.Match"
          },
          "type": "array",
          "x-omitempty": true
        },
        "any": {
          "description": "When Any is non-nil, T matches a set of labels if and only if some element of Any matches them.\nOnly one field may be non-nil.",
          "items": {
            "$ref": "#/definitions/routeGroup.Match"
          },
          "type": "array",
          "x-omitempty": true
        },
        "label": {
          "allOf": [
            {
              "$ref": "#/definitions/routeGroup.MatchLabel"
            }
          ],
          "description": "When Label is non-nil, T matches a set of labels L if and only if t.Label.Matches(L).\nOnly one field may be non-nil."
        }
      },
      "type": "object"
    },
    "routeGroup.MatchLabel": {
      "properties": {
        "key": {
          "description": "Key is an exact match on a label key, glob\ncharacters are just considered normal characters.",
          "type": "string"
        },
        "value": {
          "description": "Value is a glob match for the value of a\nsandbox label.  See https://pkg.go.dev/path/filepath#Match\nfor the file glob syntax.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "routeGroup.Spec": {
      "properties": {
        "cluster": {
          "description": "Cluster gives the cluster to which the route group applies.\nIf left empty, this RG will become a multi-cluster RG..",
          "type": "string"
        },
        "description": {
          "description": "Description provides a short description of the route group.",
          "type": "string"
        },
        "endpoints": {
          "description": "Endpoints define endpoints which target different in-cluster\nservices.",
          "items": {
            "$ref": "#/definitions/routegroups.Endpoint"
          },
          "type": "array"
        },
        "match": {
          "allOf": [
            {
              "$ref": "#/definitions/routeGroup.Match"
            }
          ],
          "description": "Match defines a matcher for labels, which matches\nsandboxes that should be a part of this route group."
        },
        "ttl": {
          "allOf": [
            {
              "$ref": "#/definitions/routeGroup.TTL"
            }
          ],
          "description": "TTL define when/how the route group should be deleted"
        }
      },
      "type": "object"
    },
    "routeGroup.Status": {
      "properties": {
        "matchedSandboxes": {
          "description": "MatchedSandboxes gives the list of sandboxes whose labels\nwere matched by the 'match' object in the spec.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "message": {
          "description": "Message is a human readable explanation of why\nthe sandbox is healthy or not.",
          "type": "string"
        },
        "ready": {
          "description": "Ready indicates whether the sandbox is ready,\nmeaning that it can be used for testing.",
          "type": "boolean"
        },
        "reason": {
          "description": "Reason is a machine readable explanation of why\nthe sandbox is healthy or not.",
          "type": "string"
        },
        "scheduledDeleteTime": {
          "description": "ScheduledDeleteTime returns the formatted and computed ttl based on the Duration\nand OffsetFrom",
          "type": "string"
        }
      },
      "type": "object"
    },
    "routeGroup.TTL": {
      "properties": {
        "duration": {
          "description": "Duration represents the duration until routegroup's end of life.\nIt should be an unsigned integer not exceeding 32 bits followed by\na units character, which can be one of the following.\n  - 'm' for minutes\n  - 'h' for hours\n  - 'd' for days\n  - 'w' for weeks",
          "type": "string"
        },
        "offsetFrom": {
          "description": "OffsetFrom indicates what the Duration is relative to.  It\nmay be the empty string, \"noMatchedSandboxes\", \"createdAt\" or \"updatedAt\". The empty string\ndefaults to meaning \"noMatchedSandboxes\".",
          "type": "string"
        }
      },
      "type": "object"
    },
    "routegroups.Endpoint": {
      "properties": {
        "cluster": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "target": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "routegroups.EndpointURL": {
      "properties": {
        "cluster": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "target": {
          "type": "string"
        },
        "url": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.ConnectionStatus": {
      "properties": {
        "devbox": {
          "description": "Machine to which local mappings in this sandbox may be linked.",
          "type": "string"
        },
        "session": {
          "allOf": [
            {
              "$ref": "#/definitions/ConnectSession"
            }
          ],
          "description": "signadot local connect session id and info."
        }
      },
      "type": "object"
    },
    "sandbox.CustomPatch": {
      "properties": {
        "type": {
          "$ref": "#/definitions/sandboxes.PatchType"
        },
        "value": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.Customizations": {
      "properties": {
        "env": {
          "description": "Environment variable modifications that will be applied to the forked workload",
          "items": {
            "$ref": "#/definitions/sandbox.EnvVar"
          },
          "type": "array"
        },
        "images": {
          "description": "One or more docker images that will be applied to the forked workload",
          "items": {
            "$ref": "#/definitions/sandbox.Image"
          },
          "type": "array"
        },
        "patch": {
          "$ref": "#/definitions/sandbox.CustomPatch"
        }
      },
      "type": "object"
    },
    "sandbox.DefaultRouteGroup": {
      "properties": {
        "endpoints": {
          "items": {
            "$ref": "#/definitions/endpoints.Endpoint"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "sandbox.Endpoint": {
      "properties": {
        "baselineUrl": {
          "type": "string"
        },
        "host": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "port": {
          "type": "integer"
        },
        "protocol": {
          "type": "string"
        },
        "routeType": {
          "type": "string"
        },
        "target": {
          "type": "string"
        },
        "url": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.EnvValueFrom": {
      "properties": {
        "configMap": {
          "$ref": "#/definitions/sandbox.EnvValueFromMap"
        },
        "fork": {
          "$ref": "#/definitions/sandbox.EnvValueFromFork"
        },
        "resource": {
          "$ref": "#/definitions/sandbox.EnvValueFromResource"
        },
        "secret": {
          "$ref": "#/definitions/sandbox.EnvValueFromMap"
        }
      },
      "type": "object"
    },
    "sandbox.EnvValueFromFork": {
      "properties": {
        "expression": {
          "type": "string"
        },
        "forkOf": {
          "$ref": "#/definitions/sandbox.ForkOf"
        }
      },
      "type": "object"
    },
    "sandbox.EnvValueFromMap": {
      "properties": {
        "key": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "optional": {
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "sandbox.EnvValueFromResource": {
      "properties": {
        "name": {
          "type": "string"
        },
        "outputKey": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.EnvVar": {
      "properties": {
        "container": {
          "description": "name of container to which it applies",
          "type": "string"
        },
        "name": {
          "description": "environmental variable name",
          "type": "string"
        },
        "operation": {
          "allOf": [
            {
              "$ref": "#/definitions/sandboxes.EnvOpName"
            }
          ],
          "description": "upsert or delete"
        },
        "value": {
          "description": "environmental variable value",
          "type": "string"
        },
        "valueFrom": {
          "allOf": [
            {
              "$ref": "#/definitions/sandbox.EnvValueFrom"
            }
          ],
          "description": "environmental variable dynamic value"
        }
      },
      "type": "object"
    },
    "sandbox.FileOp": {
      "properties": {
        "path": {
          "type": "string"
        },
        "value": {
          "type": "string"
        },
        "valueFrom": {
          "$ref": "#/definitions/sandbox.FileSource"
        }
      },
      "type": "object"
    },
    "sandbox.FileSource": {
      "properties": {
        "configMap": {
          "$ref": "#/definitions/sandbox.FileSourceMap"
        },
        "resource": {
          "$ref": "#/definitions/sandbox.FileSourceResource"
        },
        "secret": {
          "$ref": "#/definitions/sandbox.FileSourceMap"
        }
      },
      "type": "object"
    },
    "sandbox.FileSourceMap": {
      "properties": {
        "key": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "optional": {
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "sandbox.FileSourceResource": {
      "properties": {
        "name": {
          "type": "string"
        },
        "outputKey": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.Fork": {
      "properties": {
        "customizations": {
          "allOf": [
            {
              "$ref": "#/definitions/sandbox.Customizations"
            }
          ],
          "description": "Customizations specify the customizations we will apply on the fork"
        },
        "endpoints": {
          "description": "Deprecated. Use defaultRouteGroup.Endpoints instead.",
          "items": {
            "$ref": "#/definitions/sandbox.ForkEndpoint"
          },
          "type": "array",
          "x-omitempty": "true"
        },
        "forkOf": {
          "allOf": [
            {
              "$ref": "#/definitions/sandbox.ForkOf"
            }
          ],
          "description": "ForkOf specifies the target workload that we will be forking.  In this usage\nthe Kind of the ForkOf object must not be a service."
        },
        "name": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.ForkEndpoint": {
      "properties": {
        "name": {
          "description": "Name of the endpoint",
          "type": "string"
        },
        "port": {
          "description": "Port it will map to on the forked workload",
          "type": "integer"
        },
        "protocol": {
          "description": "Protocol that this endpoint uses",
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.ForkOf": {
      "properties": {
        "kind": {
          "description": "Kind of the baseline workload.",
          "example": "Deployment",
          "type": "string"
        },
        "name": {
          "description": "Name of the entity within the Kubernetes cluster.",
          "example": "my-frontend",
          "type": "string"
        },
        "namespace": {
          "description": "Namespace within which the entity lives in the Kubernetes cluster.",
          "example": "default",
          "type": "string"
        }
      },
      "required": [
        "kind",
        "name",
        "namespace"
      ],
      "type": "object"
    },
    "sandbox.HostEndpoint": {
      "properties": {
        "host": {
          "description": "Hostname that this endpoint points to",
          "type": "string"
        },
        "name": {
          "description": "Name of the endpoint",
          "type": "string"
        },
        "port": {
          "description": "Port it will map to on the specified host",
          "type": "integer"
        },
        "protocol": {
          "description": "Protocol that this endpoint uses",
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.Image": {
      "properties": {
        "container": {
          "description": "Container is the container this image must apply to in the forked workload",
          "type": "string"
        },
        "image": {
          "description": "Name of the image (e.g. gcr.io/my-image/repo:my-tag)",
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.LocalWorkloadStatus": {
      "properties": {
        "name": {
          "type": "string"
        },
        "tunnel": {
          "$ref": "#/definitions/sandbox.TunnelStatus"
        }
      },
      "type": "object"
    },
    "sandbox.Readiness": {
      "properties": {
        "connection": {
          "allOf": [
            {
              "$ref": "#/definitions/sandbox.ConnectionStatus"
            }
          ],
          "description": "Connection describes an associated call to signadot local connect."
        },
        "forwards": {
          "description": "Forwards status",
          "items": {
            "$ref": "#/definitions/sandboxes.ForwardStatus"
          },
          "type": "array"
        },
        "jobs": {
          "allOf": [
            {
              "$ref": "#/definitions/sandboxes.JobsSummary"
            }
          ],
          "description": "status of the jobs running in the context of the given sandbox"
        },
        "local": {
          "description": "Local mappings status",
          "items": {
            "$ref": "#/definitions/sandbox.LocalWorkloadStatus"
          },
          "type": "array"
        },
        "message": {
          "description": "Message is a human readable explanation of why\nthe sandbox is healthy or not.",
          "type": "string"
        },
        "ready": {
          "description": "Ready indicates whether the sandbox is ready,\nmeaning that it can be used for testing.",
          "type": "boolean"
        },
        "reason": {
          "description": "Reason is a machine readable explanation of why\nthe sandbox is healthy or not.",
          "type": "string"
        },
        "scheduledDeleteTime": {
          "description": "ScheduledDeleteTime returns the formatted and computed ttl based on the Duration\nand OffsetFrom",
          "type": "string"
        },
        "testExecutions": {
          "allOf": [
            {
              "$ref": "#/definitions/sandbox.TestExecutionsSummary"
            }
          ],
          "description": "status of the test executions running in the context of the given sandbox"
        }
      },
      "type": "object"
    },
    "sandbox.Resource": {
      "properties": {
        "name": {
          "description": "Unique name for this resource (used to reference it in env vars and files)",
          "type": "string"
        },
        "params": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Plugin-specific parameters as key-value pairs",
          "type": "object"
        },
        "plugin": {
          "description": "Plugin name, optionally suffixed with @version (e.g. my-plugin@1.2.0)",
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.Spec": {
      "properties": {
        "cluster": {
          "description": "Cluster within which this sandbox should be created",
          "type": "string"
        },
        "connection": {
          "allOf": [
            {
              "$ref": "#/definitions/Connection"
            }
          ],
          "description": "What signadot local connect connection to use."
        },
        "defaultRouteGroup": {
          "allOf": [
            {
              "$ref": "#/definitions/sandbox.DefaultRouteGroup"
            }
          ],
          "description": "DefaultRouteGroup can be used to define route group endpoints for the sandbox."
        },
        "description": {
          "description": "Description of the purpose of this sandbox",
          "type": "string"
        },
        "disableSandboxTrafficManager": {
          "description": "DisableSandboxTrafficManager provides a way of turning off the sandbox\ntraffic manager for forks in this sandbox.\nDeprecated in operators since v1.1. The sandbox traffic manager has been\nretired.",
          "type": "boolean"
        },
        "endpoints": {
          "description": "Deprecated. Use defaultRouteGroup.Endpoints instead.",
          "items": {
            "$ref": "#/definitions/sandbox.HostEndpoint"
          },
          "type": "array",
          "x-omitempty": "true"
        },
        "forks": {
          "description": "Forks is the specification of each forked entity",
          "items": {
            "$ref": "#/definitions/sandbox.Fork"
          },
          "type": "array"
        },
        "labels": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Labels are used to specify metadata associated with the sandbox as key-value pairs.",
          "type": "object"
        },
        "local": {
          "description": "Local Workloads",
          "items": {
            "$ref": "#/definitions/local"
          },
          "type": "array"
        },
        "localMachineID": {
          "description": "Identifier of the machine from where a sandbox containing local workloads\nwas created or is intended to be ran",
          "type": "string"
        },
        "middleware": {
          "description": "Request Middleware",
          "items": {
            "$ref": "#/definitions/sandboxes.Middleware"
          },
          "type": "array"
        },
        "resources": {
          "description": "Resources specifies each required resource to spin up the sandbox",
          "items": {
            "$ref": "#/definitions/sandbox.Resource"
          },
          "type": "array"
        },
        "routing": {
          "allOf": [
            {
              "$ref": "#/definitions/sandboxes.Routing"
            }
          ],
          "description": "Routing specification"
        },
        "ttl": {
          "allOf": [
            {
              "$ref": "#/definitions/sandbox.TTL"
            }
          ],
          "description": "TTL gives the maximum lifetime of the sandbox.\nIt may be empty, in which case it defaults to forever."
        },
        "virtual": {
          "description": "Virtual Workloads",
          "items": {
            "$ref": "#/definitions/virtual"
          },
          "type": "array"
        }
      },
      "required": [
        "cluster",
        "forks"
      ],
      "type": "object"
    },
    "sandbox.TTL": {
      "properties": {
        "duration": {
          "description": "Duration represents the duration until sandbox end of life.\nIt should be an unsigned integer not exceeding 32 bits followed by\na units character, which can be one of the following.\n  - 'm' for minutes\n  - 'h' for hours\n  - 'd' for days\n  - 'w' for weeks",
          "type": "string"
        },
        "offsetFrom": {
          "description": "OffsetFrom indicates what the Duration is relative to.  It\nmay be the empty string, \"createdAt\" or \"updatedAt\".  The empty string\ndefaults to meaning \"createdAt\".",
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandbox.TestExecutionsSummary": {
      "properties": {
        "checks": {
          "$ref": "#/definitions/sandbox.TestExecutionsSummaryChecks"
        },
        "phaseCounts": {
          "items": {
            "$ref": "#/definitions/testexecutions.PhaseCount"
          },
          "type": "array"
        },
        "trafficDiffs": {
          "$ref": "#/definitions/sandbox.TestExecutionsSummaryTrafficDiffs"
        }
      },
      "type": "object"
    },
    "sandbox.TestExecutionsSummaryChecks": {
      "properties": {
        "failed": {
          "type": "integer"
        },
        "passed": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "sandbox.TestExecutionsSummaryTrafficDiffs": {
      "properties": {
        "green": {
          "type": "integer"
        },
        "red": {
          "type": "integer"
        },
        "yellow": {
          "type": "integer"
        }
      },
      "type": "object"
    },
    "sandbox.TunnelStatus": {
      "properties": {
        "health": {
          "properties": {
            "connected": {
              "type": "boolean"
            },
            "lastCheckTime": {
              "type": "string"
            },
            "lastConnectedTime": {
              "type": "string"
            }
          },
          "type": "object"
        }
      },
      "type": "object"
    },
    "sandboxes.ArgValueFrom": {
      "properties": {
        "forward": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandboxes.Argument": {
      "properties": {
        "name": {
          "description": "Name indicates the name of the associated parameter.",
          "type": "string"
        },
        "value": {
          "description": "Value indicates the value passed to the parameter of\nthe same name.",
          "type": "string"
        },
        "valueFrom": {
          "allOf": [
            {
              "$ref": "#/definitions/sandboxes.ArgValueFrom"
            }
          ],
          "description": "ValueFrom indicates from where to grab the value"
        }
      },
      "type": "object"
    },
    "sandboxes.EnvOpName": {
      "enum": [
        "upsert",
        "delete"
      ],
      "type": "string",
      "x-enum-varnames": [
        "EnvOpUpsert",
        "EnvOpDelete"
      ]
    },
    "sandboxes.ExplainMode": {
      "enum": [
        "explain",
        "context"
      ],
      "type": "string",
      "x-enum-varnames": [
        "ExplainModeExplain",
        "ExplainModeContext"
      ]
    },
    "sandboxes.Forward": {
      "properties": {
        "appProtocol": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "port": {
          "type": "integer"
        },
        "toLocal": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandboxes.ForwardStatus": {
      "properties": {
        "name": {
          "type": "string"
        },
        "tunnel": {
          "$ref": "#/definitions/sandbox.TunnelStatus"
        }
      },
      "type": "object"
    },
    "sandboxes.JobsSummary": {
      "properties": {
        "phaseCounts": {
          "items": {
            "$ref": "#/definitions/jobs.PhaseCount"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "sandboxes.LLMContext": {
      "properties": {
        "messages": {
          "items": {
            "$ref": "#/definitions/sandboxes.LLMMessage"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "sandboxes.LLMMessage": {
      "properties": {
        "content": {
          "type": "string"
        },
        "role": {
          "$ref": "#/definitions/sandboxes.LLMMessageRole"
        }
      },
      "type": "object"
    },
    "sandboxes.LLMMessageRole": {
      "enum": [
        "system",
        "user"
      ],
      "type": "string",
      "x-enum-varnames": [
        "LLMMessageRoleSystem",
        "LLMMessageRoleUser"
      ]
    },
    "sandboxes.Middleware": {
      "properties": {
        "args": {
          "description": "Middleware arguments",
          "items": {
            "$ref": "#/definitions/sandboxes.Argument"
          },
          "type": "array"
        },
        "match": {
          "description": "Matches specifies a disjunction of matching criteria for dispatching\nthe middleware.  Any empty list means don't dispatch anything.",
          "items": {
            "$ref": "#/definitions/sandboxes.MiddlewareMatch"
          },
          "type": "array"
        },
        "name": {
          "description": "Middleware name",
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandboxes.MiddlewareMatch": {
      "properties": {
        "workload": {
          "description": "Workload specifies a glob which matches\neach workload name in the spec.",
          "type": "string"
        }
      },
      "type": "object"
    },
    "sandboxes.PatchType": {
      "enum": [
        "strategic",
        "merge",
        "json",
        "signadot/env",
        "signadot/image"
      ],
      "type": "string",
      "x-enum-varnames": [
        "PatchTypeStrategic",
        "PatchTypeMerge",
        "PatchTypeJSON",
        "PatchTypeSDEnv",
        "PatchTypeSDImage"
      ]
    },
    "sandboxes.Routing": {
      "properties": {
        "forwards": {
          "items": {
            "$ref": "#/definitions/sandboxes.Forward"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "sandboxes.SandboxStatusExplainResponse": {
      "properties": {
        "context": {
          "allOf": [
            {
              "$ref": "#/definitions/sandboxes.LLMContext"
            }
          ],
          "description": "Context contains the LLM messages (system prompt + user context)\nthat can be fed into any LLM. Only present when mode=context."
        },
        "explanation": {
          "description": "Explanation is a natural-language explanation of why the sandbox\nis in its current state and what, if anything, the user can do.\nOnly present when mode=explain.",
          "type": "string"
        },
        "mode": {
          "allOf": [
            {
              "$ref": "#/definitions/sandboxes.ExplainMode"
            }
          ],
          "description": "Mode indicates whether the response contains an LLM explanation or raw context."
        },
        "status": {
          "allOf": [
            {
              "$ref": "#/definitions/sandbox.Readiness"
            }
          ],
          "description": "Status is the current machine-readable sandbox status."
        }
      },
      "type": "object"
    },
    "servicestatus.Incident": {
      "properties": {
        "id": {
          "type": "string"
        },
        "impact": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "resolvedAt": {
          "description": "ResolvedAt is the incident resolution time (RFC3339); omitted while\nthe incident is unresolved.",
          "type": "string"
        },
        "startsAt": {
          "description": "StartsAt is the incident start time (RFC3339).",
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "updatedAt": {
          "description": "UpdatedAt is the time of the most recent update (RFC3339).",
          "type": "string"
        },
        "url": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "servicestatus.Maintenance": {
      "properties": {
        "endsAt": {
          "description": "EndsAt is the scheduled end time (RFC3339); omitted if open-ended.",
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "impact": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "startsAt": {
          "description": "StartsAt is the scheduled start time (RFC3339).",
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "updatedAt": {
          "description": "UpdatedAt is the time of the most recent update (RFC3339).",
          "type": "string"
        },
        "url": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "servicestatus.Response": {
      "properties": {
        "incidents": {
          "items": {
            "$ref": "#/definitions/servicestatus.Incident"
          },
          "type": "array"
        },
        "maintenances": {
          "items": {
            "$ref": "#/definitions/servicestatus.Maintenance"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "syntax.Position": {
      "properties": {
        "col": {
          "description": "1-based column (rune) number; 0 if column unknown",
          "format": "int32",
          "type": "integer"
        },
        "line": {
          "description": "1-based line number; 0 if line unknown",
          "format": "int32",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "testexecutions.Check": {
      "properties": {
        "errors": {
          "items": {
            "$ref": "#/definitions/testexecutions.CheckError"
          },
          "type": "array"
        },
        "name": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "testexecutions.CheckError": {
      "properties": {
        "attrs": {
          "additionalProperties": {},
          "type": "object"
        },
        "message": {
          "type": "string"
        },
        "sourcePosition": {
          "$ref": "#/definitions/syntax.Position"
        }
      },
      "type": "object"
    },
    "testexecutions.Checks": {
      "properties": {
        "baseline": {
          "items": {
            "$ref": "#/definitions/testexecutions.Check"
          },
          "type": "array"
        },
        "sandbox": {
          "items": {
            "$ref": "#/definitions/testexecutions.Check"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "testexecutions.Phase": {
      "enum": [
        "pending",
        "in_progress",
        "failed",
        "succeeded",
        "canceled"
      ],
      "type": "string",
      "x-enum-varnames": [
        "PendingPhase",
        "InProgressPhase",
        "FailedPhase",
        "SucceededPhase",
        "CanceledPhase"
      ]
    },
    "testexecutions.PhaseCount": {
      "properties": {
        "count": {
          "type": "integer"
        },
        "phase": {
          "$ref": "#/definitions/testexecutions.Phase"
        }
      },
      "type": "object"
    },
    "testexecutions.QueryResult": {
      "properties": {
        "cursor": {
          "type": "string"
        },
        "execution": {
          "$ref": "#/definitions/TestExecution"
        }
      },
      "type": "object"
    },
    "testexecutions.UnpairedCapture": {
      "properties": {
        "baselineCaptureID": {
          "type": "string"
        },
        "targetCaptureID": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "trafficmodels.By": {
      "properties": {
        "direction": {
          "$ref": "#/definitions/trafficmodels.Direction"
        },
        "kind": {
          "$ref": "#/definitions/trafficmodels.Kind"
        },
        "name": {
          "type": "string"
        },
        "namespace": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "trafficmodels.DiffOperation": {
      "enum": [
        "add",
        "remove",
        "replace"
      ],
      "type": "string",
      "x-enum-varnames": [
        "Add",
        "Remove",
        "Replace"
      ]
    },
    "trafficmodels.Direction": {
      "enum": [
        "Inbound",
        "Outbound"
      ],
      "type": "string",
      "x-enum-varnames": [
        "Inbound",
        "Outbound"
      ]
    },
    "trafficmodels.Kind": {
      "enum": [
        "Job",
        "Deployment",
        "Rollout"
      ],
      "type": "string",
      "x-enum-varnames": [
        "Job",
        "Deployment",
        "Rollout"
      ]
    },
    "virtual": {
      "properties": {
        "name": {
          "type": "string"
        },
        "workload": {
          "$ref": "#/definitions/local.From"
        }
      },
      "type": "object"
    },
    "workload.Workload": {
      "properties": {
        "kind": {
          "description": "Kind of the baseline workload.",
          "example": "Deployment",
          "type": "string"
        },
        "name": {
          "description": "Name of the entity within the Kubernetes cluster.",
          "example": "my-frontend",
          "type": "string"
        },
        "namespace": {
          "description": "Namespace within which the entity lives in the Kubernetes cluster.",
          "example": "default",
          "type": "string"
        }
      },
      "required": [
        "kind",
        "name",
        "namespace"
      ],
      "type": "object"
    }
  },
  "host": "api.signadot.com",
  "info": {
    "contact": {},
    "description": "API for Signadot Sandboxes",
    "title": "Signadot API",
    "version": "2.0"
  },
  "paths": {
    "/auth/device/code/": {
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Get an authentication code for a device login flow",
        "operationId": "auth-device-get-code",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/authdevices.Code"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "Get Device Authentication Code",
        "tags": [
          "Auth"
        ]
      }
    },
    "/auth/device/token/": {
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Get an authentication token for a device login flow",
        "operationId": "auth-device-get-token",
        "parameters": [
          {
            "description": "Information to get the token",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/authdevices.TokenInput"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/authdevices.Token"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "429": {
            "description": "Too Many Requests",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "Get Device Authentication Token",
        "tags": [
          "Auth"
        ]
      }
    },
    "/auth/device/token/refresh": {
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Refresh an authentication token using a refresh token",
        "operationId": "auth-device-refresh-token",
        "parameters": [
          {
            "description": "Refresh token string",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/authdevices.Token"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "429": {
            "description": "Too Many Requests",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "Refresh Device Authentication Token",
        "tags": [
          "Auth"
        ]
      }
    },
    "/meta/openapi.json": {
      "get": {
        "description": "Returns the customer-facing OpenAPI (Swagger 2.0) document for",
        "operationId": "meta-openapi",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OpenAPI document",
            "schema": {
              "type": "object"
            }
          }
        },
        "summary": "Documented OpenAPI spec",
        "tags": [
          "Meta"
        ]
      }
    },
    "/meta/plans": {
      "get": {
        "description": "Returns the JSON Schema for plans.PlanSpec, with descriptions",
        "operationId": "meta-plans",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "JSON Schema for PlanSpec",
            "schema": {
              "type": "object"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "Plan-authoring schema",
        "tags": [
          "Meta"
        ]
      }
    },
    "/orgs/": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get organization details",
        "operationId": "get-org-name",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/orgs.GetOrgNameResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get Org Name",
        "tags": [
          "Orgs"
        ]
      }
    },
    "/orgs/{orgName}/artifacts/jobs/{jobName}/attempts/{jobAttempt}": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List all artifacts for a given job attempt.",
        "operationId": "list-job-attempt-artifacts",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Job Name",
            "in": "path",
            "name": "jobName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Job Attempt ID",
            "in": "path",
            "name": "jobAttempt",
            "required": true,
            "type": "integer"
          },
          {
            "description": "Filter by artifact space, one of 'user' or 'system' (by default there is no filter)",
            "enum": [
              "user",
              "system"
            ],
            "in": "query",
            "name": "space",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/JobArtifact"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List job attempt artifacts",
        "tags": [
          "Artifacts"
        ]
      }
    },
    "/orgs/{orgName}/artifacts/jobs/{jobName}/attempts/{jobAttempt}/objects/": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get info about a job attempt artifact",
        "operationId": "info-job-attempt-artifact",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Job Name",
            "in": "path",
            "name": "jobName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Job Attempt ID",
            "in": "path",
            "name": "jobAttempt",
            "required": true,
            "type": "integer"
          },
          {
            "description": "Artifact Path",
            "in": "query",
            "name": "path",
            "required": true,
            "type": "string"
          },
          {
            "description": "Artifact space, one of 'user' or 'system' (by default 'user')",
            "enum": [
              "user",
              "system"
            ],
            "in": "query",
            "name": "space",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/JobArtifactInfo"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Job attempt artifact info",
        "tags": [
          "Artifacts"
        ]
      }
    },
    "/orgs/{orgName}/artifacts/jobs/{jobName}/attempts/{jobAttempt}/objects/download": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Downloads an artifact for a given job attempt.",
        "operationId": "download-job-attempt-artifact",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Job Name",
            "in": "path",
            "name": "jobName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Job Attempt ID",
            "in": "path",
            "name": "jobAttempt",
            "required": true,
            "type": "integer"
          },
          {
            "description": "Artifact Path",
            "in": "query",
            "name": "path",
            "required": true,
            "type": "string"
          },
          {
            "description": "Artifact space, one of 'user' or 'system' (by default 'user')",
            "enum": [
              "user",
              "system"
            ],
            "in": "query",
            "name": "space",
            "type": "string"
          },
          {
            "description": "Downloads the specified byte range of the artifact. Retrieving multiple ranges of data per request is not supported",
            "in": "header",
            "name": "Range",
            "type": "string"
          }
        ],
        "produces": [
          "*/*"
        ],
        "responses": {
          "200": {
            "description": "Artifact successfully downloaded",
            "headers": {
              "signadot-artifact-checksumSHA256": {
                "description": "A base64-encoded, 256-bit SHA-256 digest of the artifact",
                "type": "string"
              },
              "signadot-artifact-last-modified": {
                "description": "Date and time when the artifact was last modified",
                "type": "string"
              },
              "signadot-artifact-metadata": {
                "description": "A json-encoded, map of the artifact metadata",
                "type": "string"
              }
            },
            "schema": {
              "type": "file"
            }
          },
          "206": {
            "description": "Artifact range successfully downloaded",
            "headers": {
              "signadot-artifact-last-modified": {
                "description": "Date and time when the artifact was last modified",
                "type": "string"
              },
              "signadot-artifact-metadata": {
                "description": "A json-encoded, map of the artifact metadata",
                "type": "string"
              }
            },
            "schema": {
              "type": "file"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Download job attempt artifact",
        "tags": [
          "Artifacts"
        ]
      }
    },
    "/orgs/{orgName}/artifacts/jobs/{jobName}/attempts/{jobAttempt}/objects/upload": {
      "post": {
        "consumes": [
          "multipart/form-data"
        ],
        "description": "Uploads an artifact for a given job attempt.",
        "operationId": "upload-job-attempt-artifact",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Job Name",
            "in": "path",
            "name": "jobName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Job Attempt ID",
            "in": "path",
            "name": "jobAttempt",
            "required": true,
            "type": "integer"
          },
          {
            "description": "Artifact Path",
            "in": "query",
            "name": "path",
            "required": true,
            "type": "string"
          },
          {
            "description": "Artifact space, one of 'user' or 'system' (by default 'user')",
            "enum": [
              "user",
              "system"
            ],
            "in": "query",
            "name": "space",
            "type": "string"
          },
          {
            "description": "Job Execution ID",
            "in": "formData",
            "name": "jobExecution",
            "type": "integer"
          },
          {
            "description": "A base64-encoded, 256-bit SHA-256 digest of the artifact",
            "in": "formData",
            "name": "checksumSHA256",
            "type": "string"
          },
          {
            "description": "A json-encoded, map of metadata to store with the artifact",
            "in": "formData",
            "name": "metadata",
            "type": "string"
          },
          {
            "description": "Artifact File",
            "in": "formData",
            "name": "artifact",
            "required": true,
            "type": "file"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "413": {
            "description": "Request Entity Too Large",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Upload job attempt artifact",
        "tags": [
          "Artifacts"
        ]
      }
    },
    "/orgs/{orgName}/clusters/": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List clusters.",
        "operationId": "list-clusters",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/Cluster"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List clusters",
        "tags": [
          "Cluster"
        ]
      }
    },
    "/orgs/{orgName}/clusters/{clusterName}/": {
      "delete": {
        "consumes": [
          "application/json"
        ],
        "description": "Remove a Kubernetes cluster from Signadot.",
        "operationId": "remove-cluster",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Cluster Name",
            "in": "path",
            "name": "clusterName",
            "required": true,
            "type": "string",
            "x-example": "my-cluster"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Remove a cluster",
        "tags": [
          "Cluster"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get a cluster.",
        "operationId": "get-cluster",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Cluster Name",
            "in": "path",
            "name": "clusterName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Cluster"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a cluster",
        "tags": [
          "Cluster"
        ]
      },
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Add a Kubernetes cluster to Signadot.",
        "operationId": "add-cluster",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Cluster Name",
            "in": "path",
            "name": "clusterName",
            "required": true,
            "type": "string",
            "x-example": "my-cluster"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Cluster"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Add a cluster",
        "tags": [
          "Cluster"
        ]
      }
    },
    "/orgs/{orgName}/clusters/{clusterName}/devmesh/analyze": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Analyze DevMesh status for a given cluster",
        "operationId": "cluster-devmesh-analyze",
        "parameters": [
          {
            "description": "Signadot Org name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Cluster Name",
            "in": "path",
            "name": "clusterName",
            "required": true,
            "type": "string",
            "x-example": "my-new-cluster"
          },
          {
            "description": "Filter by statuses (comma separated value)",
            "in": "query",
            "name": "namespace",
            "type": "string"
          },
          {
            "description": "Filter by namespaces (comma separated value)",
            "in": "query",
            "name": "status",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/clusters.DevMeshEnabledWorkload"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Cluster DevMesh Analyze",
        "tags": [
          "Cluster"
        ]
      }
    },
    "/orgs/{orgName}/clusters/{clusterName}/tokens": {
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Create a new token for connecting a cluster.",
        "operationId": "create-cluster-token",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Cluster Name",
            "in": "path",
            "name": "clusterName",
            "required": true,
            "type": "string",
            "x-example": "my-new-cluster"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ClusterToken"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create cluster token",
        "tags": [
          "Cluster"
        ]
      }
    },
    "/orgs/{orgName}/clusters/{clusterName}/tokens/": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List the cluster tokens associated with a cluster.",
        "operationId": "list-cluster-tokens",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Cluster Name",
            "in": "path",
            "name": "clusterName",
            "required": true,
            "type": "string",
            "x-example": "my-new-cluster"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/ClusterToken"
              },
              "type": "array"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List cluster tokens",
        "tags": [
          "Cluster"
        ]
      }
    },
    "/orgs/{orgName}/clusters/{clusterName}/tokens/{tokenId}": {
      "delete": {
        "consumes": [
          "application/json"
        ],
        "description": "Delete a cluster token associated with a cluster.",
        "operationId": "delete-cluster-token",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Cluster Name",
            "in": "path",
            "name": "clusterName",
            "required": true,
            "type": "string",
            "x-example": "my-new-cluster"
          },
          {
            "description": "Token Id",
            "in": "path",
            "name": "tokenId",
            "required": true,
            "type": "string",
            "x-example": "kq6mtksk7mn5"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete cluster token",
        "tags": [
          "Cluster"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get a cluster token associated with a cluster.",
        "operationId": "get-cluster-token",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Cluster Name",
            "in": "path",
            "name": "clusterName",
            "required": true,
            "type": "string",
            "x-example": "my-new-cluster"
          },
          {
            "description": "Token Id",
            "in": "path",
            "name": "tokenId",
            "required": true,
            "type": "string",
            "x-example": "kq6mtksk7mn5"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ClusterToken"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a cluster token",
        "tags": [
          "Cluster"
        ]
      }
    },
    "/orgs/{orgName}/devboxes/": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List devboxes. Use query param all=true to list all devboxes in org, otherwise returns user's devboxes. API key authentication returns org-scoped devboxes.",
        "operationId": "get-devboxes",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Set to 'true' to list all devboxes in org",
            "in": "query",
            "name": "all",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/Devbox"
              },
              "type": "array"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "429": {
            "description": "Too Many Requests",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "List devboxes",
        "tags": [
          "Devboxes"
        ]
      },
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Register a devbox with metadata. Returns 201 Created for new devbox, 200 OK if already exists. When authenticated via API key, creates org-scoped devboxes shared across all API keys in the org.",
        "operationId": "register-devbox",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Devbox Registration",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/DevboxRegistration"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Devbox"
            }
          },
          "201": {
            "description": "Created",
            "schema": {
              "$ref": "#/definitions/Devbox"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "429": {
            "description": "Too Many Requests",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "Register a devbox (idempotent POST)",
        "tags": [
          "Devboxes"
        ]
      }
    },
    "/orgs/{orgName}/devboxes/{devboxId}": {
      "delete": {
        "consumes": [
          "application/json"
        ],
        "description": "Delete a devbox by its deterministic ID",
        "operationId": "delete-devbox",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Devbox Identifier",
            "in": "path",
            "name": "devboxId",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "429": {
            "description": "Too Many Requests",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "Delete a devbox",
        "tags": [
          "Devboxes"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get a devbox by its deterministic ID",
        "operationId": "get-devbox",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Devbox Identifier",
            "in": "path",
            "name": "devboxId",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Devbox"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "429": {
            "description": "Too Many Requests",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "Get a devbox by ID",
        "tags": [
          "Devboxes"
        ]
      }
    },
    "/orgs/{orgName}/devboxes/{devboxId}/claim": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Claim a devbox for a signadot local connect session",
        "operationId": "claim-devbox",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Devbox Identifier",
            "in": "path",
            "name": "devboxId",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Devbox"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "409": {
            "description": "Conflict",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "429": {
            "description": "Too Many Requests",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "Claim a devbox",
        "tags": [
          "Devboxes"
        ]
      }
    },
    "/orgs/{orgName}/devboxes/{devboxId}/release": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Release a devbox from a signadot local connect session lease",
        "operationId": "release-devbox",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Devbox Identifier",
            "in": "path",
            "name": "devboxId",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Devbox"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "429": {
            "description": "Too Many Requests",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "Release a devbox's connection",
        "tags": [
          "Devboxes"
        ]
      }
    },
    "/orgs/{orgName}/devboxes/{devboxId}/renew/{devboxSessionId}": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Renew a devbox for a signadot local connect session lease",
        "operationId": "renew-devbox",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Devbox Identifier",
            "in": "path",
            "name": "devboxId",
            "required": true,
            "type": "string"
          },
          {
            "description": "Devbox Connect Session",
            "in": "path",
            "name": "devboxSessionId",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Devbox"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "429": {
            "description": "Too Many Requests",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "500": {
            "description": "Internal Server Error",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "summary": "Renew a devbox's connection",
        "tags": [
          "Devboxes"
        ]
      }
    },
    "/orgs/{orgName}/events": {
      "get": {
        "description": "List audit events for the org, newest first. Each event carries the authentication method (auth) and, when resolvable, the principal who acted. Time window defaults to the last 24h; event types default to all.",
        "operationId": "list-events",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Window start (RFC3339); defaults to endTime-24h",
            "in": "query",
            "name": "startTime",
            "type": "string"
          },
          {
            "description": "Window end (RFC3339); defaults to now",
            "in": "query",
            "name": "endTime",
            "type": "string"
          },
          {
            "collectionFormat": "csv",
            "description": "Event type filter; repeatable; defaults to all",
            "in": "query",
            "items": {
              "type": "string"
            },
            "name": "type",
            "type": "array"
          },
          {
            "description": "event_data filter DSL (key=value\u0026...)",
            "in": "query",
            "name": "filters",
            "type": "string"
          },
          {
            "description": "Max events (1..1000); defaults to 200",
            "in": "query",
            "name": "limit",
            "type": "integer"
          },
          {
            "description": "Opaque pagination cursor: pass the previous page's last event cursor to fetch the next (older) page. Keep the other query parameters (type/filters/principal/authMethod and the time window) stable across pages; the window is pinned to the cursor, and changing the other filters mid-pagination restarts the result set.",
            "in": "query",
            "name": "cursor",
            "type": "string"
          },
          {
            "description": "Filter by principal kind (User|ServiceAccount|System). System selects events with no principal. Matches events that recorded a principal; older events are attributed best-effort in the response but are not matched by this filter.",
            "in": "query",
            "name": "principalKind",
            "type": "string"
          },
          {
            "description": "Filter by principal public ID (requires principalKind). Matches events that recorded this principal; older events attributed to it best-effort are not matched.",
            "in": "query",
            "name": "principalId",
            "type": "string"
          },
          {
            "description": "Filter by authentication method (jwt|api_key|system); covers all events.",
            "in": "query",
            "name": "authMethod",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ListEventsResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List audit events",
        "tags": [
          "Events"
        ]
      }
    },
    "/orgs/{orgName}/events/export": {
      "get": {
        "description": "Stream the org's audit events (same filters as the list endpoint) as a CSV attachment, newest first. The file is generated and streamed server-side with bounded memory, so the client need not page through every event; every event matching the filters is included.",
        "operationId": "export-events",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Window start (RFC3339); defaults to endTime-24h",
            "in": "query",
            "name": "startTime",
            "type": "string"
          },
          {
            "description": "Window end (RFC3339); defaults to now",
            "in": "query",
            "name": "endTime",
            "type": "string"
          },
          {
            "collectionFormat": "csv",
            "description": "Event type filter; repeatable; defaults to all",
            "in": "query",
            "items": {
              "type": "string"
            },
            "name": "type",
            "type": "array"
          },
          {
            "description": "event_data filter DSL (key=value\u0026...)",
            "in": "query",
            "name": "filters",
            "type": "string"
          },
          {
            "description": "Filter by principal kind (User|ServiceAccount|System)",
            "in": "query",
            "name": "principalKind",
            "type": "string"
          },
          {
            "description": "Filter by principal public ID (requires principalKind)",
            "in": "query",
            "name": "principalId",
            "type": "string"
          },
          {
            "description": "Filter by authentication method (jwt|api_key|system)",
            "in": "query",
            "name": "authMethod",
            "type": "string"
          }
        ],
        "produces": [
          "text/csv"
        ],
        "responses": {
          "200": {
            "description": "CSV attachment",
            "schema": {
              "type": "string"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Export audit events as CSV",
        "tags": [
          "Events"
        ]
      }
    },
    "/orgs/{orgName}/jobs": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List Jobs",
        "operationId": "list-jobs",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Filter jobs by target sandbox name",
            "in": "query",
            "name": "targetSandbox",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/Job"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List Jobs",
        "tags": [
          "Jobs"
        ]
      },
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Creates a job with the provided parameters.",
        "operationId": "create-job",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Request to create a job",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Job"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Job"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create a job",
        "tags": [
          "Jobs"
        ]
      }
    },
    "/orgs/{orgName}/jobs/{jobName}": {
      "delete": {
        "consumes": [
          "application/json"
        ],
        "description": "Delete a given job.",
        "operationId": "delete-job",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Job  Name",
            "in": "path",
            "name": "jobName",
            "required": true,
            "type": "string",
            "x-example": "job-xyz"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a job",
        "tags": [
          "Jobs"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Fetch the details about a given job.",
        "operationId": "get-job",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Job Name",
            "in": "path",
            "name": "jobName",
            "required": true,
            "type": "string",
            "x-example": "job-xyz"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Job"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a job",
        "tags": [
          "Jobs"
        ]
      }
    },
    "/orgs/{orgName}/jobs/{jobName}/attempts/{jobAttempt}/logs/stream": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Stream logs for a given job attempt.",
        "operationId": "stream-job-attempt-logs",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Job Name",
            "in": "path",
            "name": "jobName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Job Attempt ID",
            "in": "path",
            "name": "jobAttempt",
            "required": true,
            "type": "integer"
          },
          {
            "description": "Stream type (stdout or stderr)",
            "enum": [
              "stdout",
              "stderr"
            ],
            "in": "query",
            "name": "type",
            "type": "string"
          },
          {
            "description": "If set, the number of lines from the end of the logs to show",
            "in": "query",
            "name": "tailLines",
            "type": "integer"
          },
          {
            "description": "If set, resume logs stream from the given cursor",
            "in": "query",
            "name": "cursor",
            "type": "string"
          }
        ],
        "produces": [
          "text/event-stream"
        ],
        "responses": {
          "200": {
            "description": "Log lines stream",
            "schema": {
              "type": "file"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Stream job attempt logs",
        "tags": [
          "JobLogs"
        ]
      }
    },
    "/orgs/{orgName}/jobs/{jobName}/cancel": {
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Cancel a given job.",
        "operationId": "cancel-job",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Job Name",
            "in": "path",
            "name": "jobName",
            "required": true,
            "type": "string",
            "x-example": "job-xyz"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Job"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Cancel a job",
        "tags": [
          "Jobs"
        ]
      }
    },
    "/orgs/{orgName}/plan-actions": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List all actions visible to the org (system + org-owned)",
        "operationId": "list-plan-actions",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/PlanAction"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List plan actions",
        "tags": [
          "PlanActions"
        ]
      }
    },
    "/orgs/{orgName}/plan-actions/{actionName}": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get a single action by name (org-owned preferred over system)",
        "operationId": "get-plan-action",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Action Name",
            "in": "path",
            "name": "actionName",
            "required": true,
            "type": "string",
            "x-example": "request-http"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/PlanAction"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a plan action",
        "tags": [
          "PlanActions"
        ]
      }
    },
    "/orgs/{orgName}/plan-runnergroup-settings": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Returns cluster eligibility information with nested plan runner group data.",
        "operationId": "get-planrunnergroup-settings",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/PlanRunnerGroupSettingsResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get PlanRunnerGroup settings",
        "tags": [
          "PlanRunnerGroups"
        ]
      }
    },
    "/orgs/{orgName}/plan-runnergroups": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List PlanRunnerGroups.",
        "operationId": "list-planrunnergroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/PlanRunnerGroup"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List PlanRunnerGroups",
        "tags": [
          "PlanRunnerGroups"
        ]
      }
    },
    "/orgs/{orgName}/plan-runnergroups/{planRunnerGroupName}": {
      "delete": {
        "consumes": [
          "application/json"
        ],
        "description": "Delete a given plan runner group.",
        "operationId": "delete-planrunnergroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "PlanRunnerGroup Name",
            "in": "path",
            "name": "planRunnerGroupName",
            "required": true,
            "type": "string",
            "x-example": "my-plan-runner-group"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a plan runner group",
        "tags": [
          "PlanRunnerGroups"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Fetch the details about a given plan runner group.",
        "operationId": "get-planrunnergroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "PlanRunnerGroup Name",
            "in": "path",
            "name": "planRunnerGroupName",
            "required": true,
            "type": "string",
            "x-example": "my-plan-runner-group"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/PlanRunnerGroup"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a plan runner group",
        "tags": [
          "PlanRunnerGroups"
        ]
      },
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Creates or updates a plan runner group with the provided parameters.",
        "operationId": "apply-planrunnergroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "PlanRunnerGroup Name",
            "in": "path",
            "name": "planRunnerGroupName",
            "required": true,
            "type": "string",
            "x-example": "my-plan-runner-group"
          },
          {
            "description": "Request to create or update plan runner group",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/PlanRunnerGroup"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/PlanRunnerGroup"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create or update a plan runner group",
        "tags": [
          "PlanRunnerGroups"
        ]
      }
    },
    "/orgs/{orgName}/plan-runnergroups/{planRunnerGroupName}/desired-images": {
      "get": {
        "description": "Returns the set of literal \\image refs declared by",
        "operationId": "get-prg-desired-images",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Plan Runner Group Name",
            "in": "path",
            "name": "planRunnerGroupName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/PlanDesiredImagesResponse"
            }
          },
          "304": {
            "description": "Not Modified — desired set unchanged since the client's ETag"
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Desired image set for a plan runner group",
        "tags": [
          "PlanRunnerGroups"
        ]
      }
    },
    "/orgs/{orgName}/plan-tags": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List all plan tags for the org",
        "operationId": "list-plan-tags",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/PlanTag"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List plan tags",
        "tags": [
          "PlanTags"
        ]
      }
    },
    "/orgs/{orgName}/plan-tags/{planTagName}": {
      "delete": {
        "description": "Delete a plan tag (the plan itself is not deleted)",
        "operationId": "delete-plan-tag",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Plan Tag Name",
            "in": "path",
            "name": "planTagName",
            "required": true,
            "type": "string",
            "x-example": "latest"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a plan tag",
        "tags": [
          "PlanTags"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get a single plan tag by name with its associated plan",
        "operationId": "get-plan-tag",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Plan Tag Name",
            "in": "path",
            "name": "planTagName",
            "required": true,
            "type": "string",
            "x-example": "latest"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/PlanTag"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a plan tag",
        "tags": [
          "PlanTags"
        ]
      },
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Creates the tag if it doesn't exist, or moves it to a different plan if it does",
        "operationId": "put-plan-tag",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Plan Tag Name",
            "in": "path",
            "name": "planTagName",
            "required": true,
            "type": "string",
            "x-example": "latest"
          },
          {
            "description": "Plan tag spec with plan ID",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/PlanTagSpec"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/PlanTag"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create or update a plan tag",
        "tags": [
          "PlanTags"
        ]
      }
    },
    "/orgs/{orgName}/plans": {
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Create a plan from a raw spec. Each step's action may be supplied either fully embedded (body, params, outputs, etc. inline) or by reference — set only `action.actionID` and the server hydrates the contents from the registered action.",
        "operationId": "create-plan",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Set to 'action' to include each step's full action contents in the response (body, schemas, extraInputsSchemaPolicy). Default returns the compact by-ref form.",
            "enum": [
              "action"
            ],
            "in": "query",
            "name": "expand",
            "type": "string"
          },
          {
            "description": "Plan spec",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/PlanSpec"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/RunnablePlan"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create a plan",
        "tags": [
          "Plans"
        ]
      }
    },
    "/orgs/{orgName}/plans/compile": {
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Compiles a natural-language prompt into a runnable plan",
        "operationId": "compile-plan",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Set to 'action' to include each step's full action contents (body, schemas, extraInputsSchemaPolicy). Default returns the compact by-ref form.",
            "enum": [
              "action"
            ],
            "in": "query",
            "name": "expand",
            "type": "string"
          },
          {
            "description": "Compile input with prompt",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/PlanCompileInput"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/RunnablePlan"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Compile a plan from a prompt",
        "tags": [
          "Plans"
        ]
      }
    },
    "/orgs/{orgName}/plans/executions": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List executions for the org with optional filters and cursor-based pagination",
        "operationId": "list-plan-executions",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Filter by plan ID",
            "in": "query",
            "name": "planID",
            "type": "string"
          },
          {
            "description": "Filter by plan tag name (resolved to plan ID at query time)",
            "in": "query",
            "name": "tag",
            "type": "string"
          },
          {
            "description": "Filter by execution phase",
            "in": "query",
            "name": "phase",
            "type": "string"
          },
          {
            "description": "Number of results per page (default 50, max 500)",
            "in": "query",
            "name": "pageSize",
            "type": "integer"
          },
          {
            "description": "Pagination cursor from a previous response",
            "in": "query",
            "name": "cursor",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/PlanExecutionQueryResult"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List plan executions",
        "tags": [
          "PlanExecutions"
        ]
      },
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Creates a new execution of a compiled plan",
        "operationId": "create-plan-execution",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Execution spec with plan ID and params",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/PlanExecutionSpec"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/PlanExecution"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "429": {
            "description": "Too Many Requests",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create a plan execution",
        "tags": [
          "PlanExecutions"
        ]
      }
    },
    "/orgs/{orgName}/plans/executions/{executionID}": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get the current state of a plan execution by ID",
        "operationId": "get-plan-execution",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Plan Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/PlanExecution"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a plan execution",
        "tags": [
          "PlanExecutions"
        ]
      }
    },
    "/orgs/{orgName}/plans/executions/{executionID}/cancel": {
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Cancel a running plan execution. Returns 409 if already terminal.",
        "operationId": "cancel-plan-execution",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Plan Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/PlanExecution"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "409": {
            "description": "Conflict",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Cancel a plan execution",
        "tags": [
          "PlanExecutions"
        ]
      }
    },
    "/orgs/{orgName}/plans/executions/{executionID}/logs/live": {
      "get": {
        "description": "Stream live logs for all steps of a plan execution, multiplexed into a single stream.",
        "operationId": "stream-plan-execution-logs",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Plan Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          },
          {
            "description": "If set, the number of lines from the end of the logs to show",
            "in": "query",
            "name": "tailLines",
            "type": "integer"
          },
          {
            "description": "If set, resume logs stream from the given cursor",
            "in": "query",
            "name": "cursor",
            "type": "string"
          }
        ],
        "produces": [
          "text/event-stream"
        ],
        "responses": {
          "200": {
            "description": "Aggregated log lines stream",
            "schema": {
              "type": "file"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Stream aggregated plan logs",
        "tags": [
          "PlanExecutionLogs"
        ]
      }
    },
    "/orgs/{orgName}/plans/executions/{executionID}/outputs/{outputName}": {
      "get": {
        "description": "Returns the output content for a plan-level output. Resolves the step reference and serves the value or proxies the artifact.",
        "operationId": "get-plan-execution-output",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Plan Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          },
          {
            "description": "Output Name",
            "in": "path",
            "name": "outputName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/octet-stream"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "headers": {
              "Content-Type": {
                "description": "MIME type of the output body, resolved via plans.ResolveContentType",
                "type": "string"
              }
            },
            "schema": {
              "type": "file"
            }
          },
          "206": {
            "description": "Partial Content",
            "headers": {
              "Content-Type": {
                "description": "MIME type of the output body, resolved via plans.ResolveContentType",
                "type": "string"
              }
            },
            "schema": {
              "type": "file"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "503": {
            "description": "Service Unavailable",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Download a plan-level output",
        "tags": [
          "PlanExecutions"
        ]
      }
    },
    "/orgs/{orgName}/plans/executions/{executionID}/steps/{stepID}/logs/download": {
      "get": {
        "description": "Returns the captured stdout or stderr for a specific step. Inlined values are served directly; large logs are proxied from S3.",
        "operationId": "download-step-log",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Plan Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          },
          {
            "description": "Step ID",
            "in": "path",
            "name": "stepID",
            "required": true,
            "type": "string"
          },
          {
            "description": "Stream type (stdout or stderr)",
            "enum": [
              "stdout",
              "stderr"
            ],
            "in": "query",
            "name": "stream",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "text/plain"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "type": "file"
            }
          },
          "206": {
            "description": "Partial Content",
            "schema": {
              "type": "file"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "503": {
            "description": "Service Unavailable",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Download a step log",
        "tags": [
          "PlanExecutionLogs"
        ]
      }
    },
    "/orgs/{orgName}/plans/executions/{executionID}/steps/{stepID}/logs/live": {
      "get": {
        "description": "Stream live stdout or stderr logs for a specific step of a plan execution.",
        "operationId": "stream-plan-execution-step-logs",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Plan Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          },
          {
            "description": "Step ID",
            "in": "path",
            "name": "stepID",
            "required": true,
            "type": "string"
          },
          {
            "description": "Stream type (stdout or stderr)",
            "enum": [
              "stdout",
              "stderr"
            ],
            "in": "query",
            "name": "stream",
            "required": true,
            "type": "string"
          },
          {
            "description": "If set, the number of lines from the end of the logs to show",
            "in": "query",
            "name": "tailLines",
            "type": "integer"
          },
          {
            "description": "If set, resume logs stream from the given cursor",
            "in": "query",
            "name": "cursor",
            "type": "string"
          }
        ],
        "produces": [
          "text/event-stream"
        ],
        "responses": {
          "200": {
            "description": "Log lines stream",
            "schema": {
              "type": "file"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Stream step logs",
        "tags": [
          "PlanExecutionLogs"
        ]
      }
    },
    "/orgs/{orgName}/plans/executions/{executionID}/steps/{stepID}/outputs/{outputName}": {
      "get": {
        "description": "Returns the output content for a specific step. Inlined values are served directly; artifact outputs are proxied from S3.",
        "operationId": "get-step-output",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Plan Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          },
          {
            "description": "Step ID",
            "in": "path",
            "name": "stepID",
            "required": true,
            "type": "string"
          },
          {
            "description": "Output Name",
            "in": "path",
            "name": "outputName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/octet-stream"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "headers": {
              "Content-Type": {
                "description": "MIME type of the output body, resolved via plans.ResolveContentType",
                "type": "string"
              }
            },
            "schema": {
              "type": "file"
            }
          },
          "206": {
            "description": "Partial Content",
            "headers": {
              "Content-Type": {
                "description": "MIME type of the output body, resolved via plans.ResolveContentType",
                "type": "string"
              }
            },
            "schema": {
              "type": "file"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "503": {
            "description": "Service Unavailable",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Download a step output",
        "tags": [
          "PlanExecutions"
        ]
      }
    },
    "/orgs/{orgName}/plans/{planID}": {
      "delete": {
        "description": "Delete a plan by ID",
        "operationId": "delete-plan",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Plan ID",
            "in": "path",
            "name": "planID",
            "required": true,
            "type": "string",
            "x-example": "q860pz1v7t430"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a plan",
        "tags": [
          "Plans"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get a single plan by ID",
        "operationId": "get-plan",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Plan ID",
            "in": "path",
            "name": "planID",
            "required": true,
            "type": "string",
            "x-example": "q860pz1v7t430"
          },
          {
            "description": "Set to 'action' to include each step's full action contents (body, schemas, extraInputsSchemaPolicy). Default returns the compact by-ref form.",
            "enum": [
              "action"
            ],
            "in": "query",
            "name": "expand",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/RunnablePlan"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a plan",
        "tags": [
          "Plans"
        ]
      }
    },
    "/orgs/{orgName}/plans/{plan_id}/compile": {
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Re-runs LLM compilation using the source plan's prompt, creating a new plan linked to the original",
        "operationId": "recompile-plan",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Plan ID",
            "in": "path",
            "name": "plan_id",
            "required": true,
            "type": "string",
            "x-example": "q860pz1v7t430"
          },
          {
            "description": "Set to 'action' to include each step's full action contents (body, schemas, extraInputsSchemaPolicy). Default returns the compact by-ref form.",
            "enum": [
              "action"
            ],
            "in": "query",
            "name": "expand",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/RunnablePlan"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Recompile a plan",
        "tags": [
          "Plans"
        ]
      }
    },
    "/orgs/{orgName}/resource-plugins": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List resource plugins under the specified Signadot org. By default returns only the highest-semver version of each plugin. Pass `?version=all` to expand the response into one row per published (name, version), sorted by name then semver-descending. `?version=latest` is accepted as an explicit alias for the default.",
        "operationId": "list-resource-plugins",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "'latest' (default) returns only the highest-semver version of each plugin; 'all' returns every published version",
            "enum": [
              "latest",
              "all"
            ],
            "in": "query",
            "name": "version",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/ResourcePlugin"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List resource plugins",
        "tags": [
          "ResourcePlugins"
        ]
      }
    },
    "/orgs/{orgName}/resource-plugins/{pluginName}": {
      "delete": {
        "consumes": [
          "application/json"
        ],
        "description": "Delete a resource plugin version. Omit the version query parameter to delete the latest version. Deletion is blocked when any sandbox references the specific version being deleted.",
        "operationId": "delete-resource-plugin",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Resource plugin name",
            "in": "path",
            "name": "pluginName",
            "required": true,
            "type": "string",
            "x-example": "mariadb-plugin"
          },
          {
            "description": "Resource plugin version (semver); omit for latest",
            "in": "query",
            "name": "version",
            "type": "string",
            "x-example": "1.2.0"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a resource plugin",
        "tags": [
          "ResourcePlugins"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get the specified resource plugin. Omit the version query parameter to get the latest version.",
        "operationId": "get-resource-plugin",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Resource plugin name",
            "in": "path",
            "name": "pluginName",
            "required": true,
            "type": "string",
            "x-example": "mariadb-plugin"
          },
          {
            "description": "Resource plugin version (semver); omit for latest",
            "in": "query",
            "name": "version",
            "type": "string",
            "x-example": "1.2.0"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ResourcePlugin"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get the requested resource plugin",
        "tags": [
          "ResourcePlugins"
        ]
      },
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Creates a new version of a resource plugin. The body's `name` field carries the wire form `bareName[@semver]` (e.g. `my-plugin@1.2.0`); its bare part must match the URL path name. A bare-name form (no `@`) publishes the default version `0.0.0`. Versions are immutable; PUTting an existing (name, version) pair returns 409. The version suffix must be a concrete semver; \"latest\" is only accepted on the read and delete query parameters.",
        "operationId": "apply-resource-plugin",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Resource plugin name",
            "in": "path",
            "name": "pluginName",
            "required": true,
            "type": "string",
            "x-example": "mariadb-plugin"
          },
          {
            "description": "Request to create a resource plugin version",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ResourcePlugin"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "409": {
            "description": "Conflict",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Apply a resource plugin",
        "tags": [
          "ResourcePlugins"
        ]
      }
    },
    "/orgs/{orgName}/resource-plugins/{pluginName}/versions": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List every published version of the named resource plugin.",
        "operationId": "list-resource-plugin-versions",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Resource plugin name",
            "in": "path",
            "name": "pluginName",
            "required": true,
            "type": "string",
            "x-example": "mariadb-plugin"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/ResourcePlugin"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List versions of a resource plugin",
        "tags": [
          "ResourcePlugins"
        ]
      }
    },
    "/orgs/{orgName}/routegroups": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List all routegroups under the specified Signadot org.",
        "operationId": "list-routegroups",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/RouteGroup"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List routegroups",
        "tags": [
          "RouteGroups"
        ]
      }
    },
    "/orgs/{orgName}/routegroups/{routegroupName}": {
      "delete": {
        "consumes": [
          "application/json"
        ],
        "description": "Delete a given routegroup.",
        "operationId": "delete-routegroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "RouteGroup Name",
            "in": "path",
            "name": "routegroupName",
            "required": true,
            "type": "string",
            "x-example": "my-routegroup"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a routegroup",
        "tags": [
          "RouteGroups"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Fetch the details about a given routegroup.",
        "operationId": "get-routegroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "RouteGroup Name",
            "in": "path",
            "name": "routegroupName",
            "required": true,
            "type": "string",
            "x-example": "my-routegroup"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/RouteGroup"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a routegroup",
        "tags": [
          "RouteGroups"
        ]
      },
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Creates or updates a routegroup with the provided parameters.",
        "operationId": "apply-routegroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "RouteGroup Name",
            "in": "path",
            "name": "routegroupName",
            "required": true,
            "type": "string",
            "x-example": "my-routegroup"
          },
          {
            "description": "Request to create or update routegroup",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/RouteGroup"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/RouteGroup"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create or update a routegroup",
        "tags": [
          "RouteGroups"
        ]
      }
    },
    "/orgs/{orgName}/runnergroups": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List RunnerGroups",
        "operationId": "list-runnergroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/JobRunnerGroup"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List RunnerGroups",
        "tags": [
          "RunnerGroups"
        ]
      }
    },
    "/orgs/{orgName}/runnergroups/{runnergroupName}": {
      "delete": {
        "consumes": [
          "application/json"
        ],
        "description": "Delete a given jobrunnergroup.",
        "operationId": "delete-runnergroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "RunnerGroup Name",
            "in": "path",
            "name": "runnergroupName",
            "required": true,
            "type": "string",
            "x-example": "my-runnergroup"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a runnergroup",
        "tags": [
          "RunnerGroups"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Fetch the details about a given jobrunnergroup.",
        "operationId": "get-runnergroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "RunnerGroup Name",
            "in": "path",
            "name": "runnergroupName",
            "required": true,
            "type": "string",
            "x-example": "my-runnergroup"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/JobRunnerGroup"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a runnergroup",
        "tags": [
          "RunnerGroups"
        ]
      },
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Creates or updates a runnergroup with the provided parameters.",
        "operationId": "apply-runnergroup",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "RunnerGroup Name",
            "in": "path",
            "name": "runnergroupName",
            "required": true,
            "type": "string",
            "x-example": "my-runnergroup"
          },
          {
            "description": "Request to create or update runnergroup",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/JobRunnerGroup"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/JobRunnerGroup"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create or update a runnergroup",
        "tags": [
          "RunnerGroups"
        ]
      }
    },
    "/orgs/{orgName}/sandboxes": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List all sandboxes under the specified Signadot org.",
        "operationId": "list-sandboxes",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/Sandbox"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List sandboxes",
        "tags": [
          "Sandboxes"
        ]
      }
    },
    "/orgs/{orgName}/sandboxes/{sandboxName}": {
      "delete": {
        "consumes": [
          "application/json"
        ],
        "description": "Delete a given sandbox.",
        "operationId": "delete-sandbox",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Sandbox Name",
            "in": "path",
            "name": "sandboxName",
            "required": true,
            "type": "string",
            "x-example": "my-sandbox"
          },
          {
            "description": "force",
            "in": "query",
            "name": "force",
            "type": "boolean"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a sandbox",
        "tags": [
          "Sandboxes"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Fetch the details about a given sandbox.",
        "operationId": "get-sandbox",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Sandbox Name",
            "in": "path",
            "name": "sandboxName",
            "required": true,
            "type": "string",
            "x-example": "my-sandbox"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Sandbox"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a sandbox",
        "tags": [
          "Sandboxes"
        ]
      },
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Creates or updates a sandbox with the provided parameters.",
        "operationId": "apply-sandbox",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Sandbox Name",
            "in": "path",
            "name": "sandboxName",
            "required": true,
            "type": "string",
            "x-example": "my-sandbox"
          },
          {
            "description": "Request to create sandbox",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Sandbox"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Sandbox"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create or update a sandbox",
        "tags": [
          "Sandboxes"
        ]
      }
    },
    "/orgs/{orgName}/sandboxes/{sandboxName}/logs": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Fetch logs for a forked workload in a sandbox. The server resolves the sandbox and workload to the underlying Kubernetes object, so only sandbox-model names are required (no cluster/kind/namespace).",
        "operationId": "get-sandbox-logs",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Sandbox Name",
            "in": "path",
            "name": "sandboxName",
            "required": true,
            "type": "string",
            "x-example": "my-sandbox"
          },
          {
            "description": "Sandboxed workload (fork) name from the sandbox spec",
            "in": "query",
            "name": "workload",
            "type": "string"
          },
          {
            "description": "Sandbox resource name from the sandbox spec",
            "in": "query",
            "name": "resource",
            "type": "string"
          },
          {
            "description": "Resource plugin step name; only valid with resource (defaults to all create steps)",
            "in": "query",
            "name": "step",
            "type": "string"
          },
          {
            "description": "Container name; defaults to all containers",
            "in": "query",
            "name": "container",
            "type": "string"
          },
          {
            "description": "Only return logs after this RFC3339 timestamp",
            "in": "query",
            "name": "sinceTime",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/logs.ContainerLogs"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get sandbox workload logs",
        "tags": [
          "Sandboxes"
        ]
      }
    },
    "/orgs/{orgName}/sandboxes/{sandboxName}/status/explain": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Returns a sandbox status explanation. In the default mode (mode=explain), generates a natural-language explanation using an LLM fed with cluster context. When mode=context, returns the assembled LLM messages (system prompt + user context) without calling the LLM. Both modes require the sandbox explain AI feature to be enabled, otherwise they return 403 (the assembled context contains sandbox metadata and is itself sensitive).",
        "operationId": "explain-sandbox-status",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Sandbox Name",
            "in": "path",
            "name": "sandboxName",
            "required": true,
            "type": "string",
            "x-example": "my-sandbox"
          },
          {
            "description": "Response mode: 'explain' (default) calls the LLM, 'context' returns raw LLM messages",
            "enum": [
              "explain",
              "context"
            ],
            "in": "query",
            "name": "mode",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/sandboxes.SandboxStatusExplainResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "501": {
            "description": "Not Implemented",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Explain sandbox status",
        "tags": [
          "Sandboxes"
        ]
      }
    },
    "/orgs/{orgName}/secrets": {
      "get": {
        "description": "List all secrets for the org (metadata only, no values).",
        "operationId": "list-secrets",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/Secret"
              },
              "type": "array"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List secrets",
        "tags": [
          "Secrets"
        ]
      },
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Create a new encrypted secret for the org.",
        "operationId": "create-secret",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Secret (name + value required)",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Secret"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Secret"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create a secret",
        "tags": [
          "Secrets"
        ]
      }
    },
    "/orgs/{orgName}/secrets/{secretName}": {
      "delete": {
        "description": "Delete a secret from the org.",
        "operationId": "delete-secret",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Secret Name",
            "in": "path",
            "name": "secretName",
            "required": true,
            "type": "string"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a secret",
        "tags": [
          "Secrets"
        ]
      },
      "get": {
        "description": "Get secret metadata (no value).",
        "operationId": "get-secret",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Secret Name",
            "in": "path",
            "name": "secretName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Secret"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a secret",
        "tags": [
          "Secrets"
        ]
      },
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Update the value (and optionally description) of an existing secret.",
        "operationId": "update-secret",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Secret Name",
            "in": "path",
            "name": "secretName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Secret (value required)",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Secret"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Secret"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Update a secret",
        "tags": [
          "Secrets"
        ]
      }
    },
    "/orgs/{orgName}/service-accounts": {
      "get": {
        "description": "List all service accounts for the org.",
        "operationId": "list-service-accounts",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/ServiceAccount"
              },
              "type": "array"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List service accounts",
        "tags": [
          "ServiceAccounts"
        ]
      },
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Create a new service account (non-human principal) for the org.",
        "operationId": "create-service-account",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Service account (name + role required)",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ServiceAccount"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ServiceAccount"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "409": {
            "description": "Conflict",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create a service account",
        "tags": [
          "ServiceAccounts"
        ]
      }
    },
    "/orgs/{orgName}/service-accounts/{serviceAccountName}": {
      "delete": {
        "description": "Hard-delete a service account. Refused with 409 if it still holds API keys (remove them first, so they aren't orphaned). Devboxes and other rows bound to this principal are left for an admin to clean up.",
        "operationId": "delete-service-account",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Service Account Name",
            "in": "path",
            "name": "serviceAccountName",
            "required": true,
            "type": "string"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "409": {
            "description": "Conflict",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a service account",
        "tags": [
          "ServiceAccounts"
        ]
      },
      "get": {
        "description": "Get a single service account by name.",
        "operationId": "get-service-account",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Service Account Name",
            "in": "path",
            "name": "serviceAccountName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ServiceAccount"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a service account",
        "tags": [
          "ServiceAccounts"
        ]
      },
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Update the role and/or description of an existing service account. Name is immutable.",
        "operationId": "update-service-account",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Service Account Name",
            "in": "path",
            "name": "serviceAccountName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Service account (role required)",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/ServiceAccount"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ServiceAccount"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Update a service account",
        "tags": [
          "ServiceAccounts"
        ]
      }
    },
    "/orgs/{orgName}/service-accounts/{serviceAccountName}/api-keys": {
      "get": {
        "description": "List the API keys bound to a service account (admin only).",
        "operationId": "list-service-account-api-keys",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Service Account Name",
            "in": "path",
            "name": "serviceAccountName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ListApiKeysResponse"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List a service account's API keys",
        "tags": [
          "ApiKeys"
        ]
      },
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Create an API key bound to a service account (admin only). The token is returned once.",
        "operationId": "create-service-account-api-key",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Service Account Name",
            "in": "path",
            "name": "serviceAccountName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Optional description",
            "in": "body",
            "name": "data",
            "schema": {
              "$ref": "#/definitions/CreateApiKeyRequest"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/ApiKey"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create a service-account API key",
        "tags": [
          "ApiKeys"
        ]
      }
    },
    "/orgs/{orgName}/service-accounts/{serviceAccountName}/api-keys/{apiKeyId}": {
      "delete": {
        "description": "Delete a service-account-bound API key (admin only). The key must belong to the SA in the path.",
        "operationId": "delete-service-account-api-key",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Service Account Name",
            "in": "path",
            "name": "serviceAccountName",
            "required": true,
            "type": "string"
          },
          {
            "description": "API key public ID",
            "in": "path",
            "name": "apiKeyId",
            "required": true,
            "type": "string"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "403": {
            "description": "Forbidden",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "404": {
            "description": "Not Found",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a service-account API key",
        "tags": [
          "ApiKeys"
        ]
      }
    },
    "/orgs/{orgName}/tests": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List Tests",
        "operationId": "list-tests",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/Test"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List Tests",
        "tags": [
          "Tests"
        ]
      }
    },
    "/orgs/{orgName}/tests/executions/": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Query test executions based on different criteria",
        "operationId": "query-test-executions",
        "parameters": [
          {
            "description": "Signadot Org name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Only include auto diff executions",
            "in": "query",
            "name": "isAutoDiff",
            "type": "string"
          },
          {
            "description": "Do not include executions from deleted tests",
            "in": "query",
            "name": "skipDeletedTests",
            "type": "string"
          },
          {
            "description": "Test source external or saas",
            "in": "query",
            "name": "source",
            "type": "string"
          },
          {
            "description": "Target sandbox name",
            "in": "query",
            "name": "targetSandbox",
            "type": "string"
          },
          {
            "description": "Target route group name",
            "in": "query",
            "name": "targetRouteGroup",
            "type": "string"
          },
          {
            "description": "Target routing key",
            "in": "query",
            "name": "targetRoutingKey",
            "type": "string"
          },
          {
            "description": "Revision of the target routing context",
            "in": "query",
            "name": "targetRevision",
            "type": "string"
          },
          {
            "description": "Cluster name",
            "in": "query",
            "name": "cluster",
            "type": "string"
          },
          {
            "description": "Whether the test is published to the UI by default",
            "in": "query",
            "name": "published",
            "type": "boolean"
          },
          {
            "description": "Test name",
            "in": "query",
            "name": "testName",
            "type": "string"
          },
          {
            "description": "Trigger name",
            "in": "query",
            "name": "triggerID",
            "type": "string"
          },
          {
            "description": "Trigger workload in JSON format",
            "in": "query",
            "name": "triggerWorkload",
            "type": "string"
          },
          {
            "description": "Test execution phase",
            "in": "query",
            "name": "executionPhase",
            "type": "string"
          },
          {
            "description": "CLI run identifier",
            "in": "query",
            "name": "runID",
            "type": "string"
          },
          {
            "description": "Repository name",
            "in": "query",
            "name": "repo",
            "type": "string"
          },
          {
            "description": "Repository path",
            "in": "query",
            "name": "repoPath",
            "type": "string"
          },
          {
            "description": "Repository path",
            "in": "query",
            "name": "repoBranch",
            "type": "string"
          },
          {
            "description": "Repository commit SHA",
            "in": "query",
            "name": "repoCommitSHA",
            "type": "string"
          },
          {
            "collectionFormat": "multi",
            "description": "Label constraint key:value (may be specified multiple times)",
            "in": "query",
            "items": {
              "type": "string"
            },
            "name": "label",
            "type": "array"
          },
          {
            "description": "Filter results starting from this time",
            "in": "query",
            "name": "from",
            "type": "string"
          },
          {
            "description": "Filter results until this time",
            "in": "query",
            "name": "to",
            "type": "string"
          },
          {
            "description": "Sorting direction",
            "enum": [
              "asc",
              "desc"
            ],
            "in": "query",
            "name": "orderDir",
            "type": "string"
          },
          {
            "description": "Number of rows to be included in the response",
            "in": "query",
            "name": "pageSize",
            "type": "integer"
          },
          {
            "description": "Start sending results from this cursor",
            "in": "query",
            "name": "cursor",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/testexecutions.QueryResult"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Query Test Executions",
        "tags": [
          "TestExecutions"
        ]
      },
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Create an external test execution",
        "operationId": "create-external-test-execution",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Request to create a test execution",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/TestExecution"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/TestExecution"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create External Test Execution",
        "tags": [
          "TestExecutions"
        ]
      }
    },
    "/orgs/{orgName}/tests/executions/{executionID}": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Fetch the details about a given test execution.",
        "operationId": "get-test-execution",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Test Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/TestExecution"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a test execution",
        "tags": [
          "TestExecutions"
        ]
      }
    },
    "/orgs/{orgName}/tests/executions/{executionID}/cancel": {
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Cancel a given test execution.",
        "operationId": "cancel-test-execution",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Test Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Cancel a test execution",
        "tags": [
          "TestExecutions"
        ]
      }
    },
    "/orgs/{orgName}/tests/executions/{executionID}/traffic-diff": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get the full traffic diff of a test execution",
        "operationId": "test-execution-traffic-diff",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Test Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/TrafficDiffResult"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get the full traffic diff of a test execution",
        "tags": [
          "TestExecutions"
        ]
      }
    },
    "/orgs/{orgName}/tests/executions/{executionID}/traffic-diff-findings": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Get the findings view of the traffic diff of a test execution",
        "operationId": "test-execution-traffic-diff-findings",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Test Execution ID",
            "in": "path",
            "name": "executionID",
            "required": true,
            "type": "string"
          },
          {
            "description": "Context",
            "in": "query",
            "name": "diffContext",
            "type": "string"
          },
          {
            "description": "Category",
            "in": "query",
            "name": "category",
            "type": "string"
          },
          {
            "description": "Max Findings",
            "in": "query",
            "name": "maxFindings",
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/TrafficDiffResult"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get the findings view of the traffic diff of a test execution",
        "tags": [
          "TestExecutions"
        ]
      }
    },
    "/orgs/{orgName}/tests/{testName}": {
      "delete": {
        "consumes": [
          "application/json"
        ],
        "description": "Delete a given test.",
        "operationId": "delete-test",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Test Name",
            "in": "path",
            "name": "testName",
            "required": true,
            "type": "string",
            "x-example": "job-xyz"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/EmptyResponse"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Delete a test",
        "tags": [
          "Tests"
        ]
      },
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "Fetch the details about a given test.",
        "operationId": "get-test",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Test Name",
            "in": "path",
            "name": "testName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Test"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Get a test",
        "tags": [
          "Tests"
        ]
      },
      "put": {
        "consumes": [
          "application/json"
        ],
        "description": "Creates or updates a test with the provided parameters.",
        "operationId": "apply-test",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Test Name",
            "in": "path",
            "name": "testName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Test Spec",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/TestSpec"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/Test"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create or update a Test",
        "tags": [
          "Tests"
        ]
      }
    },
    "/orgs/{orgName}/tests/{testName}/executions/": {
      "get": {
        "consumes": [
          "application/json"
        ],
        "description": "List test executions for a given test",
        "operationId": "list-test-executions",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Test name",
            "in": "path",
            "name": "testName",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "items": {
                "$ref": "#/definitions/TestExecution"
              },
              "type": "array"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "List Test Executions",
        "tags": [
          "TestExecutions"
        ]
      },
      "post": {
        "consumes": [
          "application/json"
        ],
        "description": "Creates a hosted test execution",
        "operationId": "create-hosted-test-execution",
        "parameters": [
          {
            "description": "Signadot Org Name",
            "in": "path",
            "name": "orgName",
            "required": true,
            "type": "string",
            "x-example": "my-company"
          },
          {
            "description": "Test name",
            "in": "path",
            "name": "testName",
            "required": true,
            "type": "string"
          },
          {
            "description": "Request to create a test execution",
            "in": "body",
            "name": "data",
            "required": true,
            "schema": {
              "$ref": "#/definitions/TestExecution"
            }
          }
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "OK",
            "schema": {
              "$ref": "#/definitions/TestExecution"
            }
          },
          "400": {
            "description": "Bad Request",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "401": {
            "description": "Unauthorized",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          },
          "502": {
            "description": "Bad Gateway",
            "schema": {
              "$ref": "#/definitions/ErrorResponse"
            }
          }
        },
        "security": [
          {
            "ApiKeyAuth": []
          }
        ],
        "summary": "Create Hosted Test Execution",
        "tags": [
          "TestExecutions"
        ]
      }
    },
    "/service-status": {
      "get": {
        "description": "Caching gateway over the public Status API: active and recently-resolved incidents plus in-progress and upcoming scheduled maintenance, normalized into a vendor-neutral shape and served from a short server-side cache. Always 200 (unconfigured or upstream failure yields empty arrays); unauthenticated.",
        "operationId": "service-status",
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "Current incidents and maintenance",
            "schema": {
              "$ref": "#/definitions/servicestatus.Response"
            }
          }
        },
        "summary": "Service status (incidents + maintenance)",
        "tags": [
          "ServiceStatus"
        ]
      }
    }
  },
  "securityDefinitions": {
    "ApiKeyAuth": {
      "in": "header",
      "name": "signadot-api-key",
      "type": "apiKey"
    }
  },
  "swagger": "2.0",
  "tags": [
    {
      "name": "ApiKeys"
    },
    {
      "name": "Artifacts"
    },
    {
      "name": "Auth"
    },
    {
      "name": "Cluster"
    },
    {
      "name": "Devboxes"
    },
    {
      "name": "Events"
    },
    {
      "name": "JobLogs"
    },
    {
      "name": "Jobs"
    },
    {
      "name": "Orgs"
    },
    {
      "name": "PlanActions"
    },
    {
      "name": "PlanExecutionLogs"
    },
    {
      "name": "PlanExecutions"
    },
    {
      "name": "PlanRunnerGroups"
    },
    {
      "name": "Plans"
    },
    {
      "name": "PlanTags"
    },
    {
      "name": "ResourcePlugins"
    },
    {
      "name": "RouteGroups"
    },
    {
      "name": "RunnerGroups"
    },
    {
      "name": "Sandboxes"
    },
    {
      "name": "Secrets"
    },
    {
      "name": "ServiceAccounts"
    },
    {
      "name": "ServiceStatus"
    },
    {
      "name": "TestExecutions"
    },
    {
      "name": "Tests"
    },
    {
      "name": "Meta"
    }
  ]
}