openapi: 3.1.0
info:
  title: Platform93 API
  version: 0.1.0
  license:
    name: Apache-2.0
    identifier: Apache-2.0
  description: Public contract for fresh Platform93 installations.
servers:
  - url: /
security:
  - bearerAuth: []
tags:
  - name: System
    description: Process health and build information.
  - name: Setup
    description: One-time installation bootstrap.
  - name: Control
    description: Platform users, organizations, and applications.
  - name: Management
    description: Machine-only installation provisioning and organization governance.
  - name: Identity
    description: Application-user authentication and profiles.
  - name: Catalog
    description: Features, products, and immutable prices.
  - name: Entitlements
    description: Grants and local entitlement requests.
  - name: Billing
    description: Provider connections and billing lifecycle.
  - name: Storage
    description: Optional tenant-aware S3-compatible object storage.
  - name: Events
    description: Domain events, outgoing webhooks, and audit.
paths:
  /auth/invitations/{invitation_id}:
    get:
      operationId: startHostedInvitation
      tags: [Auth]
      parameters:
        - name: invitation_id
          in: path
          required: true
          schema: {$ref: '#/components/schemas/UUID'}
        - name: link_token
          in: query
          required: true
          schema: {type: string, maxLength: 256}
      responses:
        '303': {description: Browser-bound hosted invitation page.}
  /v1/auth/hosted/interactions/{interaction_id}:
    parameters:
      - $ref: '#/components/parameters/HostedInteractionID'
    get:
      operationId: getHostedAuthInteraction
      tags: [Auth]
      security: [{hostedCookie: []}]
      responses:
        '200':
          description: Browser-bound interaction without bearer credentials.
          content:
            application/json:
              schema: {$ref: '#/components/schemas/HostedAuthView'}
  /v1/auth/hosted/interactions/{interaction_id}/actions:
    parameters:
      - $ref: '#/components/parameters/HostedInteractionID'
      - $ref: '#/components/parameters/HostedCSRF'
    post:
      operationId: performHostedAuthAction
      tags: [Auth]
      security: [{hostedCookie: []}]
      requestBody:
        required: true
        content:
          application/json:
            schema: {$ref: '#/components/schemas/HostedAuthAction'}
      responses:
        '200':
          description: Updated interaction, redirect, or passkey options.
          content:
            application/json:
              schema: {$ref: '#/components/schemas/HostedAuthResult'}
  /v1/auth/hosted/interactions/{interaction_id}/return:
    parameters:
      - $ref: '#/components/parameters/HostedInteractionID'
      - $ref: '#/components/parameters/HostedCSRF'
    post:
      operationId: exchangeHostedAuthReturn
      tags: [Auth]
      security: [{hostedCookie: []}]
      requestBody:
        required: true
        content:
          application/json:
            schema: {$ref: '#/components/schemas/HostedAuthReturn'}
      responses:
        '200':
          description: Updated interaction after provider or email return.
          content:
            application/json:
              schema: {$ref: '#/components/schemas/HostedAuthView'}
  /auth/return/{interaction_id}:
    parameters:
      - $ref: '#/components/parameters/HostedInteractionID'
    get:
      operationId: redirectHostedAuthReturn
      tags: [Auth]
      security: [{hostedCookie: []}]
      responses:
        '303':
          description: Redirect to hosted page; credentials are not consumed on GET.
          headers:
            Location:
              schema: {type: string}
  /v1/control/installation/auth-branding:
    get:
      operationId: getInstallationAuthBranding
      tags: [Control]
      security: [{controlBearer: []}, {controlCookie: []}]
      responses:
        '200':
          description: Branding override and version.
          content:
            application/json:
              schema: {$ref: '#/components/schemas/HostedBrandingSettings'}
    put:
      operationId: updateInstallationAuthBranding
      tags: [Control]
      security: [{controlBearer: []}, {controlCookie: []}]
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      requestBody:
        required: true
        content:
          application/json:
            schema: {$ref: '#/components/schemas/HostedBranding'}
      responses:
        '204': {description: Branding saved; empty configuration restores defaults.}
  /v1/control/organizations/{organization_id}/auth-branding:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: getOrganizationAuthBranding
      tags: [Control]
      security: [{controlBearer: []}, {controlCookie: []}]
      responses:
        '200':
          description: Branding override and version.
          content:
            application/json:
              schema: {$ref: '#/components/schemas/HostedBrandingSettings'}
    put:
      operationId: updateOrganizationAuthBranding
      tags: [Control]
      security: [{controlBearer: []}, {controlCookie: []}]
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      requestBody:
        required: true
        content:
          application/json:
            schema: {$ref: '#/components/schemas/HostedBranding'}
      responses:
        '204': {description: Branding saved.}
  /v1/control/applications/{application_id}/auth-branding:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: getApplicationAuthBranding
      tags: [Control]
      security: [{controlBearer: []}, {controlCookie: []}]
      responses:
        '200':
          description: Branding override, effective settings, and version.
          content:
            application/json:
              schema: {$ref: '#/components/schemas/HostedBrandingSettings'}
    put:
      operationId: updateApplicationAuthBranding
      tags: [Control]
      security: [{controlBearer: []}, {controlCookie: []}]
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      requestBody:
        required: true
        content:
          application/json:
            schema: {$ref: '#/components/schemas/HostedBranding'}
      responses:
        '204': {description: Branding saved.}
  /healthz:
    get:
      operationId: health
      tags:
        - System
      security: []
      responses:
        '200':
          description: Process is alive
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HealthStatus'
  /readyz:
    get:
      operationId: readiness
      tags:
        - System
      security: []
      responses:
        '200':
          description: Process is ready
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HealthStatus'
        '503':
          $ref: '#/components/responses/Problem'
  /version:
    get:
      operationId: version
      tags:
        - System
      security: []
      responses:
        '200':
          description: Build information
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VersionInfo'
  /v1/setup/status:
    get:
      operationId: setupStatus
      tags:
        - Setup
      security: []
      responses:
        '200':
          description: Setup and Platform user login availability
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SetupStatus'
  /v1/setup/bootstrap:
    post:
      operationId: bootstrap
      tags:
        - Setup
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BootstrapRequest'
      responses:
        '201':
          description: Setup-only Platform user session
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SetupSession'
        '401':
          $ref: '#/components/responses/Problem'
  /v1/setup/complete:
    post:
      operationId: completeSetup
      tags:
        - Setup
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CompleteSetup'
      responses:
        '200':
          description: Setup completed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SetupCompletion'
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
  /v1/setup/notification-providers:
    post:
      operationId: createSetupNotificationProvider
      tags:
        - Setup
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/SMTPProvider'
      responses:
        '201':
          description: Installation SMTP provider stored
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProvider'
  /v1/control/auth/email/start:
    post:
      operationId: startControlUserEmailLogin
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ControlEmailStart'
      responses:
        '202':
          description: Enumeration-safe Platform user challenge accepted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeAccepted'
  /v1/control/auth/email/verify:
    post:
      operationId: verifyControlUserEmailLogin
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailVerify'
      responses:
        '200':
          description: Platform user cookie session created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
  /v1/control/auth/password:
    post:
      operationId: loginControlUserWithPassword
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ControlUserPasswordLogin'
      responses:
        '200':
          description: Platform user cookie session created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '401':
          $ref: '#/components/responses/Problem'
    put:
      operationId: changeControlUserPassword
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ControlUserPasswordChange'
      responses:
        '204':
          description: Password stored and other Platform user sessions revoked
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/auth/me:
    get:
      operationId: getControlUserAccount
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Current Platform user profile and sign-in methods
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlUserAccount'
    patch:
      operationId: updateControlUserAccount
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateControlUserAccount'
      responses:
        '204':
          description: Platform user profile updated
  /v1/control/auth/logout:
    post:
      operationId: logoutControlUser
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Platform user session revoked
  /v1/control/auth/token/refresh:
    post:
      operationId: refreshControlUserSession
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Platform user session credential rotated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
  /v1/control/auth/sessions:
    get:
      operationId: listControlUserSessions
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listControlUserSessions response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SessionPage'
  /v1/control/auth/sessions/{session_id}:
    parameters:
      - name: session_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: revokeControlUserSession
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Platform user session revoked
  /v1/control/auth/logout-all:
    post:
      operationId: logoutAllControlUserSessions
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: All Platform user sessions revoked
  /v1/control/auth/methods:
    get:
      operationId: getControlAuthMethods
      tags:
        - Identity
      security: []
      responses:
        '200':
          description: Available Platform user sign-in methods
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlAuthMethods'
  /v1/control/auth/providers/{provider}/start:
    parameters:
      - name: provider
        in: path
        required: true
        schema:
          type: string
          enum:
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
    post:
      operationId: startControlExternalLogin
      tags:
        - Identity
      security: []
      responses:
        '201':
          description: External Platform sign-in started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalAuthStart'
  /v1/control/auth/providers/{provider}/link:
    parameters:
      - name: provider
        in: path
        required: true
        schema:
          type: string
          enum:
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
    post:
      operationId: linkControlExternalIdentity
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '201':
          description: External Platform identity link started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalAuthStart'
  /v1/control/auth/identities/{identity_id}:
    parameters:
      - name: identity_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: unlinkControlExternalIdentity
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: External Platform identity unlinked
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/invitations/accept:
    post:
      operationId: acceptControlUserInvitation
      tags:
        - Control
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AcceptControlUserInvitation'
      responses:
        '200':
          description: Invitation accepted and Platform user cookie issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '401':
          $ref: '#/components/responses/Problem'
  /v1/control/invitations/providers/{provider}/start:
    parameters:
      - name: provider
        in: path
        required: true
        schema:
          type: string
          enum:
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
    post:
      operationId: startControlInvitationExternalLogin
      tags:
        - Control
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ControlInvitationProviderStart'
      responses:
        '201':
          description: Provider-backed invitation acceptance started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalAuthStart'
  /v1/control/installation/notification-providers:
    get:
      operationId: listInstallationNotificationProviders
      tags:
        - Setup
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listInstallationNotificationProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProviderPage'
    post:
      operationId: createInstallationNotificationProvider
      tags:
        - Setup
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/SMTPProvider'
      responses:
        '201':
          description: Installation SMTP provider stored
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProvider'
  /v1/control/installation/notification-providers/{provider_id}:
    parameters:
      - name: provider_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getInstallationNotificationProvider
      tags:
        - Setup
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Installation notification provider metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProvider'
        '404':
          $ref: '#/components/responses/Problem'
    patch:
      operationId: updateInstallationNotificationProvider
      tags:
        - Setup
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateSMTPProvider'
      responses:
        '200':
          description: Installation notification provider updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProvider'
        '404':
          $ref: '#/components/responses/Problem'
    delete:
      operationId: disableInstallationNotificationProvider
      tags:
        - Setup
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Installation notification provider disabled
        '404':
          $ref: '#/components/responses/Problem'
  /v1/control/installation/notification-providers/{provider_id}/verify:
    parameters:
      - name: provider_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: verifyInstallationNotificationProvider
      tags:
        - Setup
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: SMTP connectivity and credentials verified
        '502':
          $ref: '#/components/responses/Problem'
  /v1/control/installation/notification-providers/{provider_id}/test:
    parameters:
      - name: provider_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - $ref: '#/components/parameters/IdempotencyKey'
    post:
      operationId: testInstallationNotificationProvider
      tags:
        - Setup
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TestNotificationProvider'
      responses:
        '202':
          description: Installation SMTP test queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationQueued'
        '404':
          $ref: '#/components/responses/Problem'
  /v1/control/installation/auth/providers:
    get:
      operationId: listInstallationAuthProviders
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listInstallationAuthProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProviderPage'
  /v1/control/installation/auth/providers/{provider}:
    parameters:
      - name: provider
        in: path
        required: true
        schema:
          type: string
          enum:
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
    put:
      operationId: configureInstallationAuthProvider
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfigureAuthProvider'
      responses:
        '200':
          description: Installation authentication provider configured
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProvider'
    patch:
      operationId: updateInstallationAuthProvider
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateInstallationAuthProvider'
      responses:
        '204':
          description: Installation authentication provider settings updated
        '404':
          $ref: '#/components/responses/Problem'
    delete:
      operationId: disableInstallationAuthProvider
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Installation authentication provider disabled
  /v1/control/installation/billing/providers:
    get:
      operationId: listInstallationBillingProviders
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listInstallationBillingProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProviderPage'
    post:
      operationId: createInstallationBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateBillingProvider'
      responses:
        '201':
          description: Installation billing provider configured
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProvider'
  /v1/control/installation/billing/providers/{provider_id}:
    parameters:
      - $ref: '#/components/parameters/ProviderID'
    get:
      operationId: getInstallationBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Secret-free installation billing provider
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProvider'
    patch:
      operationId: updateInstallationBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateBillingProvider'
      responses:
        '204':
          description: Installation billing provider updated
    delete:
      operationId: disableInstallationBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Installation billing provider disabled
  /v1/control/installation/billing/providers/{provider_id}/verify:
    parameters:
      - $ref: '#/components/parameters/ProviderID'
    post:
      operationId: verifyInstallationBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Installation billing provider credentials verified
  /v1/control/installation/users:
    get:
      operationId: listInstallationControlUsers
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listInstallationControlUsers response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlUserPage'
  /v1/control/installation/users/{control_user_id}:
    parameters:
      - name: control_user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    patch:
      operationId: updateInstallationControlUser
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MembershipRole'
      responses:
        '204':
          description: Installation role updated
    delete:
      operationId: deleteInstallationControlUser
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Installation role removed and sessions revoked
  /v1/control/installation/invitations:
    get:
      operationId: listInstallationControlUserInvitations
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listInstallationControlUserInvitations response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlUserInvitationPage'
    post:
      operationId: createInstallationControlUserInvitation
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateControlUserInvitation'
      responses:
        '201':
          description: Platform user invitation created and credential returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlUserInvitation'
  /v1/control/installation/invitations/{invitation_id}/resend:
    parameters:
      - name: invitation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: resendInstallationControlUserInvitation
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateControlInvitationMethod'
      responses:
        '200':
          description: Platform user invitation rotated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlUserInvitation'
  /v1/control/installation/invitations/{invitation_id}:
    parameters:
      - name: invitation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: revokeInstallationControlUserInvitation
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Platform user invitation revoked
  /v1/control/installation/auth-policy:
    get:
      operationId: getControlAuthPolicy
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Platform authentication policy
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlAuthPolicy'
    patch:
      operationId: updateControlAuthPolicy
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateControlAuthPolicy'
      responses:
        '204':
          description: Platform authentication policy updated
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/installation/signing-keys:
    get:
      operationId: listSigningKeys
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listSigningKeys response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SigningKeyPage'
  /v1/control/installation/signing-keys/rotate:
    post:
      operationId: rotateSigningKey
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '201':
          description: New installation signing key activated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SigningKey'
  /v1/control/installation/management-api:
    get:
      operationId: getManagementAPIStatus
      tags:
        - Management
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Management API installation status
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagementAPIStatus'
    patch:
      operationId: updateManagementAPIStatus
      tags:
        - Management
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateManagementAPI'
      responses:
        '200':
          description: Management API status updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagementAPIStatus'
  /v1/control/installation/management-clients:
    get:
      operationId: listManagementClients
      tags:
        - Management
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listManagementClients response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagementClientPage'
    post:
      operationId: createManagementClient
      tags:
        - Management
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateManagementClient'
      responses:
        '201':
          description: Management client created and secret returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagementClient'
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/installation/management-clients/{management_client_id}/rotate-secret:
    parameters:
      - name: management_client_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: rotateManagementClientSecret
      tags:
        - Management
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Management client secret rotated and returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretCredential'
  /v1/control/installation/management-clients/{management_client_id}:
    parameters:
      - name: management_client_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: disableManagementClient
      tags:
        - Management
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Management client disabled and all of its tokens invalidated
  /v1/control/installation/organizations/{organization_id}/policy:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    put:
      operationId: updateOrganizationPolicy
      tags:
        - Management
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrganizationPolicy'
      responses:
        '204':
          description: Installation-owned organization policy updated
        '412':
          $ref: '#/components/responses/Problem'
  /v1/control/organizations:
    get:
      operationId: listOrganizations
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/IncludeRetired'
      responses:
        '200':
          description: Accessible organizations and the current installation role
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationPage'
    post:
      operationId: createOrganization
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/Named'
      responses:
        '201':
          description: Organization created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Organization'
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/organizations/{organization_id}/applications:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: listApplications
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/IncludeRetired'
      responses:
        '200':
          description: Successful listApplications response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationPage'
    post:
      operationId: createApplication
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/Named'
      responses:
        '201':
          description: Application created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Application'
  /v1/control/organizations/{organization_id}/applications/{application_resource_id}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: application_resource_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    patch:
      operationId: updateApplication
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/Rename'
      responses:
        '204':
          description: Application renamed
        '412':
          $ref: '#/components/responses/Problem'
    delete:
      operationId: retireApplication
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Application retired and live credentials revoked
  /v1/control/organizations/{organization_id}/applications/{application_resource_id}/restore:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: application_resource_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: restoreApplication
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Application restored without restoring revoked credentials
  /v1/control/organizations/{organization_id}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: getOrganization
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Organization details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Organization'
    patch:
      operationId: updateOrganization
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/Rename'
      responses:
        '204':
          description: Organization renamed
        '412':
          $ref: '#/components/responses/Problem'
    delete:
      operationId: retireOrganization
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Organization and active descendants retired
  /v1/control/organizations/{organization_id}/policy:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: getOrganizationPolicy
      tags:
        - Management
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Organization policy and current usage
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationPolicy'
  /v1/control/organizations/{organization_id}/restore:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    post:
      operationId: restoreOrganization
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Organization restored; descendants remain retired
  /v1/control/organizations/{organization_id}/members:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: listOrganizationMembers
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listOrganizationMembers response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationMemberPage'
  /v1/control/organizations/{organization_id}/members/{member_id}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: member_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    patch:
      operationId: updateOrganizationMember
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MembershipRole'
      responses:
        '204':
          description: Organization role updated
    delete:
      operationId: deleteOrganizationMember
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Organization member removed
  /v1/control/organizations/{organization_id}/invitations:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: listOrganizationInvitations
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listOrganizationInvitations response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlUserInvitationPage'
    post:
      operationId: createOrganizationInvitation
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateControlUserInvitation'
      responses:
        '201':
          description: Invitation queued and credential returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlUserInvitation'
  /v1/control/organizations/{organization_id}/invitations/{invitation_id}/resend:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: invitation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: resendOrganizationInvitation
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Invitation credential rotated and delivery queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlUserInvitation'
  /v1/control/organizations/{organization_id}/invitations/{invitation_id}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: invitation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: revokeOrganizationInvitation
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Pending invitation revoked
  /v1/control/organizations/{organization_id}/audit-logs:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: listOrganizationAuditLogs
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listOrganizationAuditLogs response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditRecordPage'
  /v1/control/organizations/{organization_id}/auth/providers:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: listOrganizationAuthProviders
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listOrganizationAuthProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProviderPage'
  /v1/control/organizations/{organization_id}/auth/providers/{provider}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: provider
        in: path
        required: true
        schema:
          type: string
          enum:
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
    put:
      operationId: configureOrganizationAuthProvider
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfigureAuthProvider'
      responses:
        '200':
          description: Organization authentication provider configured
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProvider'
    patch:
      operationId: updateOrganizationAuthProvider
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/ProviderInheritance'
      responses:
        '204':
          description: Organization authentication provider inheritance updated
        '404':
          $ref: '#/components/responses/Problem'
    delete:
      operationId: disableOrganizationAuthProvider
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Organization authentication provider disabled
  /v1/control/organizations/{organization_id}/notification-providers:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: listOrganizationNotificationProviders
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listOrganizationNotificationProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProviderPage'
    post:
      operationId: createOrganizationNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/SMTPProvider'
      responses:
        '201':
          description: Organization SMTP provider stored
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProvider'
  /v1/control/organizations/{organization_id}/notification-providers/{provider_id}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: provider_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getOrganizationNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Redacted organization SMTP provider
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProvider'
    patch:
      operationId: updateOrganizationNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateSMTPProvider'
      responses:
        '200':
          description: Organization SMTP provider updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProvider'
    delete:
      operationId: disableOrganizationNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Organization SMTP provider disabled
  /v1/control/organizations/{organization_id}/notification-providers/{provider_id}/verify:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: provider_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: verifyOrganizationNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Organization SMTP provider verified
  /v1/control/organizations/{organization_id}/notification-providers/{provider_id}/test:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: provider_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - $ref: '#/components/parameters/IdempotencyKey'
    post:
      operationId: testOrganizationNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TestNotificationProvider'
      responses:
        '202':
          description: Organization SMTP test queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationQueued'
  /v1/control/organizations/{organization_id}/billing/providers:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: listOrganizationBillingProviders
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listOrganizationBillingProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProviderPage'
    post:
      operationId: createOrganizationBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateBillingProvider'
      responses:
        '201':
          description: Organization billing provider configured
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProvider'
  /v1/control/organizations/{organization_id}/billing/providers/{provider_id}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - $ref: '#/components/parameters/ProviderID'
    get:
      operationId: getOrganizationBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Secret-free organization billing provider
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProvider'
    patch:
      operationId: updateOrganizationBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateBillingProvider'
      responses:
        '204':
          description: Organization billing provider updated
    delete:
      operationId: disableOrganizationBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Organization billing provider disabled
  /v1/control/organizations/{organization_id}/billing/providers/{provider_id}/verify:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - $ref: '#/components/parameters/ProviderID'
    post:
      operationId: verifyOrganizationBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Organization billing provider credentials verified
  /v1/applications/{application_id}/public-config:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: publicConfig
      tags:
        - Control
      security: []
      responses:
        '200':
          description: Secret-free runtime configuration
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuntimeConfig'
  /v1/control/applications/{application_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: getApplication
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Application details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Application'
  /v1/control/applications/{application_id}/statistics:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: getApplicationStatistics
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Application identity, catalog, billing, and delivery counts
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationStatistics'
  /v1/control/applications/{application_id}/public-config:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    patch:
      operationId: updatePublicApplicationConfig
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/PublicApplicationConfig'
      responses:
        '204':
          description: Explicitly public runtime configuration replaced
        '412':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/internal-config:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    patch:
      operationId: updateInternalApplicationConfig
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/InternalApplicationConfig'
      responses:
        '204':
          description: Internal application policy updated and disabled credentials revoked
        '412':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/auth-config:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    patch:
      operationId: updateAuthConfig
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/ApplicationAuthConfig'
      responses:
        '204':
          description: Authentication configuration and PKCE application redirects updated
  /v1/control/applications/{application_id}/auth/providers/google:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    put:
      operationId: configureGoogleProvider
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfigureAuthProvider'
      responses:
        '200':
          description: Google client configured and callback URI returned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProvider'
  /v1/control/applications/{application_id}/auth/providers/apple:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    put:
      operationId: configureAppleProvider
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfigureAuthProvider'
      responses:
        '200':
          description: Apple client configured and callback URI returned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProvider'
  /v1/control/applications/{application_id}/auth/providers:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listApplicationAuthProviders
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listApplicationAuthProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProviderPage'
  /v1/control/applications/{application_id}/auth/providers/{provider}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: provider
        in: path
        required: true
        schema:
          type: string
          enum:
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
    put:
      operationId: configureApplicationAuthProvider
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfigureAuthProvider'
      responses:
        '200':
          description: Application authentication provider configured
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProvider'
    delete:
      operationId: disableApplicationAuthProvider
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Application authentication provider disabled
  /v1/control/applications/{application_id}/domains:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listApplicationDomains
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listApplicationDomains response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationDomainPage'
    post:
      operationId: createApplicationDomain
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateApplicationDomain'
      responses:
        '201':
          description: Domain added and DNS proof returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationDomain'
  /v1/control/applications/{application_id}/domains/{domain_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: domain_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: deleteApplicationDomain
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Domain removed
  /v1/control/applications/{application_id}/domains/{domain_id}/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: domain_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: verifyApplicationDomain
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: DNS ownership verified
  /v1/control/applications/{application_id}/clients:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listClients
      parameters:
        - $ref: '#/components/parameters/ReferenceQuery'
        - $ref: '#/components/parameters/ReferenceLimit'
        - $ref: '#/components/parameters/ReferenceCursor'
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listClients response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthClientPage'
    post:
      operationId: createClient
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateClient'
      responses:
        '201':
          description: Client created and secret returned once when applicable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthClient'
  /v1/control/applications/{application_id}/clients/{client_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: client_id
        in: path
        required: true
        schema:
          type: string
    get:
      operationId: getClient
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Client detail
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthClient'
    patch:
      operationId: updateClient
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateClient'
      responses:
        '204':
          description: Client updated
    delete:
      operationId: disableClient
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Client and active OAuth grants disabled
  /v1/control/applications/{application_id}/clients/{client_id}/rotate-secret:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: client_id
        in: path
        required: true
        schema:
          type: string
    post:
      operationId: rotateClientSecret
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Replacement client secret returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretCredential'
  /v1/control/applications/{application_id}/roles:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listRoles
      parameters:
        - $ref: '#/components/parameters/ReferenceQuery'
        - $ref: '#/components/parameters/ReferenceLimit'
        - $ref: '#/components/parameters/ReferenceCursor'
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listRoles response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RolePage'
    post:
      operationId: createRole
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRole'
      responses:
        '201':
          description: Role created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        '422':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/roles/{role_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: role_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getRole
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Role details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        '404':
          $ref: '#/components/responses/Problem'
    patch:
      operationId: updateRole
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRole'
      responses:
        '204':
          description: Role updated
        '409':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
    delete:
      operationId: deleteRole
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Unassigned custom role deleted
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/workspaces:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listWorkspaces
      parameters:
        - $ref: '#/components/parameters/ReferenceQuery'
        - $ref: '#/components/parameters/ReferenceLimit'
        - $ref: '#/components/parameters/ReferenceCursor'
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listWorkspaces response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspacePage'
    post:
      operationId: createWorkspace
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWorkspace'
      responses:
        '201':
          description: Workspace created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace'
  /v1/control/applications/{application_id}/workspaces/{workspace_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getWorkspace
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Workspace details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace'
    patch:
      operationId: updateWorkspace
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWorkspace'
      responses:
        '204':
          description: Workspace updated
    delete:
      operationId: deleteWorkspace
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Workspace retired and memberships removed
        '404':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/workspaces/{workspace_id}/owner-transfer:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: recoverWorkspaceOwnership
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/OwnershipTransfer'
      responses:
        '200':
          $ref: '#/components/responses/OwnershipTransferResult'
  /v1/control/applications/{application_id}/workspaces/{workspace_id}/members:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: listWorkspaceMembers
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listWorkspaceMembers response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspaceMemberPage'
  /v1/control/applications/{application_id}/workspaces/{workspace_id}/members/{user_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    put:
      operationId: replaceWorkspaceMemberRoles
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReplaceWorkspaceMemberRoles'
      responses:
        '200':
          description: Workspace member roles replaced atomically
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspaceMember'
    delete:
      operationId: deleteWorkspaceMember
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Workspace membership removed
  /v1/control/applications/{application_id}/role-assignments:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listRoleAssignments
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listRoleAssignments response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAssignmentPage'
    post:
      operationId: createRoleAssignment
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/RoleAssignment'
      responses:
        '201':
          description: User or machine-client role assignment created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAssignmentRecord'
  /v1/control/applications/{application_id}/role-assignments/{assignment_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: assignment_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: deleteRoleAssignment
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Role assignment deleted
  /v1/control/applications/{application_id}/permission-grants:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/OptionalPermissionSubjectType'
      - $ref: '#/components/parameters/OptionalPermissionSubjectID'
      - $ref: '#/components/parameters/WorkspaceIDQuery'
      - $ref: '#/components/parameters/PermissionGrantStatus'
    get:
      operationId: listControlPermissionGrants
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listControlPermissionGrants response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGrantPage'
    post:
      operationId: createControlPermissionGrant
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/RequiredIdempotencyKey'
      requestBody:
        $ref: '#/components/requestBodies/PermissionGrantBody'
      responses:
        '201':
          description: Direct permission grant created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGrant'
        '422':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/permission-grants/effective:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/PermissionSubjectType'
      - $ref: '#/components/parameters/PermissionSubjectID'
      - $ref: '#/components/parameters/WorkspaceIDQuery'
    get:
      operationId: getControlEffectiveAccess
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Effective roles and scopes
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EffectiveAccess'
  /v1/control/applications/{application_id}/permission-grants/{grant_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: grant_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getControlPermissionGrant
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Direct permission grant
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGrant'
    delete:
      operationId: revokeControlPermissionGrant
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      responses:
        '204':
          description: Direct permission grant revoked
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/delegations:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listDelegations
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listDelegations response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DelegationPage'
    post:
      operationId: createDelegation
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateDelegation'
      responses:
        '201':
          description: Short-lived one-time delegation exchange credential
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Delegation'
  /v1/control/applications/{application_id}/delegations/{delegation_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: delegation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getDelegation
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Delegation details and lifecycle state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Delegation'
  /v1/applications/{application_id}/delegations/{delegation_id}/exchange:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: delegation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: exchangeDelegation
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExchangeDelegation'
      responses:
        '200':
          description: Non-refreshable delegated access token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
  /v1/applications/{application_id}/notifications:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/RequiredIdempotencyKey'
    post:
      operationId: sendMachineNotification
      tags:
        - Events
      description: Machine-client-only template notification delivery.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QueueNotification'
      responses:
        '202':
          description: Notification queued or suppressed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueuedNotification'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/permission-grants:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/OptionalPermissionSubjectType'
      - $ref: '#/components/parameters/OptionalPermissionSubjectID'
      - $ref: '#/components/parameters/WorkspaceIDQuery'
      - $ref: '#/components/parameters/PermissionGrantStatus'
    get:
      operationId: listPermissionGrants
      tags:
        - Control
      responses:
        '200':
          description: Successful listPermissionGrants response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGrantPage'
        '403':
          $ref: '#/components/responses/Problem'
    post:
      operationId: createPermissionGrant
      tags:
        - Control
      parameters:
        - $ref: '#/components/parameters/RequiredIdempotencyKey'
      requestBody:
        $ref: '#/components/requestBodies/PermissionGrantBody'
      responses:
        '201':
          description: Direct permission grant created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGrant'
        '403':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/permission-grants/effective:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/PermissionSubjectType'
      - $ref: '#/components/parameters/PermissionSubjectID'
      - $ref: '#/components/parameters/WorkspaceIDQuery'
    get:
      operationId: getEffectiveAccess
      tags:
        - Control
      responses:
        '200':
          description: Effective roles and scopes
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EffectiveAccess'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/permission-grants/{grant_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: grant_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getPermissionGrant
      tags:
        - Control
      responses:
        '200':
          description: Direct permission grant
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGrant'
    delete:
      operationId: revokePermissionGrant
      tags:
        - Control
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      responses:
        '204':
          description: Direct permission grant revoked
        '409':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/invitations:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listApplicationInvitations
      tags:
        - Control
      responses:
        '200':
          description: Successful listApplicationInvitations response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationInvitationPage'
    post:
      operationId: createApplicationInvitationMachine
      tags:
        - Control
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateInvitation'
      responses:
        '201':
          description: Invitation created and email queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationInvitation'
  /v1/applications/{application_id}/invitations/{invitation_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: invitation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getApplicationInvitation
      tags:
        - Control
      responses:
        '200':
          description: Invitation detail
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationInvitation'
    delete:
      operationId: revokeApplicationInvitation
      tags:
        - Control
      responses:
        '204':
          description: Pending invitation revoked
  /v1/applications/{application_id}/invitations/{invitation_id}/resend:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: invitation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: resendApplicationInvitation
      tags:
        - Control
      responses:
        '202':
          description: Invitation credentials rotated and email queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvitationResent'
        '429':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/users:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: serviceListApplicationUsers
      tags:
        - Identity
      responses:
        '200':
          description: Successful serviceListApplicationUsers response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserPage'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/users/{user_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: serviceGetApplicationUser
      tags:
        - Identity
      responses:
        '200':
          description: Redacted application user
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/workspaces:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: serviceListApplicationWorkspaces
      tags:
        - Control
      responses:
        '200':
          description: Successful serviceListApplicationWorkspaces response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspacePage'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/service/workspaces/{workspace_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: serviceGetApplicationWorkspace
      tags:
        - Control
      responses:
        '200':
          description: Workspace detail
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/service/workspaces/{workspace_id}/access:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: serviceListApplicationWorkspaceAccess
      tags:
        - Control
      responses:
        '200':
          description: Successful serviceListApplicationWorkspaceAccess response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspaceAccessPage'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/subjects/{subject_type}/{subject_id}/entitlements:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: subject_type
        in: path
        required: true
        schema:
          enum:
            - user
            - workspace
      - name: subject_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: serviceGetSubjectEntitlements
      tags:
        - Entitlements
      responses:
        '200':
          description: Successful serviceGetSubjectEntitlements response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntitlementGrantPage'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/subjects/{subject_type}/{subject_id}/billing:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: subject_type
        in: path
        required: true
        schema:
          enum:
            - user
            - workspace
      - name: subject_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: serviceGetSubjectBilling
      tags:
        - Billing
      responses:
        '200':
          description: Subject billing profile and subscription summary
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingSummary'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/delegations/{delegation_id}/revoke:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: delegation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: revokeDelegation
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Delegation and delegated sessions revoked
  /v1/control/applications/{application_id}/invitations:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listApplicationInvitationsControl
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listApplicationInvitationsControl response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationInvitationPage'
    post:
      operationId: createApplicationInvitationControl
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateInvitation'
      responses:
        '201':
          description: Application or workspace invitation created and email queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationInvitation'
  /v1/control/applications/{application_id}/invitations/{invitation_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: invitation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getApplicationInvitationControl
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Invitation detail
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationInvitation'
    delete:
      operationId: revokeApplicationInvitationControl
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Pending invitation revoked
  /v1/control/applications/{application_id}/invitations/{invitation_id}/resend:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: invitation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: resendApplicationInvitationControl
      tags:
        - Control
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '202':
          description: Invitation credentials rotated and localized email queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvitationResent'
        '429':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/users:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listUsers
      parameters:
        - $ref: '#/components/parameters/ReferenceQuery'
        - $ref: '#/components/parameters/ReferenceLimit'
        - $ref: '#/components/parameters/ReferenceCursor'
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listUsers response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserPage'
    post:
      operationId: createUser
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateUser'
      responses:
        '201':
          description: User created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
  /v1/control/applications/{application_id}/users/{user_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getUser
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: User details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
    patch:
      operationId: updateUser
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateUser'
      responses:
        '204':
          description: User updated
  /v1/control/applications/{application_id}/users/{user_id}/suspend:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: suspendUser
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '204':
          description: User suspended and active grants revoked
  /v1/control/applications/{application_id}/users/{user_id}/restore:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: restoreUser
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '204':
          description: Suspended user restored without restoring old sessions
  /v1/control/applications/{application_id}/users/{user_id}/verify-email:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: verifyUserEmail
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '204':
          description: User email administratively verified
  /v1/control/applications/{application_id}/users/{user_id}/unverify-email:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: unverifyUserEmail
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '204':
          description: User email verification removed
  /v1/control/applications/{application_id}/users/{user_id}/verify-organization:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: verifyUserOrganization
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '204':
          description: User organization administratively verified
  /v1/control/applications/{application_id}/users/{user_id}/unverify-organization:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: unverifyUserOrganization
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '204':
          description: User organization verification removed
  /v1/control/applications/{application_id}/users/{user_id}/sessions:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: listUserSessions
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listUserSessions response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SessionPage'
  /v1/control/applications/{application_id}/users/{user_id}/sessions/revoke:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: revokeUserSessions
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: All active user sessions revoked
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RevokedSessionCount'
  /v1/control/applications/{application_id}/users/{user_id}/addresses:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: listUserAddresses
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listUserAddresses response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddressPage'
  /v1/control/applications/{application_id}/oauth-consents:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listOAuthConsents
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listOAuthConsents response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthConsentPage'
  /v1/control/applications/{application_id}/oauth-consents/{user_id}/{client_id}/revoke:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - name: client_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: revokeOAuthConsent
      tags:
        - Identity
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Consent and active grants revoked
  /v1/control/applications/{application_id}/features:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listFeatures
      tags:
        - Catalog
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listFeatures response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FeaturePage'
    post:
      operationId: createFeature
      tags:
        - Catalog
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateFeature'
      responses:
        '201':
          description: Feature created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Feature'
        '422':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/auth/password/sign-up:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: passwordSignUp
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordSignUp'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/auth/password/sign-in:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: passwordSignIn
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordSignIn'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
        '401':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/auth/methods:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: authMethods
      tags:
        - Identity
      security: []
      responses:
        '200':
          description: Enumeration-safe enabled authentication methods
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthMethods'
  /v1/applications/{application_id}/auth/email/start:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: emailStart
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailStart'
      responses:
        '202':
          description: Enumeration-safe challenge accepted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeAccepted'
  /v1/applications/{application_id}/auth/email/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: emailVerify
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailVerify'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
  /v1/applications/{application_id}/auth/token/refresh:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: refresh
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RefreshToken'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
  /v1/applications/{application_id}/auth/password/reset/start:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: passwordResetStart
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordResetStart'
      responses:
        '202':
          description: Enumeration-safe reset challenge accepted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeAccepted'
  /v1/applications/{application_id}/auth/password/reset/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: passwordResetVerify
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordResetVerify'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
  /v1/applications/{application_id}/auth/providers:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listAuthProviders
      tags:
        - Identity
      security: []
      responses:
        '200':
          description: Successful listAuthProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthProviderPage'
  /v1/applications/{application_id}/auth/providers/google/start:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: startGoogleAuth
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalAuthStartRequest'
      responses:
        '201':
          description: Google authorization URL with state, nonce, and S256 PKCE
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalAuthStart'
  /v1/auth/providers/google/callback:
    get:
      operationId: googleAuthCallback
      tags:
        - Identity
      security: []
      responses:
        '302':
          description: Installation-wide callback that resolves the application from protected OAuth state and redirects with a one-time Platform93 exchange credential
  /v1/applications/{application_id}/auth/providers/google/exchange:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: exchangeGoogleAuth
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalAuthExchange'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
  /v1/applications/{application_id}/auth/providers/apple/start:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: startAppleAuth
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalAuthStartRequest'
      responses:
        '201':
          description: Apple authorization URL with state and nonce
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalAuthStart'
  /v1/auth/providers/apple/callback:
    post:
      operationId: appleAuthCallback
      tags:
        - Identity
      security: []
      requestBody:
        required: false
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                code:
                  type: string
                state:
                  type: string
                user:
                  type: string
                error:
                  type: string
      responses:
        '302':
          description: Installation-wide callback that resolves the application from protected OAuth state and redirects with a one-time Platform93 exchange credential
  /v1/applications/{application_id}/auth/providers/apple/exchange:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: exchangeAppleAuth
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalAuthExchange'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
  /v1/applications/{application_id}/auth/providers/{provider}/start:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: provider
        in: path
        required: true
        schema:
          enum: [microsoft, facebook, linkedin]
    post:
      operationId: startSocialAuth
      tags: [Identity]
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalAuthStartRequest'
      responses:
        '201':
          description: External provider authorization started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalAuthStart'
  /v1/applications/{application_id}/auth/providers/{provider}/exchange:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: provider
        in: path
        required: true
        schema:
          enum: [microsoft, facebook, linkedin]
    post:
      operationId: exchangeSocialAuth
      tags: [Identity]
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalAuthExchange'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
  /v1/auth/providers/{provider}/callback:
    parameters:
      - name: provider
        in: path
        required: true
        schema:
          enum: [microsoft, facebook, linkedin]
    get:
      operationId: socialAuthCallback
      tags: [Identity]
      security: []
      responses:
        '302':
          description: Installation-wide provider callback
  /v1/applications/{application_id}/auth/external-email/start:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: startExternalEmailEnrollment
      tags: [Identity]
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalEmailEnrollmentStart'
      responses:
        '202':
          description: External identity email verification queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalEmailEnrollmentChallenge'
  /v1/applications/{application_id}/auth/external-email/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: verifyExternalEmailEnrollment
      tags: [Identity]
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalEmailEnrollmentVerify'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
  /v1/applications/{application_id}/auth/mfa/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: verifyMFA
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyMFA'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
        '401':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/auth/mfa/webauthn/options:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: beginWebAuthnAuthentication
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BeginWebAuthnAuthentication'
      responses:
        '201':
          description: WebAuthn assertion options and opaque ceremony identifier
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebAuthnChallenge'
  /v1/applications/{application_id}/auth/mfa/webauthn/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: finishWebAuthnAuthentication
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FinishWebAuthnCeremony'
      responses:
        '200':
          $ref: '#/components/responses/Tokens'
        '401':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/auth/invitations/exchange:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: exchangeApplicationInvitation
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExchangeInvitation'
      responses:
        '200':
          description: Invitation accepted and a short-lived PKCE-bound authorization code returned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvitationExchangeResult'
        '401':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/auth/invitations/providers/{provider}/start:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: provider
        in: path
        required: true
        schema:
          enum: [google, apple, microsoft, facebook, linkedin]
    post:
      operationId: startApplicationInvitationProvider
      tags: [Identity]
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExchangeInvitation'
      responses:
        '201':
          description: Provider-backed application invitation acceptance started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalAuthStart'
        '401':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/auth/invitations/token:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: redeemApplicationInvitation
      tags:
        - Identity
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RedeemInvitation'
      responses:
        '200':
          description: Authentication completed or MFA challenge returned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '401':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/me:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: getCurrentUser
      tags:
        - Identity
      responses:
        '200':
          description: Current user
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
    patch:
      operationId: updateCurrentUser
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateUserProfile'
      responses:
        '204':
          description: Profile updated
    delete:
      operationId: deleteMyAccount
      tags:
        - Identity
      responses:
        '204':
          description: Account deleted and credentials revoked
        '403':
          description: Apple reauthentication is required before account deletion; no account data is changed.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Problem'
  /v1/applications/{application_id}/auth/logout:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: logoutCurrentSession
      tags:
        - Identity
      responses:
        '204':
          description: Current interactive session revoked
  /v1/applications/{application_id}/me/api-keys:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listPersonalAPIKeys
      tags:
        - Identity
      responses:
        '200':
          description: Successful listPersonalAPIKeys response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PersonalAPIKeyPage'
        '403':
          $ref: '#/components/responses/Problem'
    post:
      operationId: createPersonalAPIKey
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePersonalAPIKey'
      responses:
        '201':
          description: Key created and secret returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PersonalAPIKeyCreated'
  /v1/applications/{application_id}/catalog/products:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: publicCatalog
      tags:
        - Catalog
      security: []
      responses:
        '200':
          description: Successful publicCatalog response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProductPage'
  /v1/control/applications/{application_id}/products:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listProducts
      parameters:
        - $ref: '#/components/parameters/ReferenceQuery'
        - $ref: '#/components/parameters/ReferenceLimit'
        - $ref: '#/components/parameters/ReferenceCursor'
      tags:
        - Catalog
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listProducts response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProductPage'
    post:
      operationId: createProduct
      tags:
        - Catalog
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateProduct'
      responses:
        '201':
          description: Product created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Product'
  /v1/control/applications/{application_id}/products/{product_id}/prices:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: product_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: listPrices
      tags:
        - Catalog
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listPrices response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PricePage'
    post:
      operationId: createPrice
      tags:
        - Catalog
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePrice'
      responses:
        '201':
          description: Immutable price created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Price'
  /v1/control/applications/{application_id}/products/{product_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: product_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getProduct
      tags:
        - Catalog
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Product details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Product'
    patch:
      operationId: updateProduct
      tags:
        - Catalog
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateProduct'
      responses:
        '204':
          description: Product updated
  /v1/control/applications/{application_id}/entitlements:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listEntitlements
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listEntitlements response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntitlementGrantPage'
    post:
      operationId: createEntitlement
      parameters:
        - $ref: '#/components/parameters/RequiredIdempotencyKey'
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateEntitlement'
      responses:
        '201':
          description: Entitlement grant created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntitlementGrant'
  /v1/control/applications/{application_id}/entitlements/{entitlement_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: entitlement_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getEntitlement
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Entitlement grant, effective state, and append-only actions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EntitlementGrant'
  /v1/control/applications/{application_id}/entitlements/{entitlement_id}/revoke:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: entitlement_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: revokeEntitlement
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '204':
          description: Append-only revocation recorded
  /v1/control/applications/{application_id}/entitlements/{entitlement_id}/adjust:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: entitlement_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: adjustEntitlement
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AdjustEntitlement'
      responses:
        '204':
          description: Append-only expiry adjustment recorded
  /v1/control/applications/{application_id}/entitlements/{entitlement_id}/restore:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: entitlement_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: restoreEntitlement
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '204':
          description: Append-only restoration recorded
  /v1/control/applications/{application_id}/local-entitlement-requests:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listLocalEntitlementRequests
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listLocalEntitlementRequests response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LocalEntitlementRequestPage'
  /v1/control/applications/{application_id}/local-entitlement-requests/{request_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/RequestID'
    get:
      operationId: getLocalEntitlementRequest
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Local request with immutable snapshots and action history
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LocalEntitlementRequest'
  /v1/control/applications/{application_id}/local-entitlement-requests/{request_id}/approve:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/RequestID'
    post:
      operationId: approveLocalEntitlementRequest
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '200':
          description: Request approved exactly once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LocalEntitlementApproval'
  /v1/control/applications/{application_id}/local-entitlement-requests/{request_id}/reject:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/RequestID'
    post:
      operationId: rejectLocalEntitlementRequest
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '204':
          description: Request rejected
  /v1/control/applications/{application_id}/local-entitlement-requests/{request_id}/reopen:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/RequestID'
    post:
      operationId: reopenLocalEntitlementRequest
      tags:
        - Entitlements
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditReason'
      responses:
        '204':
          description: Rejected or canceled request reopened for review
  /v1/applications/{application_id}/local-entitlement-checkouts:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: localEntitlementCheckout
      tags:
        - Entitlements
      parameters:
        - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LocalCheckout'
      responses:
        '201':
          description: Pending local entitlement request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LocalEntitlementRequest'
  /v1/applications/{application_id}/me/local-entitlement-requests:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyLocalEntitlementRequests
      tags:
        - Entitlements
      responses:
        '200':
          description: Successful listMyLocalEntitlementRequests response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LocalEntitlementRequestPage'
  /v1/applications/{application_id}/me/local-entitlement-requests/{request_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/RequestID'
    get:
      operationId: getMyLocalEntitlementRequest
      tags:
        - Entitlements
      responses:
        '200':
          description: Own local request with immutable snapshots and action history
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LocalEntitlementRequest'
  /v1/applications/{application_id}/me/local-entitlement-requests/{request_id}/cancel:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/RequestID'
    post:
      operationId: cancelMyLocalEntitlementRequest
      tags:
        - Entitlements
      responses:
        '204':
          description: Pending request canceled
  /v1/applications/{application_id}/me/entitlements:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/WorkspaceIDQuery'
    get:
      operationId: listMyEntitlements
      tags:
        - Entitlements
      responses:
        '200':
          description: Effective user entitlements, optionally merged with one accessible workspace and full provenance
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EffectiveEntitlements'
  /v1/control/applications/{application_id}/billing/providers:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listBillingProviders
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listBillingProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProviderPage'
    post:
      operationId: createBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateBillingProvider'
      responses:
        '201':
          description: Billing provider configured
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProvider'
  /v1/control/applications/{application_id}/billing/providers/{provider_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ProviderID'
    get:
      operationId: getBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Secret-free provider connection
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProvider'
    patch:
      operationId: updateBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateBillingProvider'
      responses:
        '204':
          description: Provider credentials or metadata updated
    delete:
      operationId: disableBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Provider disabled
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/billing/providers/{provider_id}/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ProviderID'
    post:
      operationId: verifyBillingProvider
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Provider credentials verified
  /v1/applications/{application_id}/billing/checkout-sessions:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: createCheckoutSession
      tags:
        - Billing
      parameters:
        - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCheckout'
      responses:
        '201':
          description: Provider checkout created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CheckoutSession'
  /v1/applications/{application_id}/billing/checkout-sessions/{session_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/SessionID'
    get:
      operationId: getCheckoutSession
      tags:
        - Billing
      responses:
        '200':
          description: Checkout status and redirect URI
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CheckoutSession'
  /v1/applications/{application_id}/billing/portal-sessions:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: createBillingPortalSession
      tags:
        - Billing
      parameters:
        - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePortalSession'
      responses:
        '201':
          description: Customer portal session created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PortalSession'
  /v1/control/applications/{application_id}/billing/subscriptions:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listSubscriptions
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listSubscriptions response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubscriptionPage'
  /v1/control/applications/{application_id}/billing/subscriptions/{subscription_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/SubscriptionID'
    get:
      operationId: getSubscription
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Subscription details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Subscription'
  /v1/control/applications/{application_id}/billing/subscriptions/{subscription_id}/cancel:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/SubscriptionID'
      - $ref: '#/components/parameters/IdempotencyKey'
    post:
      operationId: cancelSubscription
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CancelSubscription'
      responses:
        '204':
          description: Subscription cancellation scheduled or applied
  /v1/control/applications/{application_id}/billing/subscriptions/{subscription_id}/resume:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/SubscriptionID'
      - $ref: '#/components/parameters/IdempotencyKey'
    post:
      operationId: resumeSubscription
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Scheduled cancellation removed
  /v1/control/applications/{application_id}/billing/subscriptions/{subscription_id}/change-price:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/SubscriptionID'
      - $ref: '#/components/parameters/IdempotencyKey'
    post:
      operationId: changeSubscriptionPrice
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChangeSubscriptionPrice'
      responses:
        '200':
          description: Subscription price changed and synchronized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Subscription'
  /v1/control/applications/{application_id}/billing/invoices:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listInvoices
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listInvoices response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvoicePage'
  /v1/control/applications/{application_id}/billing/invoices/{invoice_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: invoice_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getInvoice
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Normalized invoice details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Invoice'
  /v1/control/applications/{application_id}/billing/payments:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listPayments
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listPayments response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaymentPage'
  /v1/control/applications/{application_id}/billing/payments/{payment_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/PaymentID'
    get:
      operationId: getPayment
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Normalized payment details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Payment'
  /v1/control/applications/{application_id}/billing/payments/{payment_id}/refunds:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/PaymentID'
      - $ref: '#/components/parameters/IdempotencyKey'
    post:
      operationId: createRefund
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRefund'
      responses:
        '201':
          description: Full or partial refund created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Refund'
  /v1/control/applications/{application_id}/billing/refunds:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listRefunds
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listRefunds response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RefundPage'
  /v1/control/applications/{application_id}/billing/refunds/{refund_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: refund_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getRefund
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Normalized refund details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Refund'
  /v1/control/applications/{application_id}/billing/disputes:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listDisputes
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listDisputes response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DisputePage'
  /v1/control/applications/{application_id}/billing/disputes/{dispute_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: dispute_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getDispute
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Normalized dispute details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Dispute'
  /v1/control/applications/{application_id}/billing/statistics:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: from
        in: query
        schema:
          type: string
          format: date-time
      - name: to
        in: query
        schema:
          type: string
          format: date-time
    get:
      operationId: getBillingStatistics
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Bounded revenue, refund, and lifecycle statistics
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingStatistics'
  /v1/control/applications/{application_id}/billing/provider-events:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listBillingProviderEvents
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listBillingProviderEvents response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProviderEventPage'
  /v1/control/applications/{application_id}/billing/provider-events/{event_id}/replay:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: event_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: replayBillingProviderEvent
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Stored provider event replayed
  /v1/control/applications/{application_id}/billing/providers/{provider_id}/reconciliation-runs:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ProviderID'
      - $ref: '#/components/parameters/IdempotencyKey'
    post:
      operationId: createBillingReconciliationRun
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '202':
          description: Reconciliation queued transactionally
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReconciliationAccepted'
  /v1/control/applications/{application_id}/billing/reconciliation-runs:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listBillingReconciliationRuns
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listBillingReconciliationRuns response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReconciliationRunPage'
  /v1/control/applications/{application_id}/billing/reconciliation-runs/{run_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: run_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getBillingReconciliationRun
      tags:
        - Billing
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Reconciliation findings, repairs, and status
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReconciliationRun'
  /v1/applications/{application_id}/me/billing:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: getMyBillingSummary
      tags:
        - Billing
      responses:
        '200':
          description: Current billing resource counts
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingSummary'
  /v1/applications/{application_id}/me/subscriptions:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMySubscriptions
      tags:
        - Billing
      responses:
        '200':
          description: Successful listMySubscriptions response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubscriptionPage'
  /v1/applications/{application_id}/me/invoices:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyInvoices
      tags:
        - Billing
      responses:
        '200':
          description: Successful listMyInvoices response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvoicePage'
  /v1/applications/{application_id}/me/payments:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyPayments
      tags:
        - Billing
      responses:
        '200':
          description: Successful listMyPayments response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaymentPage'
  /v1/applications/{application_id}/me/sessions:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMySessions
      tags:
        - Identity
      responses:
        '200':
          description: Successful listMySessions response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SessionPage'
  /v1/applications/{application_id}/me/email-verification/start:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: emailVerificationStart
      tags:
        - Identity
      responses:
        '202':
          description: Verification challenge accepted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeAccepted'
  /v1/applications/{application_id}/me/email-verification/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: emailVerificationVerify
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccountChallenge'
      responses:
        '204':
          description: Email verified
  /v1/applications/{application_id}/me/email-change/start:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: emailChangeStart
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailAddress'
      responses:
        '202':
          description: Email change challenge accepted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChallengeAccepted'
  /v1/applications/{application_id}/me/email-change/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: emailChangeVerify
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccountChallenge'
      responses:
        '204':
          description: Email changed and other sessions revoked
  /v1/applications/{application_id}/me/password/change:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: passwordChange
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordChange'
      responses:
        '204':
          description: Password changed and other sessions revoked
  /v1/applications/{application_id}/me/export:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: exportMyAccount
      tags:
        - Identity
      responses:
        '200':
          description: Portable account export
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountExport'
  /v1/applications/{application_id}/me/anonymize:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: anonymizeMyAccount
      tags:
        - Identity
      responses:
        '204':
          description: Personal account data anonymized and credentials revoked
        '403':
          description: Apple reauthentication is required before account anonymization; no account data is changed.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Problem'
  /v1/applications/{application_id}/me/mfa/methods:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyMFAMethods
      tags:
        - Identity
      responses:
        '200':
          description: Successful listMyMFAMethods response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MFAMethodPage'
  /v1/applications/{application_id}/me/mfa/totp:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: startTOTPEnrollment
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StartTOTP'
      responses:
        '201':
          description: One-time TOTP secret and provisioning URI
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MFAEnrollment'
  /v1/applications/{application_id}/me/mfa/totp/{method_id}/activate:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: method_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: activateTOTPEnrollment
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActivateTOTP'
      responses:
        '200':
          description: TOTP activated and recovery codes returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MFAActivation'
  /v1/applications/{application_id}/me/mfa/webauthn/options:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: beginWebAuthnRegistration
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BeginWebAuthnRegistration'
      responses:
        '201':
          description: WebAuthn credential creation options and opaque ceremony identifier
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebAuthnChallenge'
  /v1/applications/{application_id}/me/mfa/webauthn/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: finishWebAuthnRegistration
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FinishWebAuthnCeremony'
      responses:
        '200':
          description: WebAuthn credential activated and recovery codes returned once when created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MFAActivation'
  /v1/applications/{application_id}/me/mfa/methods/{method_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: method_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: disableMFAMethod
      tags:
        - Identity
      responses:
        '204':
          description: MFA method disabled
  /v1/applications/{application_id}/me/mfa/recovery-codes/regenerate:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: regenerateRecoveryCodes
      tags:
        - Identity
      responses:
        '200':
          description: Replacement recovery codes returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RecoveryCodes'
  /v1/applications/{application_id}/me/auth/providers/google/link:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: startGoogleLink
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalAuthStartRequest'
      responses:
        '201':
          description: Authenticated Google account-link authorization URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalAuthStart'
  /v1/applications/{application_id}/me/auth/providers/apple/link:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: startAppleLink
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalAuthStartRequest'
      responses:
        '201':
          description: Authenticated Apple account-link authorization URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalAuthStart'
  /v1/applications/{application_id}/me/auth/providers/{provider}/link:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: provider
        in: path
        required: true
        schema:
          enum: [microsoft, facebook, linkedin]
    post:
      operationId: startSocialLink
      tags: [Identity]
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalAuthStartRequest'
      responses:
        '201':
          description: Authenticated external account-link authorization URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalAuthStart'
  /v1/applications/{application_id}/me/auth/identities:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyIdentities
      tags:
        - Identity
      responses:
        '200':
          description: Successful listMyIdentities response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalIdentityPage'
  /v1/applications/{application_id}/me/auth/identities/{identity_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: identity_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: unlinkMyIdentity
      tags:
        - Identity
      responses:
        '204':
          description: Linked identity removed while preserving a usable login method
        '403':
          description: Apple reauthentication is required before unlinking; the identity remains unchanged.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/Problem'
  /v1/applications/{application_id}/me/sessions/{session_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: session_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: revokeMySession
      tags:
        - Identity
      responses:
        '204':
          description: Session revoked
  /v1/applications/{application_id}/me/logout-all:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: logoutAll
      tags:
        - Identity
      responses:
        '204':
          description: All user sessions revoked
  /v1/applications/{application_id}/me/api-keys/{key_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: key_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: revokePersonalAPIKey
      tags:
        - Identity
      responses:
        '204':
          description: Personal API key revoked
  /v1/applications/{application_id}/me/addresses:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyAddresses
      tags:
        - Identity
      responses:
        '200':
          description: Successful listMyAddresses response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddressPage'
    post:
      operationId: createMyAddress
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAddress'
      responses:
        '201':
          description: Address created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Address'
  /v1/applications/{application_id}/me/addresses/{address_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: address_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    patch:
      operationId: updateMyAddress
      tags:
        - Identity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateAddress'
      responses:
        '204':
          description: Address updated with optimistic concurrency
    delete:
      operationId: deleteMyAddress
      tags:
        - Identity
      responses:
        '204':
          description: Inactive address deleted
  /v1/applications/{application_id}/me/addresses/{address_id}/activate:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: address_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: activateMyAddress
      tags:
        - Identity
      responses:
        '204':
          description: Address atomically selected as active
  /v1/applications/{application_id}/me/billing-profile:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: getMyBillingProfile
      tags:
        - Billing
      responses:
        '200':
          description: Current user billing profile
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProfile'
    patch:
      operationId: updateMyBillingProfile
      tags:
        - Billing
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateBillingProfile'
      responses:
        '204':
          description: Current user billing profile updated
  /v1/applications/{application_id}/me/workspaces:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyWorkspaces
      tags:
        - Control
      responses:
        '200':
          description: Successful listMyWorkspaces response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspacePage'
    post:
      operationId: createMyWorkspace
      tags:
        - Control
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWorkspace'
      responses:
        '201':
          description: Workspace created with the current user as owner
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace'
  /v1/applications/{application_id}/workspaces/{workspace_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getMyWorkspace
      tags:
        - Control
      responses:
        '200':
          description: Accessible workspace details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace'
    patch:
      operationId: updateMyWorkspace
      tags:
        - Control
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWorkspace'
      responses:
        '204':
          description: Workspace updated
    delete:
      operationId: archiveMyWorkspace
      tags:
        - Control
      responses:
        '204':
          description: Owned workspace archived
  /v1/applications/{application_id}/workspaces/{workspace_id}/members:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: listMyWorkspaceMembers
      tags:
        - Control
      responses:
        '200':
          description: Successful listMyWorkspaceMembers response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspaceMemberPage'
  /v1/applications/{application_id}/workspaces/{workspace_id}/members/{user_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - name: user_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    put:
      operationId: replaceMyWorkspaceMemberRoles
      tags:
        - Control
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReplaceWorkspaceMemberRoles'
      responses:
        '200':
          description: Workspace member roles replaced
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspaceMember'
    delete:
      operationId: removeMyWorkspaceMember
      tags:
        - Control
      responses:
        '204':
          description: Workspace member removed
  /v1/applications/{application_id}/workspaces/{workspace_id}/owner-transfer:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: transferMyWorkspaceOwnership
      tags:
        - Control
      requestBody:
        $ref: '#/components/requestBodies/OwnershipTransfer'
      responses:
        '200':
          $ref: '#/components/responses/OwnershipTransferResult'
  /v1/applications/{application_id}/workspaces/{workspace_id}/membership:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: leaveWorkspace
      tags:
        - Control
      responses:
        '204':
          description: Current membership removed
  /v1/applications/{application_id}/workspaces/{workspace_id}/invitations:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: listMyWorkspaceInvitations
      tags:
        - Control
      responses:
        '200':
          description: Successful listMyWorkspaceInvitations response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationInvitationPage'
    post:
      operationId: createMyWorkspaceInvitation
      tags:
        - Control
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateInvitation'
      responses:
        '201':
          description: Workspace invitation created and email queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationInvitation'
  /v1/applications/{application_id}/workspaces/{workspace_id}/invitations/{invitation_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - name: invitation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: revokeMyWorkspaceInvitation
      tags:
        - Control
      responses:
        '204':
          description: Pending workspace invitation revoked
  /v1/applications/{application_id}/workspaces/{workspace_id}/invitations/{invitation_id}/resend:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - name: invitation_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: resendMyWorkspaceInvitation
      tags:
        - Control
      responses:
        '202':
          description: Workspace invitation credentials rotated and email queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvitationResent'
        '429':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/workspaces/{workspace_id}/access:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: listMyWorkspaceAccess
      tags:
        - Control
      responses:
        '200':
          description: Successful listMyWorkspaceAccess response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspaceAccessPage'
  /v1/applications/{application_id}/workspaces/{workspace_id}/permission-grants:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/WorkspaceID'
      - $ref: '#/components/parameters/OptionalPermissionSubjectType'
      - $ref: '#/components/parameters/OptionalPermissionSubjectID'
      - $ref: '#/components/parameters/PermissionGrantStatus'
    get:
      operationId: listWorkspacePermissionGrants
      tags:
        - Control
      responses:
        '200':
          description: Successful listWorkspacePermissionGrants response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGrantPage'
        '403':
          $ref: '#/components/responses/Problem'
    post:
      operationId: createWorkspacePermissionGrant
      tags:
        - Control
      parameters:
        - $ref: '#/components/parameters/RequiredIdempotencyKey'
      requestBody:
        $ref: '#/components/requestBodies/PermissionGrantBody'
      responses:
        '201':
          description: Workspace direct permission grant created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGrant'
        '403':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/workspaces/{workspace_id}/permission-grants/{grant_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/WorkspaceID'
      - name: grant_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getWorkspacePermissionGrant
      tags:
        - Control
      responses:
        '200':
          description: Workspace direct permission grant
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGrant'
    delete:
      operationId: revokeWorkspacePermissionGrant
      tags:
        - Control
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      responses:
        '204':
          description: Workspace direct permission grant revoked
        '409':
          $ref: '#/components/responses/Problem'
  /v1/applications/{application_id}/workspaces/{workspace_id}/billing-profile:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getWorkspaceBillingProfile
      tags:
        - Billing
      responses:
        '200':
          description: Workspace billing profile
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingProfile'
    patch:
      operationId: updateWorkspaceBillingProfile
      tags:
        - Billing
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateBillingProfile'
      responses:
        '204':
          description: Workspace billing profile updated
  /v1/applications/{application_id}/workspaces/{workspace_id}/addresses:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: listWorkspaceAddresses
      tags:
        - Billing
      responses:
        '200':
          description: Successful listWorkspaceAddresses response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AddressPage'
    post:
      operationId: createWorkspaceAddress
      tags:
        - Billing
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAddress'
      responses:
        '201':
          description: Workspace billing address created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Address'
  /v1/applications/{application_id}/workspaces/{workspace_id}/addresses/{address_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - name: address_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    patch:
      operationId: updateWorkspaceAddress
      tags:
        - Billing
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateAddress'
      responses:
        '204':
          description: Workspace billing address updated
    delete:
      operationId: deleteWorkspaceAddress
      tags:
        - Billing
      responses:
        '204':
          description: Inactive workspace billing address deleted
  /v1/applications/{application_id}/workspaces/{workspace_id}/addresses/{address_id}/activate:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: workspace_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - name: address_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: activateWorkspaceAddress
      tags:
        - Billing
      responses:
        '204':
          description: Workspace billing address selected as active
  /v1/applications/{application_id}/me/workspace-invitations:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyPendingInvitations
      tags:
        - Control
      responses:
        '200':
          description: Successful listMyPendingInvitations response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationInvitationPage'
  /v1/applications/{application_id}/me/permissions/check:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: checkMyPermissions
      tags:
        - Control
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermissionCheck'
      responses:
        '200':
          description: Permission decisions with role explanations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionCheckResult'
  /v1/applications/{application_id}/me/oauth-consents:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyOAuthConsents
      tags:
        - Identity
      responses:
        '200':
          description: Successful listMyOAuthConsents response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthConsentPage'
  /v1/applications/{application_id}/me/oauth-consents/{client_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: client_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    delete:
      operationId: revokeMyOAuthConsent
      tags:
        - Identity
      responses:
        '204':
          description: Own consent and active grants revoked
  /v1/applications/{application_id}/events:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: publishCustomEvent
      tags:
        - Events
      parameters:
        - $ref: '#/components/parameters/RequiredIdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PublishCustomEvent'
      responses:
        '202':
          description: Custom event and transactional outbox record accepted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventEnvelope'
        '403':
          $ref: '#/components/responses/Problem'
        '422':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/events:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listEvents
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listEvents response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventPage'
  /v1/control/applications/{application_id}/events/{event_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: event_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getEvent
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: CloudEvents-compatible event detail
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventEnvelope'
  /v1/control/applications/{application_id}/event-types:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listEventTypes
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listEventTypes response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventTypePage'
    post:
      operationId: createEventType
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateEventType'
      responses:
        '201':
          description: Application event type registered
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventTypeDefinition'
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/event-types/{event_type_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: event_type_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getEventType
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Versioned event contract with a complete webhook example
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventTypeDefinition'
    patch:
      operationId: updateEventType
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateEventType'
      responses:
        '204':
          description: Event type definition updated
        '409':
          $ref: '#/components/responses/Problem'
    delete:
      operationId: archiveEventType
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Application event type archived
  /v1/control/applications/{application_id}/audit-logs:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listAuditLogs
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listAuditLogs response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditRecordPage'
  /v1/control/applications/{application_id}/audit-logs/{audit_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: audit_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getAuditLog
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Audit record detail
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditRecord'
  /v1/control/applications/{application_id}/audit-exports:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: createAuditExport
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditExport'
      responses:
        '201':
          description: Encrypted one-hour audit export created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditExportRecord'
  /v1/control/applications/{application_id}/audit-exports/{export_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: export_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getAuditExport
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Decrypted audit export before expiry
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditExportRecord'
  /v1/control/applications/{application_id}/webhooks:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listWebhooks
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listWebhooks response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookPage'
    post:
      operationId: createWebhook
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhook'
      responses:
        '201':
          description: Webhook created and secret returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Webhook'
  /v1/control/applications/{application_id}/webhooks/{webhook_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: webhook_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getWebhook
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Webhook endpoint and delivery statistics
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Webhook'
        '404':
          $ref: '#/components/responses/Problem'
    patch:
      operationId: updateWebhook
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWebhook'
      responses:
        '204':
          description: Webhook endpoint updated
        '409':
          $ref: '#/components/responses/Problem'
    delete:
      operationId: disableWebhook
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Webhook disabled
  /v1/control/applications/{application_id}/webhooks/{webhook_id}/test:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: webhook_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - $ref: '#/components/parameters/IdempotencyKey'
    post:
      operationId: testWebhook
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '202':
          description: Targeted signed test delivery queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookTestAccepted'
        '404':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/webhooks/{webhook_id}/rotate-secret:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: webhook_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: rotateWebhookSecret
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Webhook secret rotated and returned once
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretCredential'
  /v1/control/applications/{application_id}/webhook-deliveries:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listWebhookDeliveries
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listWebhookDeliveries response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookDeliveryPage'
  /v1/control/applications/{application_id}/webhook-deliveries/{delivery_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: delivery_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getWebhookDelivery
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Webhook delivery history detail
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookDelivery'
        '404':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/webhook-deliveries/{delivery_id}/replay:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: delivery_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: replayWebhookDelivery
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Delivery queued for replay
  /v1/control/applications/{application_id}/notification-providers:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listNotificationProviders
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listNotificationProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProviderPage'
    post:
      operationId: createNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/SMTPProvider'
      responses:
        '201':
          description: SMTP provider stored
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProvider'
  /v1/control/applications/{application_id}/notification-providers/{provider_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: provider_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Redacted provider configuration and health
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProvider'
    patch:
      operationId: updateNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateSMTPProvider'
      responses:
        '200':
          description: Redacted updated provider configuration
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationProvider'
    delete:
      operationId: disableNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Notification provider disabled
  /v1/control/applications/{application_id}/notification-providers/{provider_id}/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: provider_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: verifyNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: SMTP connectivity and authentication verified
        '502':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/notification-providers/{provider_id}/test:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: provider_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
      - $ref: '#/components/parameters/IdempotencyKey'
    post:
      operationId: testNotificationProvider
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TestNotificationProvider'
      responses:
        '202':
          description: Provider-specific test notification queued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationQueued'
  /v1/control/applications/{application_id}/sender-identities:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listSenderIdentities
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listSenderIdentities response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SenderIdentityPage'
    post:
      operationId: createSenderIdentity
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSenderIdentity'
      responses:
        '201':
          description: Sender identity created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SenderIdentity'
  /v1/control/applications/{application_id}/sender-identities/{sender_id}/default:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: sender_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: setDefaultSenderIdentity
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Default sender selected
  /v1/control/installation/notification-templates:
    get:
      operationId: listInstallationNotificationTemplates
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listInstallationNotificationTemplates response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationTemplatePage'
    post:
      operationId: createInstallationNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateNotificationTemplate'
      responses:
        '201':
          description: Installation template draft created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationTemplate'
  /v1/control/installation/notification-template-variables:
    get:
      operationId: listInstallationNotificationTemplateVariables
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Installation template variables and samples
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TemplateVariables'
  /v1/control/installation/notification-templates/{template_id}:
    parameters:
      - name: template_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getInstallationNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Installation template and immutable history
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationTemplate'
    patch:
      operationId: updateInstallationNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateNotificationTemplate'
      responses:
        '201':
          description: New installation template draft version created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationTemplate'
  /v1/control/installation/notification-templates/{template_id}/preview:
    parameters:
      - name: template_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: previewInstallationNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PreviewNotificationTemplate'
      responses:
        '200':
          description: Safely rendered installation template preview
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationTemplatePreview'
  /v1/control/installation/notification-templates/{template_id}/publish:
    parameters:
      - name: template_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: publishInstallationNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Installation template published
  /v1/control/installation/notification-templates/{template_id}/archive:
    parameters:
      - name: template_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: archiveInstallationNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Installation template archived
  /v1/control/applications/{application_id}/notification-templates:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listNotificationTemplates
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listNotificationTemplates response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationTemplatePage'
    post:
      operationId: createNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateNotificationTemplate'
      responses:
        '201':
          description: Immutable draft template version created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationTemplate'
  /v1/control/applications/{application_id}/notification-template-variables:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listNotificationTemplateVariables
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Built-in notification template variables and sample values
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TemplateVariables'
  /v1/control/applications/{application_id}/notification-templates/{template_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: template_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Template version and immutable version history
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationTemplate'
    patch:
      operationId: updateNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateNotificationTemplate'
      responses:
        '201':
          description: New immutable draft version created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationTemplate'
  /v1/control/applications/{application_id}/notification-templates/{template_id}/preview:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: template_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: previewNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PreviewNotificationTemplate'
      responses:
        '200':
          description: Safely rendered preview without delivery
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationTemplatePreview'
  /v1/control/applications/{application_id}/notification-templates/{template_id}/publish:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: template_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: publishNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Template version published and predecessor archived
  /v1/control/applications/{application_id}/notification-templates/{template_id}/archive:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: template_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: archiveNotificationTemplate
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Template version archived
  /v1/control/applications/{application_id}/notifications:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listNotifications
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listNotifications response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationPage'
  /v1/control/applications/{application_id}/notifications/statistics:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: getNotificationStatistics
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Notification and attempt status totals
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationStatistics'
  /v1/control/applications/{application_id}/notifications/{notification_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: notification_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    get:
      operationId: getNotification
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Notification metadata, attachment metadata, and attempts without encrypted payload
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Notification'
  /v1/control/applications/{application_id}/notifications/{notification_id}/retry:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: notification_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: retryNotification
      tags:
        - Events
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Notification queued for retry
  /v1/applications/{application_id}/me/notification-preferences:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyNotificationPreferences
      tags:
        - Events
      responses:
        '200':
          description: Successful listMyNotificationPreferences response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationPreferencePage'
  /v1/applications/{application_id}/me/notification-preferences/{category}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - name: category
        in: path
        required: true
        schema:
          enum:
            - transactional
            - billing
            - product
            - marketing
    put:
      operationId: updateMyNotificationPreference
      tags:
        - Events
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateNotificationPreference'
      responses:
        '204':
          description: Email preference updated; security remains mandatory
  /v1/control/installation/storage/providers:
    get:
      operationId: listInstallationStorageProviders
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listInstallationStorageProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProviderPage'
    post:
      operationId: createInstallationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/StorageProviderBody'
      responses:
        '201':
          description: Storage provider stored without exposing credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProvider'
  /v1/control/installation/storage/providers/{provider_id}:
    parameters:
      - $ref: '#/components/parameters/ProviderID'
    get:
      operationId: getInstallationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Secret-free storage provider
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProvider'
    patch:
      operationId: updateInstallationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateStorageProvider'
      responses:
        '200':
          description: Storage provider updated and marked unverified
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProvider'
    delete:
      operationId: disableInstallationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/ConfirmAffectedObjects'
      responses:
        '204':
          description: Provider disabled in Platform93
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/installation/storage/providers/{provider_id}/verify:
    parameters:
      - $ref: '#/components/parameters/ProviderID'
    post:
      operationId: verifyInstallationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Credentials and bucket visibility verified
        '502':
          $ref: '#/components/responses/Problem'
  /v1/control/installation/storage/providers/{provider_id}/enable:
    parameters:
      - $ref: '#/components/parameters/ProviderID'
    post:
      operationId: enableInstallationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Provider re-enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProviderStatus'
  /v1/control/organizations/{organization_id}/storage/providers:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: listOrganizationStorageProviders
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listOrganizationStorageProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProviderPage'
    post:
      operationId: createOrganizationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/StorageProviderBody'
      responses:
        '201':
          description: Organization storage override stored
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProvider'
  /v1/control/organizations/{organization_id}/storage/providers/{provider_id}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - $ref: '#/components/parameters/ProviderID'
    get:
      operationId: getOrganizationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Secret-free storage provider
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProvider'
    patch:
      operationId: updateOrganizationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateStorageProvider'
      responses:
        '200':
          description: Storage provider updated and marked unverified
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProvider'
    delete:
      operationId: disableOrganizationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/ConfirmAffectedObjects'
      responses:
        '204':
          description: Provider disabled in Platform93
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/organizations/{organization_id}/storage/providers/{provider_id}/verify:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - $ref: '#/components/parameters/ProviderID'
    post:
      operationId: verifyOrganizationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Credentials and bucket visibility verified
  /v1/control/organizations/{organization_id}/storage/providers/{provider_id}/enable:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - $ref: '#/components/parameters/ProviderID'
    post:
      operationId: enableOrganizationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Provider re-enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProviderStatus'
  /v1/control/applications/{application_id}/storage/providers:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listApplicationStorageProviders
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listApplicationStorageProviders response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProviderPage'
    post:
      operationId: createApplicationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        $ref: '#/components/requestBodies/StorageProviderBody'
      responses:
        '201':
          description: Application storage override stored
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProvider'
  /v1/control/applications/{application_id}/storage/providers/{provider_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ProviderID'
    get:
      operationId: getApplicationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Secret-free storage provider
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProvider'
    patch:
      operationId: updateApplicationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateStorageProvider'
      responses:
        '200':
          description: Storage provider updated and marked unverified
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProvider'
    delete:
      operationId: disableApplicationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/ConfirmAffectedObjects'
      responses:
        '204':
          description: Provider disabled in Platform93
        '409':
          $ref: '#/components/responses/Problem'
  /v1/control/applications/{application_id}/storage/providers/{provider_id}/verify:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ProviderID'
    post:
      operationId: verifyApplicationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '204':
          description: Credentials and bucket visibility verified
  /v1/control/applications/{application_id}/storage/providers/{provider_id}/enable:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ProviderID'
    post:
      operationId: enableApplicationStorageProvider
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Provider re-enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageProviderStatus'
  /v1/control/installation/storage/uploads:
    post:
      operationId: createInstallationStorageUpload
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/RequiredIdempotencyKey'
      requestBody:
        $ref: '#/components/requestBodies/StorageUpload'
      responses:
        '201':
          description: Presigned installation asset upload
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageUploadAuthorization'
  /v1/control/installation/storage/uploads/{object_id}/complete:
    parameters:
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: completeInstallationStorageUpload
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Upload verified
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
  /v1/control/installation/storage/objects:
    get:
      operationId: listInstallationStorageObjects
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listInstallationStorageObjects response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObjectPage'
  /v1/control/installation/storage/objects/{object_id}:
    parameters:
      - $ref: '#/components/parameters/ObjectID'
    get:
      operationId: getInstallationStorageObject
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Installation asset metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
    delete:
      operationId: deleteInstallationStorageObject
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/ForceDelete'
      responses:
        '204':
          description: Deletion queued
  /v1/control/installation/storage/objects/{object_id}/download:
    parameters:
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: downloadInstallationStorageObject
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Public or short-lived private URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageDownload'
  /v1/control/organizations/{organization_id}/storage/objects:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: listOrganizationStorageObjects
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listOrganizationStorageObjects response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObjectPage'
  /v1/control/organizations/{organization_id}/storage/objects/{object_id}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - $ref: '#/components/parameters/ObjectID'
    get:
      operationId: getOrganizationStorageObject
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Organization object metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
    delete:
      operationId: deleteOrganizationStorageObject
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/ForceDelete'
      responses:
        '204':
          description: Deletion queued
  /v1/control/organizations/{organization_id}/storage/objects/{object_id}/download:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: downloadOrganizationStorageObject
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Public or short-lived private URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageDownload'
  /v1/control/applications/{application_id}/storage/uploads:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: createControlApplicationStorageUpload
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/RequiredIdempotencyKey'
      requestBody:
        $ref: '#/components/requestBodies/StorageUpload'
      responses:
        '201':
          description: Presigned application asset upload
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageUploadAuthorization'
  /v1/control/applications/{application_id}/storage/uploads/{object_id}/complete:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: completeControlApplicationStorageUpload
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Upload verified
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
  /v1/control/applications/{application_id}/storage/objects:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listControlApplicationStorageObjects
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Successful listControlApplicationStorageObjects response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObjectPage'
  /v1/control/applications/{application_id}/storage/objects/{object_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ObjectID'
    get:
      operationId: getControlApplicationStorageObject
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Application object metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
    delete:
      operationId: deleteControlApplicationStorageObject
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      parameters:
        - $ref: '#/components/parameters/ForceDelete'
      responses:
        '204':
          description: Deletion queued
  /v1/control/applications/{application_id}/storage/objects/{object_id}/download:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: downloadControlApplicationStorageObject
      tags:
        - Storage
      security:
        - controlBearer: []
        - controlCookie: []
      responses:
        '200':
          description: Public or short-lived private URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageDownload'
  /v1/applications/{application_id}/storage/uploads:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: createApplicationStorageUpload
      tags:
        - Storage
      parameters:
        - $ref: '#/components/parameters/RequiredIdempotencyKey'
      requestBody:
        $ref: '#/components/requestBodies/StorageUpload'
      responses:
        '201':
          description: Presigned application-owned upload
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageUploadAuthorization'
  /v1/applications/{application_id}/storage/uploads/{object_id}/complete:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: completeApplicationStorageUpload
      tags:
        - Storage
      responses:
        '200':
          description: Upload verified
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
  /v1/applications/{application_id}/storage/objects:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listApplicationStorageObjects
      tags:
        - Storage
      responses:
        '200':
          description: Successful listApplicationStorageObjects response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObjectPage'
  /v1/applications/{application_id}/storage/objects/{object_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ObjectID'
    get:
      operationId: getApplicationStorageObject
      tags:
        - Storage
      responses:
        '200':
          description: Application object metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
    delete:
      operationId: deleteApplicationStorageObject
      tags:
        - Storage
      responses:
        '204':
          description: Deletion queued
  /v1/applications/{application_id}/storage/objects/{object_id}/download:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: downloadApplicationStorageObject
      tags:
        - Storage
      responses:
        '200':
          description: Public or short-lived private URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageDownload'
  /v1/applications/{application_id}/me/storage/uploads:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    post:
      operationId: createMyStorageUpload
      tags:
        - Storage
      parameters:
        - $ref: '#/components/parameters/RequiredIdempotencyKey'
      requestBody:
        $ref: '#/components/requestBodies/StorageUpload'
      responses:
        '201':
          description: Presigned user-owned upload
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageUploadAuthorization'
  /v1/applications/{application_id}/me/storage/uploads/{object_id}/complete:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: completeMyStorageUpload
      tags:
        - Storage
      responses:
        '200':
          description: Upload verified
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
  /v1/applications/{application_id}/me/storage/objects:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
    get:
      operationId: listMyStorageObjects
      tags:
        - Storage
      responses:
        '200':
          description: Successful listMyStorageObjects response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObjectPage'
  /v1/applications/{application_id}/me/storage/objects/{object_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ObjectID'
    get:
      operationId: getMyStorageObject
      tags:
        - Storage
      responses:
        '200':
          description: User object metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
    delete:
      operationId: deleteMyStorageObject
      tags:
        - Storage
      responses:
        '204':
          description: Deletion queued
  /v1/applications/{application_id}/me/storage/objects/{object_id}/download:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: downloadMyStorageObject
      tags:
        - Storage
      responses:
        '200':
          description: Public or short-lived private URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageDownload'
  /v1/applications/{application_id}/workspaces/{workspace_id}/storage/uploads:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/WorkspaceID'
    post:
      operationId: createWorkspaceStorageUpload
      tags:
        - Storage
      parameters:
        - $ref: '#/components/parameters/RequiredIdempotencyKey'
      requestBody:
        $ref: '#/components/requestBodies/StorageUpload'
      responses:
        '201':
          description: Presigned workspace-owned upload
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageUploadAuthorization'
  /v1/applications/{application_id}/workspaces/{workspace_id}/storage/uploads/{object_id}/complete:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/WorkspaceID'
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: completeWorkspaceStorageUpload
      tags:
        - Storage
      responses:
        '200':
          description: Upload verified
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
  /v1/applications/{application_id}/workspaces/{workspace_id}/storage/objects:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/WorkspaceID'
    get:
      operationId: listWorkspaceStorageObjects
      tags:
        - Storage
      responses:
        '200':
          description: Successful listWorkspaceStorageObjects response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObjectPage'
  /v1/applications/{application_id}/workspaces/{workspace_id}/storage/objects/{object_id}:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/WorkspaceID'
      - $ref: '#/components/parameters/ObjectID'
    get:
      operationId: getWorkspaceStorageObject
      tags:
        - Storage
      responses:
        '200':
          description: Workspace object metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageObject'
    delete:
      operationId: deleteWorkspaceStorageObject
      tags:
        - Storage
      responses:
        '204':
          description: Deletion queued
  /v1/applications/{application_id}/workspaces/{workspace_id}/storage/objects/{object_id}/download:
    parameters:
      - $ref: '#/components/parameters/ApplicationID'
      - $ref: '#/components/parameters/WorkspaceID'
      - $ref: '#/components/parameters/ObjectID'
    post:
      operationId: downloadWorkspaceStorageObject
      tags:
        - Storage
      responses:
        '200':
          description: Public or short-lived private URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StorageDownload'
  /oidc/.well-known/openid-configuration:
    get:
      operationId: oidcDiscovery
      tags:
        - Identity
      security: []
      responses:
        '200':
          description: OpenID Provider metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OIDCDiscovery'
  /oidc/jwks.json:
    get:
      operationId: oidcJWKS
      tags:
        - Identity
      security: []
      responses:
        '200':
          description: Active and retiring JSON Web Keys
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JWKS'
  /oidc/authorize:
    get:
      operationId: beginOIDCAuthorization
      description: Opted-in hosted clients receive a browser interaction redirect. Explicit application/json requests retain the headless contract.
      tags:
        - Identity
      security: []
      parameters:
        - $ref: '#/components/parameters/OAuthClientID'
        - $ref: '#/components/parameters/OAuthRedirectURI'
        - $ref: '#/components/parameters/OAuthResponseType'
        - $ref: '#/components/parameters/OAuthScope'
        - $ref: '#/components/parameters/OAuthState'
        - $ref: '#/components/parameters/OAuthCodeChallenge'
        - $ref: '#/components/parameters/OAuthCodeChallengeMethod'
        - {name: nonce, in: query, schema: {type: string, maxLength: 1024}}
        - {name: prompt, in: query, schema: {type: string, maxLength: 128}}
        - {name: max_age, in: query, schema: {type: integer, minimum: 0, maximum: 31536000}}
        - {name: ui_locales, in: query, schema: {type: string, maxLength: 256}}
      responses:
        '200':
          description: Headless consent interaction
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizationRedirect'
        '302':
          description: Authorization response redirect
        '303':
          description: Hosted sign-in interaction or validated authorization callback
          headers:
            Location:
              schema: {type: string, format: uri-reference}
    post:
      operationId: decideOIDCAuthorization
      tags:
        - Identity
      security:
        - bearerAuth: []
      requestBody:
        $ref: '#/components/requestBodies/OAuthAuthorizationDecision'
      responses:
        '200':
          description: Headless authorization response containing redirect_to when JSON is requested
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizationRedirect'
        '302':
          description: Authorization response redirect
  /oidc/token:
    post:
      operationId: exchangeOIDCToken
      tags:
        - Identity
      security: []
      requestBody:
        $ref: '#/components/requestBodies/OAuthToken'
      responses:
        '200':
          description: OAuth token response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: OAuth error response
  /oidc/revoke:
    post:
      operationId: revokeOIDCToken
      tags:
        - Identity
      security: []
      requestBody:
        $ref: '#/components/requestBodies/OAuthTokenCredential'
      responses:
        '200':
          description: Token revoked or already inactive
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmptyResponse'
  /oidc/introspect:
    post:
      operationId: introspectOIDCToken
      tags:
        - Identity
      security: []
      requestBody:
        $ref: '#/components/requestBodies/OAuthTokenCredential'
      responses:
        '200':
          description: RFC 7662 token state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenIntrospection'
  /oidc/userinfo:
    get:
      operationId: oidcUserinfo
      tags:
        - Identity
      security:
        - bearerAuth: []
      responses:
        '200':
          description: OpenID Connect claims
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfo'
        '401':
          $ref: '#/components/responses/Problem'
  /provider-webhooks/stripe/{connection_public_id}:
    post:
      operationId: stripeWebhook
      tags:
        - Billing
      security: []
      parameters:
        - name: connection_public_id
          in: path
          required: true
          schema:
            type: string
        - name: Stripe-Signature
          in: header
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema: {}
      responses:
        '200':
          description: Event stored and processed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookAcknowledgement'
        '400':
          $ref: '#/components/responses/Problem'
  /v1/management/organizations:
    get:
      operationId: managementListOrganizations
      tags:
        - Management
      security:
        - managementBearer: []
      parameters:
        - $ref: '#/components/parameters/IncludeRetired'
      responses:
        '200':
          description: Successful managementListOrganizations response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationPage'
    post:
      operationId: managementCreateOrganization
      tags:
        - Management
      security:
        - managementBearer: []
      requestBody:
        $ref: '#/components/requestBodies/Named'
      responses:
        '201':
          description: Organization provisioned without a Platform user membership
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Organization'
  /v1/management/organizations/{organization_id}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: managementGetOrganization
      tags:
        - Management
      security:
        - managementBearer: []
      responses:
        '200':
          description: Organization details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Organization'
    patch:
      operationId: managementUpdateOrganization
      tags:
        - Management
      security:
        - managementBearer: []
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      requestBody:
        $ref: '#/components/requestBodies/Rename'
      responses:
        '204':
          description: Organization renamed
    delete:
      operationId: managementRetireOrganization
      tags:
        - Management
      security:
        - managementBearer: []
      responses:
        '204':
          description: Organization retired
  /v1/management/organizations/{organization_id}/restore:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    post:
      operationId: managementRestoreOrganization
      tags:
        - Management
      security:
        - managementBearer: []
      responses:
        '204':
          description: Organization restored
  /v1/management/organizations/{organization_id}/policy:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: managementGetOrganizationPolicy
      tags:
        - Management
      security:
        - managementBearer: []
      responses:
        '200':
          description: Organization policy and usage
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationPolicy'
    put:
      operationId: managementUpdateOrganizationPolicy
      tags:
        - Management
      security:
        - managementBearer: []
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrganizationPolicy'
      responses:
        '204':
          description: Organization policy updated
  /v1/management/organizations/{organization_id}/applications:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
    get:
      operationId: managementListApplications
      tags:
        - Management
      security:
        - managementBearer: []
      parameters:
        - $ref: '#/components/parameters/IncludeRetired'
      responses:
        '200':
          description: Successful managementListApplications response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationPage'
    post:
      operationId: managementCreateApplication
      tags:
        - Management
      security:
        - managementBearer: []
      requestBody:
        $ref: '#/components/requestBodies/Named'
      responses:
        '201':
          description: Application provisioned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Application'
        '409':
          $ref: '#/components/responses/Problem'
  /v1/management/organizations/{organization_id}/applications/{application_resource_id}:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: application_resource_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    patch:
      operationId: managementUpdateApplication
      tags:
        - Management
      security:
        - managementBearer: []
      parameters:
        - $ref: '#/components/parameters/IfMatch'
      requestBody:
        $ref: '#/components/requestBodies/Rename'
      responses:
        '204':
          description: Application renamed
    delete:
      operationId: managementRetireApplication
      tags:
        - Management
      security:
        - managementBearer: []
      responses:
        '204':
          description: Application retired
  /v1/management/organizations/{organization_id}/applications/{application_resource_id}/restore:
    parameters:
      - $ref: '#/components/parameters/OrganizationID'
      - name: application_resource_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/UUID'
    post:
      operationId: managementRestoreApplication
      tags:
        - Management
      security:
        - managementBearer: []
      responses:
        '204':
          description: Application restored
components:
  securitySchemes:
    hostedCookie:
      type: apiKey
      in: cookie
      name: __Host-p93_hosted_browser
      description: Browser-bound hosted session; loopback HTTP uses p93_hosted_browser.
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT-or-PAT
    controlBearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
    controlCookie:
      type: apiKey
      in: cookie
      name: p93_control_access
    managementBearer:
      type: http
      scheme: bearer
      bearerFormat: Platform93-management-JWT
      description: Short-lived client-credentials token with actor_type=management_client and audience platform93:control.
  parameters:
    HostedInteractionID:
      name: interaction_id
      in: path
      required: true
      schema: {$ref: '#/components/schemas/UUID'}
    HostedCSRF:
      name: X-CSRF-Token
      in: header
      required: true
      schema: {type: string, minLength: 43, maxLength: 128}
    ReferenceQuery:
      name: query
      in: query
      description: Case-insensitive literal name/key search or exact resource UUID, within the authorized application. Supplying search parameters enables ID-ordered pagination.
      schema:
        type: string
        maxLength: 200
    ReferenceLimit:
      name: limit
      in: query
      schema:
        type: integer
        minimum: 1
        maximum: 100
        default: 20
    ReferenceCursor:
      name: cursor
      in: query
      description: Continue the same search using the returned next_cursor.
      schema:
        type: string
        format: uuid
    ApplicationID:
      name: application_id
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    WorkspaceID:
      name: workspace_id
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    ObjectID:
      name: object_id
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    ConfirmAffectedObjects:
      name: confirm_affected_objects
      in: query
      required: false
      schema:
        type: boolean
        default: false
      description: Required when disabling a provider pinned by live objects.
    ForceDelete:
      name: force
      in: query
      required: false
      schema:
        type: boolean
        default: false
      description: Break managed email-template references; requires X-Audit-Reason.
    WorkspaceIDQuery:
      name: workspace_id
      in: query
      required: false
      description: Explicit accessible workspace whose grants are merged with the current user's grants.
      schema:
        $ref: '#/components/schemas/UUID'
    PermissionSubjectType:
      name: subject_type
      in: query
      required: true
      schema:
        type: string
        enum:
          - user
          - client
    PermissionSubjectID:
      name: subject_id
      in: query
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    OrganizationID:
      name: organization_id
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    IncludeRetired:
      name: include_retired
      in: query
      schema:
        type: boolean
        default: false
    IfMatch:
      name: If-Match
      in: header
      required: true
      schema:
        type: string
      description: Current resource ETag.
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: false
      schema:
        type: string
        minLength: 8
        maxLength: 255
    RequiredIdempotencyKey:
      name: Idempotency-Key
      in: header
      required: true
      schema:
        type: string
        minLength: 8
        maxLength: 255
    ProviderID:
      name: provider_id
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    SessionID:
      name: session_id
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    SubscriptionID:
      name: subscription_id
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    PaymentID:
      name: payment_id
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    RequestID:
      name: request_id
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    OAuthClientID:
      name: client_id
      in: query
      required: true
      schema:
        type: string
    OAuthRedirectURI:
      name: redirect_uri
      in: query
      required: true
      schema:
        type: string
        format: uri
    OAuthResponseType:
      name: response_type
      in: query
      required: true
      schema:
        type: string
        const: code
    OAuthScope:
      name: scope
      in: query
      required: true
      schema:
        type: string
    OAuthState:
      name: state
      in: query
      required: true
      schema:
        type: string
        minLength: 8
    OAuthCodeChallenge:
      name: code_challenge
      in: query
      required: true
      schema:
        type: string
        minLength: 43
        maxLength: 128
    OAuthCodeChallengeMethod:
      name: code_challenge_method
      in: query
      required: true
      schema:
        type: string
        const: S256
    OptionalPermissionSubjectType:
      name: subject_type
      in: query
      required: false
      schema:
        type: string
        enum:
          - user
          - client
    OptionalPermissionSubjectID:
      name: subject_id
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/UUID'
    PermissionGrantStatus:
      name: status
      in: query
      required: false
      schema:
        type: string
        enum:
          - active
          - revoked
  requestBodies:
    Named:
      required: true
      content:
        application/json:
          schema:
            type: object
            required:
              - name
              - slug
            properties:
              name:
                type: string
              slug:
                type: string
                pattern: ^[a-z][a-z0-9-]{1,62}[a-z0-9]$
    Rename:
      required: true
      content:
        application/json:
          schema:
            type: object
            required:
              - name
            properties:
              name:
                type: string
                minLength: 1
                maxLength: 255
            additionalProperties: false
    ProviderInheritance:
      required: true
      content:
        application/json:
          schema:
            type: object
            required:
              - inheritable
            properties:
              inheritable:
                type: boolean
                description: Allow child scopes to resolve this provider.
            additionalProperties: false
    ApplicationAuthConfig:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApplicationAuthConfig'
    PublicApplicationConfig:
      required: true
      content:
        application/json:
          schema:
            type: object
            additionalProperties: true
            description: This entire object is returned by the unauthenticated runtime-config endpoint. Secrets are forbidden.
    InternalApplicationConfig:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApplicationInternalConfig'
    RoleAssignment:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RoleAssignment'
    PermissionGrantBody:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CreatePermissionGrant'
    OwnershipTransfer:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OwnershipTransfer'
    SMTPProvider:
      required: true
      content:
        application/json:
          schema:
            type: object
            required:
              - name
              - host
              - port
              - tls_mode
              - sender_email
            properties:
              name:
                type: string
              host:
                type: string
              port:
                type: integer
                minimum: 1
                maximum: 65535
              username:
                type: string
              password:
                type: string
                writeOnly: true
              tls_mode:
                enum:
                  - starttls
                  - implicit_tls
              sender_email:
                type: string
                format: email
              sender_name:
                type: string
              inheritable:
                type: boolean
                default: false
    StorageProviderBody:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CreateStorageProvider'
    StorageUpload:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CreateStorageUpload'
    OAuthAuthorizationDecision:
      required: true
      content:
        application/x-www-form-urlencoded:
          schema:
            type: object
            required:
              - client_id
              - redirect_uri
              - response_type
              - scope
              - state
              - code_challenge
              - code_challenge_method
              - decision
            properties:
              client_id:
                type: string
              redirect_uri:
                type: string
                format: uri
              response_type:
                type: string
                const: code
              scope:
                type: string
              state:
                type: string
              nonce:
                type: string
              code_challenge:
                type: string
              code_challenge_method:
                type: string
                const: S256
              decision:
                enum:
                  - grant
                  - deny
    OAuthToken:
      required: true
      content:
        application/x-www-form-urlencoded:
          schema:
            type: object
            required:
              - grant_type
            properties:
              grant_type:
                enum:
                  - authorization_code
                  - refresh_token
                  - client_credentials
              code:
                type: string
              redirect_uri:
                type: string
                format: uri
              code_verifier:
                type: string
              refresh_token:
                type: string
              client_id:
                type: string
              client_secret:
                type: string
                writeOnly: true
              scope:
                type: string
    OAuthTokenCredential:
      required: true
      content:
        application/x-www-form-urlencoded:
          schema:
            type: object
            required:
              - token
            properties:
              token:
                type: string
                writeOnly: true
              token_type_hint:
                enum:
                  - access_token
                  - refresh_token
              client_id:
                type: string
              client_secret:
                type: string
                writeOnly: true
  responses:
    Problem:
      description: RFC 9457 problem
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
    Tokens:
      description: Rotating user session
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TokenResponse'
    OwnershipTransferResult:
      description: Workspace ownership transferred atomically
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OwnershipTransferResult'
  schemas:
    HostedCopy:
      type: object
      additionalProperties: false
      properties:
        heading: {type: string, maxLength: 160}
        help: {type: string, maxLength: 500}
    HostedBranding:
      type: object
      additionalProperties: false
      properties:
        display_name: {type: string, maxLength: 120}
        logo_url: {type: string, format: uri}
        favicon_url: {type: string, format: uri}
        accent_color: {type: string, pattern: '^#[0-9a-fA-F]{6}$'}
        background_color: {type: string, pattern: '^#[0-9a-fA-F]{6}$'}
        layout: {type: string, enum: [centered, split]}
        privacy_url: {type: string, format: uri}
        terms_url: {type: string, format: uri}
        support_url: {type: string, format: uri}
        default_locale: {type: string}
        copy:
          type: object
          additionalProperties: {$ref: '#/components/schemas/HostedCopy'}
    HostedBrandingSettings:
      type: object
      additionalProperties: false
      required: [scope_type, configuration, version]
      properties:
        scope_type: {type: string, enum: [installation, organization, application]}
        configuration: {$ref: '#/components/schemas/HostedBranding'}
        effective: {$ref: '#/components/schemas/HostedBranding'}
        version: {type: integer, format: int64}
    HostedAuthUser:
      type: object
      additionalProperties: false
      required: [name, email]
      properties:
        name: {type: string}
        email: {type: string, format: email}
        email_verified: {type: boolean}
    HostedAuthView:
      type: object
      additionalProperties: false
      required: [interaction_id, csrf_token, application_id, client_name, branding, stage, consent_required, requested_scopes, providers, password_enabled, passwordless_enabled, registration_enabled, expires_at, ui_locales]
      properties:
        interaction_id: {$ref: '#/components/schemas/UUID'}
        csrf_token: {type: string}
        application_id: {$ref: '#/components/schemas/UUID'}
        client_name: {type: string}
        branding: {$ref: '#/components/schemas/HostedBranding'}
        stage: {type: string, enum: [login, email_code, mfa, external_email, consent, invitation]}
        user: {$ref: '#/components/schemas/HostedAuthUser'}
        consent_required: {type: boolean}
        requested_scopes: {type: array, items: {type: string}}
        providers: {type: array, items: {type: string}}
        password_enabled: {type: boolean}
        passwordless_enabled: {type: boolean}
        registration_enabled: {type: boolean}
        expires_at: {type: string, format: date-time}
        ui_locales: {type: string}
        mfa_methods: {type: array, items: {type: string, enum: [totp, webauthn]}}
        notice: {type: [string, 'null']}
    HostedAuthRedirect:
      type: object
      additionalProperties: false
      required: [redirect_url]
      properties:
        redirect_url: {type: string, format: uri}
    HostedAuthResult:
      oneOf:
        - $ref: '#/components/schemas/HostedAuthView'
        - $ref: '#/components/schemas/HostedAuthRedirect'
        - $ref: '#/components/schemas/WebAuthnChallenge'
    HostedAuthAction:
      type: object
      additionalProperties: false
      required: [action]
      properties:
        action:
          type: string
          enum: [password, signup, email_start, email_verify, mfa, webauthn_options, webauthn_verify, reset_start, reset_verify, provider, external_email_start, external_email_verify, invitation, verify_email_start, verify_email, approve, deny, switch_account, logout, restart]
        email: {type: string, format: email}
        password: {type: string, writeOnly: true}
        first_name: {type: string}
        last_name: {type: string}
        code: {type: string, writeOnly: true}
        recovery_code: {type: string, writeOnly: true}
        provider: {type: string, enum: [google, apple, microsoft, facebook, linkedin]}
        intent: {type: string, enum: [automatic, sign_in, sign_up]}
        invitation_id: {$ref: '#/components/schemas/UUID'}
        link_token: {type: string, writeOnly: true}
        credential:
          type: object
          additionalProperties: true
    HostedAuthReturn:
      type: object
      additionalProperties: false
      properties:
        challenge_id: {$ref: '#/components/schemas/UUID'}
        link_token: {type: string, writeOnly: true}
        provider: {type: string, enum: [google, apple, microsoft, facebook, linkedin]}
        code: {type: string, writeOnly: true}
        enrollment: {type: string, writeOnly: true}
    HealthStatus:
      type: object
      required:
        - status
      properties:
        status:
          type: string
          enum:
            - ok
            - ready
      additionalProperties: false
    VersionInfo:
      type: object
      required:
        - version
        - commit
        - built_at
        - schema
      properties:
        version:
          type: string
        commit:
          type: string
        built_at:
          type: string
        schema:
          type: string
      additionalProperties: false
    SetupStatus:
      type: object
      required:
        - available
        - control_user_email_login_available
        - control_auth_methods
      properties:
        available:
          type: boolean
        control_user_email_login_available:
          type: boolean
        control_auth_methods:
          $ref: '#/components/schemas/ControlAuthMethods'
      additionalProperties: false
    SetupSession:
      type: object
      required:
        - access_token
        - refresh_token
        - token_type
        - expires_in
        - control_user_id
      properties:
        access_token:
          type: string
          writeOnly: true
        refresh_token:
          type: string
          writeOnly: true
        token_type:
          const: Bearer
        expires_in:
          type: integer
        control_user_id:
          $ref: '#/components/schemas/UUID'
      additionalProperties: false
    SetupCompletion:
      type: object
      required:
        - access_token
        - refresh_token
        - token_type
        - expires_in
        - completed
      properties:
        access_token:
          type: string
          writeOnly: true
        refresh_token:
          type: string
          writeOnly: true
        token_type:
          const: Bearer
        expires_in:
          type: integer
        completed:
          type: boolean
          const: true
      additionalProperties: false
    ChallengeAccepted:
      type: object
      required:
        - challenge_id
        - expires_in
      properties:
        challenge_id:
          $ref: '#/components/schemas/UUID'
        expires_in:
          type: integer
          minimum: 1
      additionalProperties: false
    NotificationQueued:
      type: object
      required:
        - notification_id
        - status
      properties:
        notification_id:
          $ref: '#/components/schemas/UUID'
        status:
          type: string
          const: queued
      additionalProperties: false
    InvitationResent:
      type: object
      required:
        - id
        - last_sent_at
        - resend_available_at
        - expires_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        last_sent_at:
          type: string
          format: date-time
        resend_available_at:
          type: string
          format: date-time
        expires_at:
          type: string
          format: date-time
      additionalProperties: false
    ReconciliationAccepted:
      type: object
      required:
        - id
        - provider_id
        - status
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        provider_id:
          $ref: '#/components/schemas/UUID'
        status:
          type: string
          const: pending
      additionalProperties: false
    WebhookTestAccepted:
      type: object
      required:
        - event_id
        - delivery_id
        - status
      properties:
        event_id:
          $ref: '#/components/schemas/UUID'
        delivery_id:
          $ref: '#/components/schemas/UUID'
        status:
          type: string
          const: pending
      additionalProperties: false
    ControlUserAccount:
      type: object
      required:
        - id
        - email
        - display_name
        - status
        - installation_role
        - organizations
        - sign_in_methods
        - created_at
        - updated_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        email:
          type: string
          format: email
        display_name:
          type: string
        status:
          enum:
            - active
            - suspended
            - deleted
        installation_role:
          type: [string, 'null']
          enum: [owner, admin, auditor, null]
        organizations:
          type: array
          items:
            type: object
            required: [id, name, role]
            properties:
              id: { $ref: '#/components/schemas/UUID' }
              name: { type: string }
              role: { enum: [owner, admin, member, auditor] }
            additionalProperties: false
        sign_in_methods:
          type: object
          required: [email_code, magic_link, password, external_identities]
          properties:
            email_code: { type: boolean }
            magic_link: { type: boolean }
            password: { type: boolean }
            external_identities:
              type: array
              items:
                type: object
                required: [id, provider, metadata, available, created_at]
                properties:
                  id: { $ref: '#/components/schemas/UUID' }
                  provider: { enum: [google, apple, microsoft, facebook, linkedin] }
                  metadata: { type: object, additionalProperties: true }
                  available: { type: boolean }
                  created_at: { type: string, format: date-time }
                  last_used_at: { type: [string, 'null'], format: date-time }
                additionalProperties: false
          additionalProperties: false
        created_at: { type: string, format: date-time }
        updated_at: { type: string, format: date-time }
      additionalProperties: false
    Session:
      type: object
      required:
        - id
        - actor_type
        - created_at
        - expires_at
        - revoked
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        actor_type:
          enum:
            - control_user
            - user
            - client
        user_agent:
          type:
            - string
            - 'null'
        ip_address:
          type:
            - string
            - 'null'
        amr:
          type: array
          items:
            type: string
        authenticated_at:
          type:
            - string
            - 'null'
          format: date-time
        created_at:
          type: string
          format: date-time
        expires_at:
          type: string
          format: date-time
        revoked:
          type: boolean
      additionalProperties: false
    NotificationProvider:
      type: object
      required:
        - id
        - provider
        - scope
        - name
        - sender_email
        - sender_name
        - inheritable
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        provider:
          type: string
          const: smtp
        scope:
          enum:
            - installation
            - organization
            - application
        organization_id:
          type:
            - string
            - 'null'
          format: uuid
        application_id:
          type:
            - string
            - 'null'
          format: uuid
        name:
          type: string
        sender_email:
          type: string
          format: email
        sender_name:
          type: string
        inheritable:
          type: boolean
        verified:
          type: boolean
        credentials_configured:
          type: boolean
        effective:
          type: boolean
        verified_at:
          type:
            - string
            - 'null'
          format: date-time
        disabled_at:
          type: [string, 'null']
          format: date-time
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    AuthProvider:
      type: object
      required:
        - id
        - provider
        - scope
        - client_id
        - inheritable
        - control_login_enabled
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        provider:
          enum:
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
        scope:
          enum:
            - installation
            - organization
            - application
        organization_id:
          type:
            - string
            - 'null'
          format: uuid
        application_id:
          type:
            - string
            - 'null'
          format: uuid
        client_id:
          type: string
        team_id:
          type:
            - string
            - 'null'
        key_id:
          type:
            - string
            - 'null'
        tenant:
          type:
            - string
            - 'null'
          description: Microsoft tenant mode or tenant UUID. Null for other providers.
        inheritable:
          type: boolean
        control_login_enabled:
          type: boolean
        configured:
          type: boolean
        inherited:
          type: boolean
        linked_control_users:
          type: integer
          minimum: 0
        inheriting_applications:
          type: integer
          minimum: 0
        callback_uri:
          type: string
          format: uri
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    BillingProvider:
      type: object
      required:
        - id
        - provider
        - public_id
        - api_version
        - status
        - scope
        - inheritable
        - webhook_uri
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        provider:
          type: string
          const: stripe
        public_id:
          type: string
        api_version:
          type: string
        status:
          enum:
            - active
            - disabled
            - error
        scope:
          enum:
            - installation
            - organization
            - application
        inheritable:
          type: boolean
        organization_id:
          type: [string, 'null']
          format: uuid
        application_id:
          type: [string, 'null']
          format: uuid
        inherited:
          type: boolean
        webhook_configured:
          type: boolean
        effective:
          type: boolean
        metadata:
          type: object
          additionalProperties: true
        webhook_uri:
          type: string
          format: uri
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    ControlUser:
      type: object
      required:
        - id
        - email
        - display_name
        - status
        - role
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        email:
          type: string
          format: email
        display_name:
          type: string
        status:
          enum:
            - active
            - suspended
            - deleted
        role:
          enum:
            - owner
            - admin
            - member
            - auditor
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    ControlUserInvitation:
      type: object
      required:
        - id
        - email
        - role
        - onboarding_method
        - expires_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        organization_id:
          type:
            - string
            - 'null'
          format: uuid
        email:
          type: string
          format: email
        role:
          enum:
            - owner
            - admin
            - member
            - auditor
        onboarding_method:
          enum:
            - email
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
        status:
          enum:
            - pending
            - accepted
            - revoked
            - expired
        expires_at:
          type: string
          format: date-time
        invitation_token:
          type: string
          writeOnly: true
        token_returned_once:
          type: boolean
        invited_by:
          type: string
          format: uuid
        accepted_by:
          type: [string, 'null']
          format: uuid
        accepted_at:
          type: [string, 'null']
          format: date-time
        revoked_at:
          type: [string, 'null']
          format: date-time
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    SigningKey:
      type: object
      required:
        - id
        - kid
        - algorithm
        - status
        - created_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        kid:
          type: string
        algorithm:
          type: string
          const: RS256
        status:
          enum:
            - active
            - retiring
            - retired
        created_at:
          type: string
          format: date-time
        retires_at:
          type:
            - string
            - 'null'
          format: date-time
      additionalProperties: false
    SecretCredential:
      type: object
      required:
        - secret
        - secret_returned_once
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        client_id:
          type: string
        secret:
          type: string
          writeOnly: true
        secret_returned_once:
          type: boolean
        previous_secret_valid_for_seconds:
          type: integer
          minimum: 0
      additionalProperties: false
    ManagementClient:
      type: object
      required:
        - id
        - client_id
        - name
        - allowed_scopes
        - status
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        client_id:
          type: string
        name:
          type: string
        allowed_scopes:
          type: array
          items:
            type: string
        status:
          enum:
            - active
            - disabled
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    Organization:
      type: object
      required:
        - id
        - slug
        - name
        - version
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        slug:
          type: string
        name:
          type: string
        version:
          type: integer
          format: int64
        role:
          type: string
        retired_at:
          type: [string, 'null']
          format: date-time
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    Application:
      type: object
      required:
        - id
        - organization_id
        - slug
        - name
        - version
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        organization_id:
          $ref: '#/components/schemas/UUID'
        slug:
          type: string
        name:
          type: string
        version:
          type: integer
          format: int64
        issuer:
          type: string
          format: uri
        audience:
          type: string
        auth_config:
          type: object
          additionalProperties: true
        public_config:
          type: object
          additionalProperties: true
        internal_config:
          type: object
          additionalProperties: true
        retired_at:
          type: [string, 'null']
          format: date-time
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    ApplicationStatistics:
      type: object
      required:
        - users
        - workspaces
        - active_products
        - active_entitlements
        - pending_local_requests
        - live_subscriptions
        - notification_failures
        - webhook_failures
        - events_last_24_hours
      properties:
        users:
          type: object
          required: [total, active, suspended]
          properties:
            total: { type: integer, minimum: 0 }
            active: { type: integer, minimum: 0 }
            suspended: { type: integer, minimum: 0 }
          additionalProperties: false
        workspaces:
          type: integer
          minimum: 0
        active_products:
          type: integer
          minimum: 0
        active_entitlements:
          type: integer
          minimum: 0
        pending_local_requests:
          type: integer
          minimum: 0
        live_subscriptions:
          type: integer
          minimum: 0
        notification_failures:
          type: integer
          minimum: 0
        webhook_failures:
          type: integer
          minimum: 0
        events_last_24_hours:
          type: integer
          minimum: 0
      additionalProperties: false
    ApplicationDomain:
      type: object
      required:
        - id
        - hostname
        - status
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        hostname:
          type: string
          format: hostname
        status:
          enum:
            - pending
            - verified
            - disabled
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    OAuthClient:
      type: object
      required:
        - id
        - client_id
        - name
        - client_type
      properties:
        initiate_login_uri: {type: string, maxLength: 2048}
        authorization_ui: {type: string, enum: [headless, hosted], default: headless}
        pkce_required: {type: boolean, default: true}
        id:
          $ref: '#/components/schemas/UUID'
        client_id:
          type: string
        name:
          type: string
        client_type:
          enum:
            - public
            - confidential
            - machine
        redirect_uris:
          type: array
          items:
            type: string
            format: uri
        post_logout_redirect_uris:
          type: array
          items:
            type: string
            format: uri
        allowed_scopes:
          type: array
          items:
            type: string
        allowed_grants:
          type: array
          items:
            type: string
        client_secret:
          type: [string, 'null']
          writeOnly: true
        secret:
          type: string
          writeOnly: true
        secret_returned_once:
          type: boolean
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    Workspace:
      type: object
      required:
        - id
        - owner_user_id
        - key
        - name
        - metadata
        - version
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        application_id:
          $ref: '#/components/schemas/UUID'
        owner_user_id:
          $ref: '#/components/schemas/UUID'
        key:
          type: string
        name:
          type: string
        metadata:
          type: object
          additionalProperties: true
        version:
          type: integer
          format: int64
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    WorkspaceMember:
      type: object
      required:
        - workspace_id
        - user_id
        - role_keys
      properties:
        workspace_id:
          $ref: '#/components/schemas/UUID'
        user_id:
          $ref: '#/components/schemas/UUID'
        role_keys:
          type: array
          items:
            $ref: '#/components/schemas/RoleKey'
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    RoleAssignmentRecord:
      type: object
      required:
        - id
        - role_id
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        user_id:
          type:
            - string
            - 'null'
          format: uuid
        client_id:
          type:
            - string
            - 'null'
          format: uuid
        role_id:
          $ref: '#/components/schemas/UUID'
        workspace_id:
          type:
            - string
            - 'null'
          format: uuid
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    Delegation:
      type: object
      required:
        - id
        - user_id
        - scopes
        - reason
        - status
        - expires_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        user_id:
          $ref: '#/components/schemas/UUID'
        workspace_id:
          type:
            - string
            - 'null'
          format: uuid
        scopes:
          type: array
          items:
            type: string
        reason:
          type: string
        status:
          enum:
            - pending
            - exchanged
            - revoked
            - expired
        exchange_code:
          type: string
          writeOnly: true
        expires_at:
          type: string
          format: date-time
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    ApplicationInvitation:
      type: object
      required:
        - id
        - application_id
        - email
        - onboarding_method
        - status
        - expires_at
      properties:
        hosted_client_id:
          type: [string, 'null']
          format: uuid
        hosted_redirect_uri:
          type: [string, 'null']
          maxLength: 2048
        id:
          $ref: '#/components/schemas/UUID'
        application_id:
          $ref: '#/components/schemas/UUID'
        workspace_id:
          type:
            - string
            - 'null'
          format: uuid
        email:
          type: string
          format: email
        application_role_keys:
          type: array
          items:
            $ref: '#/components/schemas/RoleKey'
        workspace_role_keys:
          type: array
          items:
            $ref: '#/components/schemas/RoleKey'
        onboarding_method:
          enum: [email, google, apple, microsoft, facebook, linkedin]
          default: email
        status:
          enum:
            - pending
            - accepted
            - revoked
            - expired
        code:
          type: string
          writeOnly: true
        link_token:
          type: string
          writeOnly: true
        link:
          type: string
          format: uri
        expires_at:
          type: string
          format: date-time
        accepted_user_id:
          type:
            - string
            - 'null'
          format: uuid
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    RevokedSessionCount:
      type: object
      required:
        - revoked_sessions
      properties:
        revoked_sessions:
          type: integer
          minimum: 0
      additionalProperties: false
    AuthMethods:
      type: object
      required:
        - methods
        - registration_enabled
        - registration_mode
      properties:
        methods:
          type: array
          items:
            enum:
              - password
              - email_code
              - magic_link
              - google
              - apple
              - microsoft
              - facebook
              - linkedin
              - totp
              - webauthn
        registration_enabled:
          type: boolean
        registration_mode:
          enum:
            - public
            - invite_only
      additionalProperties: false
    WebAuthnChallenge:
      type: object
      required:
        - ceremony_id
        - options
        - expires_at
      properties:
        ceremony_id:
          $ref: '#/components/schemas/UUID'
        options:
          type: object
          additionalProperties: true
        expires_at:
          type: string
          format: date-time
      additionalProperties: false
    InvitationExchangeResult:
      type: object
      required:
        - authorization_code
        - redirect_uri
        - expires_in
      properties:
        authorization_code:
          type: string
          writeOnly: true
        redirect_uri:
          type: string
          format: uri
        expires_in:
          type: integer
          minimum: 1
        mfa_challenge_id:
          type:
            - string
            - 'null'
          format: uuid
      additionalProperties: false
    PersonalAPIKeyCreated:
      type: object
      required:
        - token
        - api_key
      properties:
        token:
          type: string
          writeOnly: true
        api_key:
          type: object
          required:
            - id
            - label
            - token_prefix
            - scopes
            - expires_at
          properties:
            id:
              $ref: '#/components/schemas/UUID'
            label:
              type: string
            token_prefix:
              type: string
            scopes:
              type: array
              items:
                type: string
            expires_at:
              type: string
              format: date-time
          additionalProperties: false
      additionalProperties: false
    Feature:
      type: object
      required:
        - id
        - key
        - name
        - value_type
        - metadata
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        key:
          type: string
        name:
          type: string
        value_type:
          enum:
            - boolean
            - number
            - string
            - free_form
        free_form_format:
          type:
            - string
            - 'null'
          enum:
            - text
            - csv
            - json
            - null
        metadata:
          type: object
          additionalProperties: true
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    Product:
      type: object
      required:
        - id
        - key
        - name
        - listable
        - status
        - metadata
        - entitlement_config
        - features
        - version
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        key:
          type: string
        name:
          type: string
        description:
          type:
            - string
            - 'null'
        listable:
          type: boolean
        status:
          enum:
            - active
            - archived
        metadata:
          type: object
          additionalProperties: true
        entitlement_config:
          type: object
          additionalProperties: true
        features:
          type: array
          items:
            $ref: '#/components/schemas/CatalogFeatureSnapshot'
        version:
          type: integer
          format: int64
        prices:
          type: array
          items:
            $ref: '#/components/schemas/Price'
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    Price:
      type: object
      required:
        - id
        - key
        - mode
        - currency
        - currency_exponent
        - tax_behavior
        - checkout_config
        - entitlement_config
        - features
        - active
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        product_id:
          $ref: '#/components/schemas/UUID'
        key:
          type: string
        mode:
          enum:
            - recurring
            - one_time
            - local
        amount_minor:
          type:
            - integer
            - 'null'
          format: int64
        currency:
          type: string
        currency_exponent:
          type: integer
        tax_behavior:
          enum:
            - inclusive
            - exclusive
            - unspecified
        checkout_config:
          type: object
          additionalProperties: true
        entitlement_config:
          type: object
          additionalProperties: true
        features:
          type: array
          items:
            $ref: '#/components/schemas/CatalogFeatureSnapshot'
        active:
          type: boolean
        interval_unit:
          type: [string, 'null']
        interval_count:
          type: [integer, 'null']
        validity_seconds:
          type: [integer, 'null']
          format: int64
        grace_seconds:
          type: integer
          format: int64
        status:
          enum:
            - active
            - archived
        version:
          type: integer
          format: int64
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    EntitlementGrant:
      type: object
      required:
        - id
        - subject_type
        - subject_id
        - source_type
        - feature_values
        - configuration
        - starts_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        source_type:
          enum:
            - manual
            - local_request
            - subscription
            - checkout
        source_id:
          type:
            - string
            - 'null'
          format: uuid
        feature_values:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/FeatureValue'
        configuration:
          type: object
          additionalProperties: true
        starts_at:
          type: string
          format: date-time
        expires_at:
          type:
            - string
            - 'null'
          format: date-time
        revoked_at:
          type:
            - string
            - 'null'
          format: date-time
        external_reference:
          type:
            - string
            - 'null'
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    EffectiveEntitlements:
      type: object
      required:
        - workspace_id
        - effective
        - provenance
        - sources
      properties:
        workspace_id:
          type:
            - string
            - 'null'
          format: uuid
        effective:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/FeatureValue'
        provenance:
          type: object
          additionalProperties:
            type: array
            items:
              $ref: '#/components/schemas/UUID'
        sources:
          type: array
          items:
            $ref: '#/components/schemas/EntitlementGrant'
      additionalProperties: false
    LocalEntitlementRequest:
      type: object
      required:
        - id
        - status
        - subject_type
        - subject_id
        - product_snapshot
        - price_snapshot
        - feature_snapshot
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        status:
          enum:
            - pending
            - approved
            - rejected
            - cancelled
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        product_snapshot:
          type: object
          additionalProperties: true
        price_snapshot:
          type: object
          additionalProperties: true
        feature_snapshot:
          type: object
          additionalProperties: true
        address_snapshot:
          type:
            - object
            - 'null'
          additionalProperties: true
        external_reference:
          type:
            - string
            - 'null'
        entitlement_grant_id:
          type:
            - string
            - 'null'
          format: uuid
        reason:
          type:
            - string
            - 'null'
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    LocalEntitlementApproval:
      type: object
      required:
        - status
        - entitlement_grant_id
      properties:
        status:
          type: string
          const: approved
        entitlement_grant_id:
          $ref: '#/components/schemas/UUID'
      additionalProperties: false
    CheckoutSession:
      type: object
      required:
        - id
        - status
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        status:
          enum:
            - open
            - complete
            - expired
        checkout_uri:
          type:
            - string
            - 'null'
          format: uri
        provider_session_id:
          type:
            - string
            - 'null'
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        external_reference:
          type:
            - string
            - 'null'
        created_at:
          type: string
          format: date-time
        expires_at:
          type:
            - string
            - 'null'
          format: date-time
      additionalProperties: false
    PortalSession:
      type: object
      required:
        - provider_session_id
        - portal_uri
      properties:
        provider_session_id:
          type: string
        portal_uri:
          type: string
          format: uri
      additionalProperties: false
    Subscription:
      type: object
      required:
        - id
        - subject_type
        - subject_id
        - price_id
        - provider_id
        - status
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        price_id:
          $ref: '#/components/schemas/UUID'
        provider_id:
          $ref: '#/components/schemas/UUID'
        provider_subscription_id:
          type: string
        status:
          type: string
        current_period_start:
          type:
            - string
            - 'null'
          format: date-time
        current_period_end:
          type:
            - string
            - 'null'
          format: date-time
        cancel_at_period_end:
          type: boolean
        external_reference:
          type:
            - string
            - 'null'
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    Invoice:
      type: object
      required:
        - id
        - subject_type
        - subject_id
        - status
        - amount_due_minor
        - currency
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        subscription_id:
          type:
            - string
            - 'null'
          format: uuid
        provider_invoice_id:
          type: string
        status:
          type: string
        amount_due_minor:
          type: integer
          format: int64
        amount_paid_minor:
          type: integer
          format: int64
        currency:
          type: string
        hosted_invoice_uri:
          type:
            - string
            - 'null'
          format: uri
        external_reference:
          type:
            - string
            - 'null'
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    Payment:
      type: object
      required:
        - id
        - subject_type
        - subject_id
        - status
        - amount_minor
        - currency
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        invoice_id:
          type:
            - string
            - 'null'
          format: uuid
        provider_payment_id:
          type: string
        status:
          type: string
        amount_minor:
          type: integer
          format: int64
        currency:
          type: string
        external_reference:
          type:
            - string
            - 'null'
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    Refund:
      type: object
      required:
        - id
        - status
        - amount_minor
        - currency
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        payment_id:
          $ref: '#/components/schemas/UUID'
        provider_refund_id:
          type: string
        status:
          type: string
        amount_minor:
          type: integer
          format: int64
        currency:
          type: string
        reason:
          type:
            - string
            - 'null'
        external_reference:
          type:
            - string
            - 'null'
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    Dispute:
      type: object
      required:
        - id
        - status
        - amount_minor
        - currency
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        payment_id:
          type:
            - string
            - 'null'
          format: uuid
        provider_dispute_id:
          type: string
        status:
          type: string
        amount_minor:
          type: integer
          format: int64
        currency:
          type: string
        reason:
          type:
            - string
            - 'null'
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    BillingStatistics:
      type: object
      required:
        - from
        - to
        - revenue_minor_by_currency
        - refunds_minor_by_currency
        - status_counts
      properties:
        from:
          type: string
          format: date-time
        to:
          type: string
          format: date-time
        revenue_minor_by_currency:
          type: array
          items:
            $ref: '#/components/schemas/CurrencyTotal'
        refunds_minor_by_currency:
          type: array
          items:
            $ref: '#/components/schemas/CurrencyTotal'
        status_counts:
          type: object
          additionalProperties:
            type: object
            additionalProperties:
              type: integer
              minimum: 0
      additionalProperties: false
    CurrencyTotal:
      type: object
      required: [currency, amount_minor]
      properties:
        currency:
          type: string
          pattern: '^[A-Z]{3}$'
        amount_minor:
          type: integer
          format: int64
      additionalProperties: false
    BillingProviderEvent:
      type: object
      required:
        - id
        - provider_event_id
        - event_type
        - status
        - received_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        provider_event_id:
          type: string
        event_type:
          type: string
        status:
          enum:
            - pending
            - processed
            - failed
            - ignored
        attempts:
          type: integer
        last_error:
          type:
            - string
            - 'null'
        received_at:
          type: string
          format: date-time
        processed_at:
          type:
            - string
            - 'null'
          format: date-time
      additionalProperties: false
    ReconciliationRun:
      type: object
      required:
        - id
        - provider_id
        - status
        - findings
        - repairs
        - created_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        provider_id:
          $ref: '#/components/schemas/UUID'
        status:
          enum:
            - pending
            - running
            - completed
            - failed
        findings:
          type: integer
          minimum: 0
        repairs:
          type: integer
          minimum: 0
        last_error:
          type:
            - string
            - 'null'
        started_at:
          type:
            - string
            - 'null'
          format: date-time
        completed_at:
          type:
            - string
            - 'null'
          format: date-time
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    BillingProfile:
      type: object
      required:
        - id
        - subject_type
        - subject_id
        - version
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        name:
          type:
            - string
            - 'null'
        email:
          type:
            - string
            - 'null'
          format: email
        tax_id:
          type:
            - string
            - 'null'
        default_address_id:
          type:
            - string
            - 'null'
          format: uuid
        version:
          type: integer
          format: int64
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    BillingSummary:
      type: object
      required:
        - subject_type
        - subject_id
        - billing_profile
        - subscriptions
      properties:
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        billing_profile:
          type:
            - object
            - 'null'
          allOf:
            - $ref: '#/components/schemas/BillingProfile'
        subscriptions:
          type: array
          items:
            $ref: '#/components/schemas/Subscription'
      additionalProperties: false
    Address:
      type: object
      required:
        - id
        - subject_type
        - subject_id
        - line1
        - city
        - postal_code
        - country
        - active
        - version
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        name:
          type:
            - string
            - 'null'
        line1:
          type: string
        line2:
          type:
            - string
            - 'null'
        city:
          type: string
        region:
          type:
            - string
            - 'null'
        postal_code:
          type: string
        country:
          type: string
        active:
          type: boolean
        version:
          type: integer
          format: int64
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    AccountExport:
      type: object
      required:
        - exported_at
        - user
        - addresses
      properties:
        exported_at:
          type: string
          format: date-time
        user:
          $ref: '#/components/schemas/User'
        addresses:
          type: array
          items:
            $ref: '#/components/schemas/Address'
      additionalProperties: false
    MFAEnrollment:
      type: object
      required:
        - method_id
        - secret
        - provisioning_uri
      properties:
        method_id:
          $ref: '#/components/schemas/UUID'
        secret:
          type: string
          writeOnly: true
        provisioning_uri:
          type: string
          format: uri
      additionalProperties: false
    MFAActivation:
      type: object
      required:
        - method_id
        - recovery_codes
      properties:
        method_id:
          $ref: '#/components/schemas/UUID'
        recovery_codes:
          type: array
          items:
            type: string
            writeOnly: true
      additionalProperties: false
    RecoveryCodes:
      type: object
      required:
        - recovery_codes
      properties:
        recovery_codes:
          type: array
          items:
            type: string
            writeOnly: true
      additionalProperties: false
    MFAMethod:
      type: object
      required:
        - id
        - type
        - status
        - created_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        type:
          enum:
            - totp
            - webauthn
        name:
          type:
            - string
            - 'null'
        status:
          enum:
            - pending
            - active
            - disabled
        last_used_at:
          type:
            - string
            - 'null'
          format: date-time
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    ExternalIdentity:
      type: object
      required:
        - id
        - provider
        - created_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        provider:
          enum:
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
        email:
          type:
            - string
            - 'null'
          format: email
        created_at:
          type: string
          format: date-time
        last_used_at:
          type:
            - string
            - 'null'
          format: date-time
      additionalProperties: false
    PermissionCheckResult:
      type: object
      required:
        - workspace_id
        - results
      properties:
        workspace_id:
          type:
            - string
            - 'null'
          format: uuid
        results:
          type: object
          additionalProperties:
            type: boolean
      additionalProperties: false
    AuditRecord:
      type: object
      required:
        - id
        - actor_type
        - action
        - target_type
        - created_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        organization_id:
          type:
            - string
            - 'null'
          format: uuid
        application_id:
          type:
            - string
            - 'null'
          format: uuid
        actor_type:
          enum:
            - control_user
            - user
            - client
            - system
        actor_id:
          type:
            - string
            - 'null'
          format: uuid
        action:
          type: string
        target_type:
          type: string
        target_id:
          type:
            - string
            - 'null'
        reason:
          type:
            - string
            - 'null'
        request_id:
          type:
            - string
            - 'null'
        changes:
          type: object
          additionalProperties: true
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    AuditExportRecord:
      type: object
      required:
        - id
        - record_count
        - expires_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        record_count:
          type: integer
          minimum: 0
        filters:
          type: object
          additionalProperties: true
        status:
          enum:
            - pending
            - ready
            - expired
            - failed
        download_uri:
          type:
            - string
            - 'null'
          format: uri
        expires_at:
          type: string
          format: date-time
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    Webhook:
      type: object
      required:
        - id
        - uri
        - event_filters
        - disabled
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        uri:
          type: string
          format: uri
        event_filters:
          type: array
          items:
            type: string
        secret:
          type: string
          writeOnly: true
        secret_returned_once:
          type: boolean
        disabled:
          type: boolean
        disabled_at:
          type:
            - string
            - 'null'
          format: date-time
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    WebhookDelivery:
      type: object
      required:
        - id
        - event_id
        - webhook_id
        - status
        - attempt_count
        - created_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        event_id:
          $ref: '#/components/schemas/UUID'
        webhook_id:
          $ref: '#/components/schemas/UUID'
        status:
          enum:
            - pending
            - delivered
            - failed
            - dead
        attempt_count:
          type: integer
          minimum: 0
        response_status:
          type:
            - integer
            - 'null'
        last_error:
          type:
            - string
            - 'null'
        next_attempt_at:
          type:
            - string
            - 'null'
          format: date-time
        created_at:
          type: string
          format: date-time
        delivered_at:
          type:
            - string
            - 'null'
          format: date-time
      additionalProperties: false
    SenderIdentity:
      type: object
      required:
        - id
        - provider_id
        - email
        - name
        - is_default
        - verified
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        provider_id:
          $ref: '#/components/schemas/UUID'
        email:
          type: string
          format: email
        name:
          type: string
        is_default:
          type: boolean
        verified:
          type: boolean
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    NotificationTemplate:
      type: object
      required:
        - id
        - key
        - locale
        - category
        - version
        - status
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        application_id:
          type:
            - string
            - 'null'
          format: uuid
        key:
          type: string
        locale:
          $ref: '#/components/schemas/Locale'
        category:
          type: string
        subject_template:
          type: string
        text_template:
          type: string
        html_template:
          type:
            - string
            - 'null'
        version:
          type: integer
        status:
          enum:
            - draft
            - active
            - archived
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    TemplateVariables:
      type: object
      required:
        - protected
        - optional
      properties:
        protected:
          type: array
          items:
            type: string
        optional:
          type: array
          items:
            type: string
      additionalProperties: false
    NotificationTemplatePreview:
      type: object
      required:
        - template_id
        - version
        - subject
        - text
        - html
      properties:
        template_id:
          $ref: '#/components/schemas/UUID'
        version:
          type: integer
        subject:
          type: string
        text:
          type: string
        html:
          type:
            - string
            - 'null'
      additionalProperties: false
    NotificationStatistics:
      type: object
      required:
        - notification_status_counts
        - attempts_delivered
        - attempts_failed
      properties:
        notification_status_counts:
          type: object
          additionalProperties:
            type: integer
            minimum: 0
        attempts_delivered:
          type: integer
          minimum: 0
        attempts_failed:
          type: integer
          minimum: 0
      additionalProperties: false
    Notification:
      type: object
      required:
        - id
        - template_key
        - recipient
        - status
        - created_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        template_key:
          type: string
        recipient:
          type: string
          format: email
        locale:
          $ref: '#/components/schemas/Locale'
        status:
          enum:
            - queued
            - sending
            - delivered
            - failed
            - suppressed
            - dead
        attempt_count:
          type: integer
          minimum: 0
        last_error:
          type:
            - string
            - 'null'
        created_at:
          type: string
          format: date-time
        delivered_at:
          type:
            - string
            - 'null'
          format: date-time
      additionalProperties: false
    NotificationPreference:
      type: object
      required:
        - category
        - email_enabled
      properties:
        category:
          type: string
        email_enabled:
          type: boolean
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    StorageProvider:
      type: object
      required:
        - id
        - provider
        - scope
        - name
        - endpoint
        - region
        - force_path_style
        - status
        - inheritable
        - credentials_configured
        - allow_private_endpoint
        - max_object_bytes
        - max_email_image_bytes
        - max_application_bytes
        - max_application_objects
        - version
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        provider:
          type: string
          const: s3
        scope:
          enum:
            - installation
            - organization
            - application
        organization_id:
          type:
            - string
            - 'null'
          format: uuid
        application_id:
          type:
            - string
            - 'null'
          format: uuid
        name:
          type: string
        endpoint:
          type: string
          format: uri
        region:
          type: string
        force_path_style:
          type: boolean
        public_bucket:
          type:
            - string
            - 'null'
        private_bucket:
          type:
            - string
            - 'null'
        public_base_url:
          type:
            - string
            - 'null'
          format: uri
        status:
          enum:
            - active
            - disabled
            - unverified
            - error
        inheritable:
          type: boolean
        credentials_configured:
          type: boolean
        allow_private_endpoint:
          type: boolean
        verified_at:
          type:
            - string
            - 'null'
          format: date-time
        disabled_at:
          type: [string, 'null']
          format: date-time
        last_error:
          type: [string, 'null']
        max_object_bytes:
          type: integer
          format: int64
        max_email_image_bytes:
          type: integer
          format: int64
        max_application_bytes:
          type: integer
          format: int64
        max_application_objects:
          type: integer
          format: int64
        version:
          type: integer
          format: int64
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    StorageProviderStatus:
      type: object
      required:
        - id
        - status
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        status:
          enum:
            - active
            - disabled
            - unverified
            - error
      additionalProperties: false
    StorageDownload:
      type: object
      required:
        - url
        - expires_at
        - visibility
      properties:
        url:
          type: string
          format: uri
        expires_at:
          type: string
          format: date-time
        visibility:
          enum:
            - public
            - private
      additionalProperties: false
    OIDCDiscovery:
      type: object
      required:
        - issuer
        - authorization_endpoint
        - token_endpoint
        - jwks_uri
        - response_types_supported
        - subject_types_supported
        - id_token_signing_alg_values_supported
      properties:
        issuer:
          type: string
          format: uri
        authorization_endpoint:
          type: string
          format: uri
        token_endpoint:
          type: string
          format: uri
        userinfo_endpoint:
          type: string
          format: uri
        revocation_endpoint:
          type: string
          format: uri
        introspection_endpoint:
          type: string
          format: uri
        jwks_uri:
          type: string
          format: uri
        response_types_supported:
          type: array
          items:
            type: string
        grant_types_supported:
          type: array
          items:
            type: string
        subject_types_supported:
          type: array
          items:
            type: string
        id_token_signing_alg_values_supported:
          type: array
          items:
            type: string
        code_challenge_methods_supported:
          type: array
          items:
            type: string
        scopes_supported:
          type: array
          items:
            type: string
      additionalProperties: false
    JWKS:
      type: object
      required:
        - keys
      properties:
        keys:
          type: array
          items:
            type: object
            required:
              - kty
              - kid
              - use
              - alg
              - n
              - e
            properties:
              kty:
                type: string
              kid:
                type: string
              use:
                type: string
              alg:
                type: string
              n:
                type: string
              e:
                type: string
            additionalProperties: false
      additionalProperties: false
    AuthorizationRedirect:
      type: object
      required:
        - redirect_to
      properties:
        redirect_to:
          type: string
          format: uri
      additionalProperties: false
    TokenIntrospection:
      type: object
      required:
        - active
      properties:
        active:
          type: boolean
        sub:
          type: string
        aud:
          oneOf:
            - type: string
            - type: array
              items:
                type: string
        iss:
          type: string
          format: uri
        exp:
          type: integer
          format: int64
        iat:
          type: integer
          format: int64
        scope:
          type: string
        client_id:
          type: string
        token_type:
          type: string
        actor_type:
          enum:
            - control_user
            - user
            - client
        application_id:
          type: string
          format: uuid
        roles:
          $ref: '#/components/schemas/StructuredRoles'
      additionalProperties: false
    UserInfo:
      type: object
      required:
        - sub
        - application_id
        - actor_type
      properties:
        sub:
          type: string
        application_id:
          $ref: '#/components/schemas/UUID'
        actor_type:
          enum:
            - user
            - client
        email:
          type: string
          format: email
        email_verified:
          type: boolean
        given_name:
          type: string
        family_name:
          type: string
        locale:
          $ref: '#/components/schemas/Locale'
        scope:
          type: string
        roles:
          $ref: '#/components/schemas/StructuredRoles'
        custom_claims:
          type: object
          additionalProperties: true
      additionalProperties: false
    WebhookAcknowledgement:
      type: object
      required:
        - received
      properties:
        received:
          type: boolean
      additionalProperties: false
    OrganizationMember:
      type: object
      required:
        - control_user_id
        - email
        - display_name
        - role
        - status
      properties:
        control_user_id:
          $ref: '#/components/schemas/UUID'
        email:
          type: string
          format: email
        display_name:
          type: string
        role:
          enum:
            - owner
            - admin
            - member
            - auditor
        status:
          enum:
            - active
            - suspended
            - deleted
        joined_at:
          type: string
          format: date-time
      additionalProperties: false
    PersonalAPIKey:
      type: object
      required:
        - id
        - label
        - token_prefix
        - scopes
        - status
        - expires_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        label:
          type: string
        token_prefix:
          type: string
        scopes:
          type: array
          items:
            type: string
        status:
          enum:
            - active
            - revoked
            - expired
        last_used_at:
          type:
            - string
            - 'null'
          format: date-time
        expires_at:
          type: string
          format: date-time
        created_at:
          type: string
          format: date-time
      additionalProperties: false
    OAuthConsent:
      type: object
      required:
        - id
        - client_id
        - scopes
        - created_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        client_id:
          type: string
        client_name:
          type: string
        scopes:
          type: array
          items:
            type: string
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    WorkspaceAccessEntry:
      type: object
      required:
        - type
        - workspace_id
      properties:
        type:
          enum:
            - owner
            - member
            - invitation
        workspace_id:
          $ref: '#/components/schemas/UUID'
        user_id:
          type:
            - string
            - 'null'
          format: uuid
        email:
          type:
            - string
            - 'null'
          format: email
        role_keys:
          type: array
          items:
            $ref: '#/components/schemas/RoleKey'
        invitation_id:
          type:
            - string
            - 'null'
          format: uuid
        status:
          type: string
        expires_at:
          type:
            - string
            - 'null'
          format: date-time
      additionalProperties: false
    EmptyResponse:
      type: object
      maxProperties: 0
      additionalProperties: false
    SessionPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Session'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    NotificationProviderPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/NotificationProvider'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    AuthProviderPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/AuthProvider'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    BillingProviderPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/BillingProvider'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    ControlUserPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ControlUser'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    ControlUserInvitationPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ControlUserInvitation'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    SigningKeyPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/SigningKey'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    ManagementClientPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ManagementClient'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    ApplicationPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Application'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    OrganizationMemberPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/OrganizationMember'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    ApplicationDomainPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationDomain'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    OAuthClientPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/OAuthClient'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    RolePage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Role'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    WorkspacePage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Workspace'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    WorkspaceMemberPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/WorkspaceMember'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    RoleAssignmentPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/RoleAssignmentRecord'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    PermissionGrantPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/PermissionGrant'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    DelegationPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Delegation'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    ApplicationInvitationPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ApplicationInvitation'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    UserPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/User'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    EntitlementGrantPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/EntitlementGrant'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    AddressPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Address'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    OAuthConsentPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/OAuthConsent'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    FeaturePage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Feature'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    ProductPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Product'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    PricePage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Price'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    LocalEntitlementRequestPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/LocalEntitlementRequest'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    SubscriptionPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Subscription'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    InvoicePage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Invoice'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    PaymentPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Payment'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    RefundPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Refund'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    DisputePage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Dispute'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    BillingProviderEventPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/BillingProviderEvent'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    ReconciliationRunPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ReconciliationRun'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    MFAMethodPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/MFAMethod'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    ExternalIdentityPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ExternalIdentity'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    WorkspaceAccessPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/WorkspaceAccessEntry'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    EventPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/EventEnvelope'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    EventTypePage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/EventTypeDefinition'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    AuditRecordPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/AuditRecord'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    WebhookPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Webhook'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    WebhookDeliveryPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/WebhookDelivery'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    SenderIdentityPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/SenderIdentity'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    NotificationTemplatePage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/NotificationTemplate'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    NotificationPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Notification'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    NotificationPreferencePage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/NotificationPreference'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    StorageProviderPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/StorageProvider'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    StorageObjectPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/StorageObject'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    PersonalAPIKeyPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/PersonalAPIKey'
        next_cursor:
          type:
            - string
            - 'null'
      additionalProperties: false
    CompleteSetup:
      type: object
      properties:
        password:
          type: string
          minLength: 12
          maxLength: 1024
          writeOnly: true
      additionalProperties: false
    ControlEmailStart:
      type: object
      required:
        - email
      properties:
        email:
          type: string
          format: email
        delivery:
          enum:
            - code
            - link
            - both
          default: both
      additionalProperties: false
    UpdateControlUserAccount:
      type: object
      required:
        - display_name
      properties:
        display_name:
          type: string
          minLength: 1
          maxLength: 200
      additionalProperties: false
    ControlInvitationProviderStart:
      type: object
      required:
        - invitation_token
      properties:
        invitation_token:
          type: string
          minLength: 1
          writeOnly: true
      additionalProperties: false
    UpdateControlInvitationMethod:
      type: object
      properties:
        onboarding_method:
          enum:
            - email
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
      additionalProperties: false
    UpdateManagementAPI:
      type: object
      required:
        - enabled
      properties:
        enabled:
          type: boolean
      additionalProperties: false
    RefreshToken:
      type: object
      required:
        - refresh_token
      properties:
        refresh_token:
          type: string
          minLength: 1
          writeOnly: true
      additionalProperties: false
    ConfigureAuthProvider:
      type: object
      required:
        - client_id
      properties:
        client_id:
          type: string
          minLength: 1
          maxLength: 500
        client_secret:
          type: string
          minLength: 1
          writeOnly: true
        team_id:
          type: string
          minLength: 1
          maxLength: 100
        key_id:
          type: string
          minLength: 1
          maxLength: 100
        private_key_pem:
          type: string
          minLength: 1
          writeOnly: true
        tenant:
          type: string
          description: Microsoft tenant mode (common, organizations, consumers) or a tenant UUID.
          pattern: '^(common|organizations|consumers|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$'
        inheritable:
          type: boolean
          default: false
        control_login_enabled:
          type: boolean
      additionalProperties: false
    UpdateSMTPProvider:
      type: object
      minProperties: 1
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 200
        host:
          type: string
          minLength: 1
          maxLength: 255
        port:
          type: integer
          minimum: 1
          maximum: 65535
        username:
          type: string
        password:
          type: string
          writeOnly: true
        tls_mode:
          enum:
            - starttls
            - implicit_tls
        sender_email:
          type: string
          format: email
        sender_name:
          type: string
          maxLength: 200
        inheritable:
          type: boolean
      additionalProperties: false
    TestNotificationProvider:
      type: object
      required:
        - recipient
      properties:
        recipient:
          type: string
          format: email
      additionalProperties: false
    UpdateBillingProvider:
      type: object
      minProperties: 1
      properties:
        secret:
          type: string
          writeOnly: true
        webhook_secret:
          type: string
          writeOnly: true
        metadata:
          type: object
          additionalProperties: true
        inheritable:
          type: boolean
      additionalProperties: false
    MembershipRole:
      type: object
      required:
        - role
      properties:
        role:
          enum:
            - owner
            - admin
            - member
            - auditor
      additionalProperties: false
    CreateApplicationDomain:
      type: object
      required:
        - hostname
      properties:
        hostname:
          type: string
          minLength: 1
          maxLength: 253
      additionalProperties: false
    CreateClient:
      type: object
      required:
        - client_id
        - name
        - client_type
      properties:
        initiate_login_uri: {type: string, maxLength: 2048}
        authorization_ui: {type: string, enum: [headless, hosted], default: headless}
        pkce_required: {type: boolean, default: true}
        client_id:
          type: string
          minLength: 1
          maxLength: 160
        name:
          type: string
          minLength: 1
          maxLength: 200
        client_type:
          enum:
            - public
            - confidential
        redirect_uris:
          type: array
          uniqueItems: true
          items:
            type: string
            format: uri
        allowed_grants:
          type: array
          uniqueItems: true
          items:
            enum:
              - authorization_code
              - refresh_token
              - client_credentials
        allowed_scopes:
          type: array
          uniqueItems: true
          items:
            type: string
      additionalProperties: false
    UpdateClient:
      type: object
      minProperties: 1
      properties:
        initiate_login_uri: {type: string, maxLength: 2048}
        authorization_ui: {type: string, enum: [headless, hosted]}
        pkce_required: {type: boolean}
        name:
          type: string
          minLength: 1
          maxLength: 200
        redirect_uris:
          type: array
          uniqueItems: true
          items:
            type: string
            format: uri
        allowed_grants:
          type: array
          uniqueItems: true
          items:
            enum:
              - authorization_code
              - refresh_token
              - client_credentials
        allowed_scopes:
          type: array
          uniqueItems: true
          items:
            type: string
      additionalProperties: false
    CreateWorkspace:
      type: object
      required:
        - key
        - name
      properties:
        key:
          type: string
          minLength: 1
          maxLength: 100
        name:
          type: string
          minLength: 1
          maxLength: 255
        owner_user_id:
          $ref: '#/components/schemas/UUID'
        metadata:
          type: object
          additionalProperties: true
      additionalProperties: false
    UpdateWorkspace:
      type: object
      minProperties: 1
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 255
        metadata:
          type: object
          additionalProperties: true
      additionalProperties: false
    ReplaceWorkspaceMemberRoles:
      type: object
      required:
        - role_keys
      properties:
        role_keys:
          type: array
          uniqueItems: true
          items:
            $ref: '#/components/schemas/RoleKey'
      additionalProperties: false
    CreateDelegation:
      type: object
      required:
        - user_id
        - reason
        - redirect_uri
        - permissions
      properties:
        user_id:
          $ref: '#/components/schemas/UUID'
        workspace_id:
          $ref: '#/components/schemas/UUID'
        reason:
          type: string
          minLength: 1
          maxLength: 500
        redirect_uri:
          type: string
          format: uri
        permissions:
          type: array
          minItems: 1
          maxItems: 200
          uniqueItems: true
          items:
            $ref: '#/components/schemas/PermissionKey'
        expires_in:
          type: integer
          format: int64
          minimum: 60
          maximum: 3600
      additionalProperties: false
    ExchangeDelegation:
      type: object
      required:
        - exchange_code
      properties:
        exchange_code:
          type: string
          minLength: 1
          writeOnly: true
      additionalProperties: false
    CreateUser:
      type: object
      required:
        - email
      properties:
        email:
          type: string
          format: email
        password:
          type: string
          minLength: 12
          maxLength: 1024
          writeOnly: true
        first_name:
          type: string
          maxLength: 200
        last_name:
          type: string
          maxLength: 200
        username:
          type:
            - string
            - 'null'
          maxLength: 200
        locale:
          $ref: '#/components/schemas/Locale'
        email_verified:
          type: boolean
        is_org_verified:
          type: boolean
        custom_attributes:
          type: object
          additionalProperties: true
      additionalProperties: false
    UpdateUser:
      type: object
      minProperties: 1
      properties:
        first_name:
          type: string
          maxLength: 200
        last_name:
          type: string
          maxLength: 200
        username:
          type:
            - string
            - 'null'
          maxLength: 200
        locale:
          $ref: '#/components/schemas/Locale'
        status:
          enum:
            - active
            - suspended
            - pending_deletion
        email_verified:
          type: boolean
        is_org_verified:
          type: boolean
        custom_attributes:
          type: object
          additionalProperties: true
        reason:
          type: string
          maxLength: 500
      additionalProperties: false
    AuditReason:
      type: object
      required:
        - reason
      properties:
        reason:
          type: string
          minLength: 1
          maxLength: 500
      additionalProperties: false
    PasswordResetStart:
      type: object
      required:
        - email
      properties:
        email:
          type: string
          format: email
      additionalProperties: false
    PasswordResetVerify:
      type: object
      required:
        - challenge_id
        - password
      properties:
        challenge_id:
          $ref: '#/components/schemas/UUID'
        code:
          type: string
          minLength: 8
          maxLength: 8
          writeOnly: true
        link_token:
          type: string
          writeOnly: true
        password:
          type: string
          minLength: 12
          maxLength: 1024
          writeOnly: true
      additionalProperties: false
    ExternalAuthStartRequest:
      type: object
      required:
        - redirect_uri
      properties:
        flow:
          enum:
            - sign_in
            - sign_up
            - automatic
            - link
          default: automatic
        redirect_uri:
          type: string
          format: uri
        login_hint:
          type: string
          format: email
        code_challenge:
          type: string
          minLength: 43
          maxLength: 43
          pattern: ^[A-Za-z0-9_-]{43}$
          writeOnly: true
      additionalProperties: false
    ExternalAuthExchange:
      type: object
      required:
        - exchange
      properties:
        exchange:
          type: string
          minLength: 1
          writeOnly: true
        code_verifier:
          type: string
          minLength: 43
          maxLength: 128
          pattern: ^[A-Za-z0-9._~-]{43,128}$
          writeOnly: true
      additionalProperties: false
    ExternalEmailEnrollmentStart:
      type: object
      required: [enrollment, email, code_verifier]
      properties:
        enrollment:
          type: string
          minLength: 1
          writeOnly: true
        email:
          type: string
          format: email
        delivery:
          enum: [code, link, both]
          default: both
        code_verifier:
          type: string
          minLength: 43
          maxLength: 128
          pattern: ^[A-Za-z0-9._~-]{43,128}$
          writeOnly: true
      additionalProperties: false
    ExternalEmailEnrollmentVerify:
      type: object
      required: [enrollment]
      oneOf:
        - required: [code]
        - required: [link_token]
      properties:
        enrollment:
          type: string
          minLength: 1
          writeOnly: true
        code:
          type: string
          minLength: 8
          maxLength: 8
          writeOnly: true
        link_token:
          type: string
          minLength: 1
          writeOnly: true
      additionalProperties: false
    ExternalEmailEnrollmentChallenge:
      type: object
      required: [challenge_id, provider, expires_in]
      properties:
        challenge_id:
          $ref: '#/components/schemas/UUID'
        provider:
          enum: [microsoft, facebook, linkedin]
        expires_in:
          type: integer
          minimum: 1
      additionalProperties: false
    VerifyMFA:
      type: object
      required:
        - challenge_id
      properties:
        challenge_id:
          $ref: '#/components/schemas/UUID'
        code:
          type: string
          writeOnly: true
        recovery_code:
          type: string
          writeOnly: true
      oneOf:
        - required:
            - code
        - required:
            - recovery_code
      additionalProperties: false
    BeginWebAuthnAuthentication:
      type: object
      required:
        - challenge_id
      properties:
        challenge_id:
          $ref: '#/components/schemas/UUID'
        origin:
          type: string
          format: uri
      additionalProperties: false
    BeginWebAuthnRegistration:
      type: object
      properties:
        origin:
          type: string
          format: uri
        label:
          type: string
          maxLength: 120
      additionalProperties: false
    FinishWebAuthnCeremony:
      type: object
      required:
        - ceremony_id
        - credential
      properties:
        ceremony_id:
          $ref: '#/components/schemas/UUID'
        credential:
          type: object
          additionalProperties: true
      additionalProperties: false
    CreateEntitlement:
      type: object
      description: Manual access without a charge or renewal. Omitted feature_values and configuration snapshot the selected price defaults, or product defaults when no price is selected. Explicit maps replace defaults; an empty object clears them. Catalog selections must be active. Expiry, when supplied, must be after the start time.
      required:
        - subject_type
        - subject_id
      properties:
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        product_id:
          $ref: '#/components/schemas/UUID'
        price_id:
          $ref: '#/components/schemas/UUID'
        feature_values:
          type: object
          additionalProperties: true
        configuration:
          type: object
          additionalProperties: true
        starts_at:
          type: string
          format: date-time
        expires_at:
          type: string
          format: date-time
        reason:
          type: string
          maxLength: 500
        external_reference:
          type: string
          minLength: 1
          maxLength: 255
      additionalProperties: false
    AdjustEntitlement:
      type: object
      properties:
        expires_at:
          type:
            - string
            - 'null'
          format: date-time
        reason:
          type: string
          maxLength: 500
      additionalProperties: false
    CreatePortalSession:
      type: object
      required:
        - provider_id
        - return_uri
      properties:
        provider_id:
          $ref: '#/components/schemas/UUID'
        subject_type:
          enum:
            - user
            - workspace
          default: user
        subject_id:
          $ref: '#/components/schemas/UUID'
        return_uri:
          type: string
          format: uri
      additionalProperties: false
    CancelSubscription:
      type: object
      properties:
        at_period_end:
          type: boolean
      additionalProperties: false
    ChangeSubscriptionPrice:
      type: object
      required:
        - price_id
      properties:
        price_id:
          $ref: '#/components/schemas/UUID'
        proration_behavior:
          enum:
            - create_prorations
            - always_invoice
            - none
          default: create_prorations
      additionalProperties: false
    CreateRefund:
      type: object
      properties:
        amount_minor:
          type: integer
          format: int64
          minimum: 1
        reason:
          type: string
          maxLength: 500
      additionalProperties: false
    AccountChallenge:
      type: object
      required:
        - challenge_id
      properties:
        challenge_id:
          $ref: '#/components/schemas/UUID'
        code:
          type: string
          minLength: 8
          maxLength: 8
          writeOnly: true
        link_token:
          type: string
          writeOnly: true
      additionalProperties: false
    EmailAddress:
      type: object
      required:
        - email
      properties:
        email:
          type: string
          format: email
      additionalProperties: false
    PasswordChange:
      type: object
      required:
        - current_password
        - new_password
      properties:
        current_password:
          type: string
          writeOnly: true
        new_password:
          type: string
          minLength: 12
          maxLength: 1024
          writeOnly: true
      additionalProperties: false
    StartTOTP:
      type: object
      properties:
        label:
          type: string
          maxLength: 120
      additionalProperties: false
    ActivateTOTP:
      type: object
      required:
        - code
      properties:
        code:
          type: string
          minLength: 6
          maxLength: 8
          writeOnly: true
      additionalProperties: false
    CreateAddress:
      type: object
      required:
        - name
        - line1
        - city
        - postal_code
        - country_code
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 200
        line1:
          type: string
          minLength: 1
          maxLength: 500
        line2:
          type: string
          maxLength: 500
        city:
          type: string
          minLength: 1
          maxLength: 200
        region:
          type: string
          maxLength: 200
        postal_code:
          type: string
          minLength: 1
          maxLength: 50
        country_code:
          type: string
          pattern: ^[A-Za-z]{2}$
        tax_id:
          type:
            - string
            - 'null'
          maxLength: 100
        active:
          type: boolean
          default: true
      additionalProperties: false
    UpdateAddress:
      type: object
      required:
        - version
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 200
        line1:
          type: string
          minLength: 1
          maxLength: 500
        line2:
          type: string
          maxLength: 500
        city:
          type: string
          minLength: 1
          maxLength: 200
        region:
          type: string
          maxLength: 200
        postal_code:
          type: string
          minLength: 1
          maxLength: 50
        country_code:
          type: string
          pattern: ^[A-Za-z]{2}$
        tax_id:
          type:
            - string
            - 'null'
          maxLength: 100
        version:
          type: integer
          format: int64
          minimum: 1
      additionalProperties: false
    UpdateBillingProfile:
      type: object
      required:
        - version
      properties:
        name:
          type: string
          maxLength: 200
        email:
          type: string
          format: email
        tax_id:
          type: string
          maxLength: 100
        version:
          type: integer
          format: int64
          minimum: 1
      additionalProperties: false
    PermissionCheck:
      type: object
      required:
        - permissions
      properties:
        permissions:
          type: array
          minItems: 1
          maxItems: 100
          uniqueItems: true
          items:
            $ref: '#/components/schemas/PermissionKey'
        workspace_id:
          $ref: '#/components/schemas/UUID'
      additionalProperties: false
    AuditExport:
      type: object
      properties:
        start:
          type: string
          format: date-time
        end:
          type: string
          format: date-time
        actor_type:
          enum:
            - control_user
            - user
            - client
            - system
        action:
          type: string
        target_type:
          type: string
      additionalProperties: false
    CreateWebhook:
      type: object
      required:
        - uri
      properties:
        uri:
          type: string
          format: uri
        event_filters:
          type: array
          uniqueItems: true
          items:
            type: string
      additionalProperties: false
    UpdateWebhook:
      type: object
      minProperties: 1
      properties:
        uri:
          type: string
          format: uri
        event_filters:
          type: array
          uniqueItems: true
          items:
            type: string
        enabled:
          type: boolean
      additionalProperties: false
    CreateSenderIdentity:
      type: object
      required:
        - provider_id
        - email
      properties:
        provider_id:
          $ref: '#/components/schemas/UUID'
        email:
          type: string
          format: email
        name:
          type: string
          maxLength: 200
        is_default:
          type: boolean
          default: false
      additionalProperties: false
    CreateNotificationTemplate:
      type: object
      required:
        - key
        - category
        - subject_template
        - text_template
      properties:
        key:
          type: string
          pattern: ^[a-z][a-z0-9_.-]{2,100}$
        locale:
          $ref: '#/components/schemas/Locale'
        category:
          enum:
            - security
            - billing
            - transactional
            - marketing
        subject_template:
          type: string
          minLength: 1
          maxLength: 500
        text_template:
          type: string
          minLength: 1
          maxLength: 100000
        html_template:
          type: string
          maxLength: 200000
        variable_schema:
          type: object
          additionalProperties: true
      additionalProperties: false
    UpdateNotificationTemplate:
      type: object
      minProperties: 1
      properties:
        category:
          enum:
            - security
            - billing
            - transactional
            - marketing
        subject_template:
          type: string
          minLength: 1
          maxLength: 500
        text_template:
          type: string
          minLength: 1
          maxLength: 100000
        html_template:
          type: string
          maxLength: 200000
        variable_schema:
          type: object
          additionalProperties: true
      additionalProperties: false
    PreviewNotificationTemplate:
      type: object
      required:
        - variables
      properties:
        variables:
          type: object
          additionalProperties: true
        user_id:
          $ref: '#/components/schemas/UUID'
        recipient:
          type: string
          format: email
      additionalProperties: false
    UpdateNotificationPreference:
      type: object
      required:
        - email_enabled
      properties:
        email_enabled:
          type: boolean
      additionalProperties: false
    UpdateStorageProvider:
      type: object
      minProperties: 1
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 200
        endpoint:
          type: string
          format: uri
          maxLength: 2000
        region:
          type: string
          minLength: 1
          maxLength: 100
        access_key_id:
          type: string
          minLength: 1
          writeOnly: true
        secret_access_key:
          type: string
          minLength: 1
          writeOnly: true
        force_path_style:
          type: boolean
        public_bucket:
          type: string
        private_bucket:
          type: string
        public_base_url:
          type: string
          format: uri
        inheritable:
          type: boolean
        allow_private_endpoint:
          type: boolean
        max_object_bytes:
          type: integer
          format: int64
          minimum: 1
        max_email_image_bytes:
          type: integer
          format: int64
          minimum: 1
        max_application_bytes:
          type: integer
          format: int64
          minimum: 1
        max_application_objects:
          type: integer
          format: int64
          minimum: 1
      additionalProperties: false
    ManagementAPIStatus:
      type: object
      required:
        - enabled
        - can_manage
        - active_clients
        - token_endpoint
        - api_base
      properties:
        enabled:
          type: boolean
        can_manage:
          type: boolean
        active_clients:
          type: integer
          minimum: 0
        token_endpoint:
          type: string
          format: uri
        api_base:
          type: string
          format: uri
      additionalProperties: false
    CreateManagementClient:
      type: object
      required:
        - client_id
        - name
      properties:
        client_id:
          type: string
          minLength: 1
          maxLength: 160
        name:
          type: string
          minLength: 1
          maxLength: 200
        allowed_scopes:
          type: array
          items:
            type: string
            const: /management/organizations/*
          default:
            - /management/organizations/*
      additionalProperties: false
    OrganizationEnabledSettings:
      type: object
      required:
        - public_registration
        - password_authentication
        - passwordless_authentication
        - personal_api_keys
        - delegation
        - organization_provider_overrides
        - application_provider_overrides
        - custom_events
        - webhooks
      properties:
        public_registration:
          type: boolean
        password_authentication:
          type: boolean
        passwordless_authentication:
          type: boolean
        personal_api_keys:
          type: boolean
        delegation:
          type: boolean
        organization_provider_overrides:
          type: boolean
        application_provider_overrides:
          type: boolean
        custom_events:
          type: boolean
        webhooks:
          type: boolean
      additionalProperties: false
    UpdateOrganizationPolicy:
      type: object
      required:
        - max_applications
        - max_users
        - enabled_settings
      properties:
        max_applications:
          type:
            - integer
            - 'null'
          minimum: 0
          description: Null means unlimited.
        max_users:
          type:
            - integer
            - 'null'
          minimum: 0
          description: Null means unlimited across all applications in the organization.
        enabled_settings:
          $ref: '#/components/schemas/OrganizationEnabledSettings'
      additionalProperties: false
    OrganizationPolicy:
      type: object
      required:
        - max_applications
        - max_users
        - enabled_settings
        - organization_id
        - usage
        - version
      properties:
        max_applications:
          type:
            - integer
            - 'null'
          minimum: 0
          description: Null means unlimited.
        max_users:
          type:
            - integer
            - 'null'
          minimum: 0
          description: Null means unlimited across all applications in the organization.
        enabled_settings:
          $ref: '#/components/schemas/OrganizationEnabledSettings'
        organization_id:
          $ref: '#/components/schemas/UUID'
        usage:
          type: object
          required:
            - applications
            - users
          properties:
            applications:
              type: integer
              minimum: 0
            users:
              type: integer
              minimum: 0
          additionalProperties: false
        version:
          type: integer
          format: int64
          minimum: 1
      additionalProperties: false
    UUID:
      type: string
      format: uuid
    CreateStorageProvider:
      type: object
      required:
        - name
        - endpoint
        - region
        - access_key_id
        - secret_access_key
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 200
        endpoint:
          type: string
          format: uri
          maxLength: 2000
        region:
          type: string
          minLength: 1
          maxLength: 100
        access_key_id:
          type: string
          minLength: 1
          writeOnly: true
        secret_access_key:
          type: string
          minLength: 1
          writeOnly: true
        force_path_style:
          type: boolean
          default: false
        public_bucket:
          type: string
          minLength: 1
        private_bucket:
          type: string
          minLength: 1
        public_base_url:
          type: string
          format: uri
        inheritable:
          type: boolean
          default: false
        allow_private_endpoint:
          type: boolean
          default: false
          description: Installation-scoped opt-in for local or private-network S3 endpoints.
        max_object_bytes:
          type: integer
          format: int64
          minimum: 1
          default: 26214400
        max_email_image_bytes:
          type: integer
          format: int64
          minimum: 1
          default: 2097152
        max_application_bytes:
          type: integer
          format: int64
          minimum: 1
          default: 10737418240
        max_application_objects:
          type: integer
          format: int64
          minimum: 1
          default: 100000
      anyOf:
        - required:
            - public_bucket
        - required:
            - private_bucket
      additionalProperties: false
    CreateStorageUpload:
      type: object
      required:
        - filename
        - content_type
        - size_bytes
        - visibility
      properties:
        filename:
          type: string
          minLength: 1
          maxLength: 500
        content_type:
          type: string
          minLength: 1
          maxLength: 255
        size_bytes:
          type: integer
          format: int64
          minimum: 1
        visibility:
          enum:
            - public
            - private
        purpose:
          enum:
            - email_image
        metadata:
          type: object
          additionalProperties: true
      additionalProperties: false
    StorageObject:
      type: object
      required:
        - id
        - provider_id
        - owner_type
        - visibility
        - filename
        - content_type
        - size_bytes
        - metadata
        - status
        - version
        - created_at
        - updated_at
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        application_id:
          type:
            - string
            - 'null'
          format: uuid
        provider_id:
          $ref: '#/components/schemas/UUID'
        owner_type:
          enum:
            - installation
            - application
            - user
            - workspace
        owner_id:
          type:
            - string
            - 'null'
          format: uuid
        visibility:
          enum:
            - public
            - private
        filename:
          type: string
        content_type:
          type: string
        size_bytes:
          type: integer
          format: int64
        etag:
          type:
            - string
            - 'null'
        metadata:
          type: object
          additionalProperties: true
        status:
          enum:
            - pending
            - ready
            - deleting
            - failed
        public_url:
          type:
            - string
            - 'null'
          format: uri
        upload_expires_at:
          type:
            - string
            - 'null'
          format: date-time
        ready_at:
          type:
            - string
            - 'null'
          format: date-time
        last_error:
          type:
            - string
            - 'null'
        version:
          type: integer
          format: int64
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    StorageUploadAuthorization:
      type: object
      required:
        - object
        - upload_url
        - upload_expires_at
        - required_headers
      properties:
        object:
          $ref: '#/components/schemas/StorageObject'
        upload_url:
          type: string
          format: uri
          writeOnly: true
        upload_expires_at:
          type: string
          format: date-time
        required_headers:
          type: object
          additionalProperties:
            type: string
      additionalProperties: false
    RuntimeStorageConfig:
      type: object
      required:
        - public_uploads_enabled
        - private_uploads_enabled
      properties:
        public_uploads_enabled:
          type: boolean
        private_uploads_enabled:
          type: boolean
        max_public_object_bytes:
          type: integer
          format: int64
        max_private_object_bytes:
          type: integer
          format: int64
        max_email_image_bytes:
          type: integer
          format: int64
        public_provider_scope:
          enum:
            - installation
            - organization
            - application
        private_provider_scope:
          enum:
            - installation
            - organization
            - application
      additionalProperties: false
    Locale:
      type: string
      maxLength: 35
      description: Canonical BCP 47 language tag such as en, de-CH, or pt-BR. Empty means no user preference.
    Problem:
      type: object
      required:
        - type
        - title
        - status
        - code
      properties:
        type:
          type: string
          format: uri-reference
        title:
          type: string
        status:
          type: integer
        detail:
          type: string
        code:
          type: string
        request_id:
          type: string
        affected_users:
          type: integer
          minimum: 0
      additionalProperties: false
    OrganizationPage:
      type: object
      required:
        - items
        - next_cursor
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Organization'
        next_cursor:
          type:
            - string
            - 'null'
        installation_role:
          type:
            - string
            - 'null'
          enum:
            - owner
            - admin
            - auditor
            - null
          description: The current Platform user's installation-wide role, or null for organization-only access.
      additionalProperties: false
    BootstrapRequest:
      type: object
      required:
        - credential
        - email
      properties:
        credential:
          type: string
          writeOnly: true
        email:
          type: string
          format: email
        display_name:
          type: string
      additionalProperties: false
    AcceptControlUserInvitation:
      type: object
      required:
        - invitation_token
      properties:
        invitation_token:
          type: string
          minLength: 1
          writeOnly: true
        display_name:
          type: string
          maxLength: 200
      additionalProperties: false
    CreateControlUserInvitation:
      type: object
      required:
        - email
        - role
      properties:
        email:
          type: string
          format: email
        role:
          enum:
            - owner
            - admin
            - member
            - auditor
        onboarding_method:
          enum:
            - email
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
          default: email
        expires_in:
          type: integer
          minimum: 300
          maximum: 2592000
      additionalProperties: false
    ControlAuthPolicy:
      type: object
      required:
        - email_code_enabled
        - magic_link_enabled
        - password_enabled
      properties:
        email_code_enabled:
          type: boolean
        magic_link_enabled:
          type: boolean
        password_enabled:
          type: boolean
      additionalProperties: false
    UpdateControlAuthPolicy:
      type: object
      required:
        - email_code_enabled
        - magic_link_enabled
        - password_enabled
      properties:
        email_code_enabled:
          type: boolean
        magic_link_enabled:
          type: boolean
        password_enabled:
          type: boolean
        confirm_affected_users:
          type: boolean
      additionalProperties: false
    ControlAuthMethods:
      type: object
      required:
        - email_code
        - magic_link
        - password
        - providers
      properties:
        email_code:
          type: boolean
        magic_link:
          type: boolean
        password:
          type: boolean
        providers:
          type: array
          items:
            enum:
              - google
              - apple
              - microsoft
              - facebook
              - linkedin
      additionalProperties: false
    ExternalAuthStart:
      type: object
      required:
        - provider
        - authorize_url
        - expires_in
      properties:
        provider:
          enum:
            - google
            - apple
            - microsoft
            - facebook
            - linkedin
        authorize_url:
          type: string
          format: uri
        expires_in:
          type: integer
      additionalProperties: false
    UpdateInstallationAuthProvider:
      type: object
      properties:
        inheritable:
          type: boolean
        control_login_enabled:
          type: boolean
        confirm_affected_users:
          type: boolean
      minProperties: 1
      additionalProperties: false
    ApplicationFlowConfig:
      type: object
      required:
        - oauth_client_id
        - sign_in_redirect_uri
        - invitation_redirect_uri
      additionalProperties: false
      properties:
        oauth_client_id:
          type: string
          minLength: 1
        sign_in_redirect_uri:
          type: string
          format: uri
          description: Exact registered HTTPS, loopback HTTP, or public-client native application redirect URI.
        invitation_redirect_uri:
          type: string
          format: uri
          description: Invitation destination using the same origin or native scheme authority as the sign-in redirect.
    ApplicationAuthConfig:
      type: object
      additionalProperties: false
      properties:
        flows:
          $ref: '#/components/schemas/ApplicationFlowConfig'
    ApplicationInternalConfig:
      type: object
      additionalProperties: false
      properties:
        registration_mode:
          type: string
          enum:
            - public
            - invite_only
        password_enabled:
          type: boolean
        passwordless_enabled:
          type: boolean
        personal_api_keys_enabled:
          type: boolean
        delegation_enabled:
          type: boolean
        user_invitations_enabled:
          type: boolean
          default: false
        custom_token_claim_keys:
          type: array
          maxItems: 32
          items:
            type: string
            minLength: 1
            maxLength: 64
            pattern: ^[A-Za-z0-9_.-]+$
    RuntimeAuthConfig:
      type: object
      required:
        - registration_mode
        - registration_enabled
        - password_enabled
        - passwordless_enabled
      additionalProperties: false
      properties:
        registration_mode:
          type: string
          enum:
            - public
            - invite_only
        registration_enabled:
          type: boolean
        password_enabled:
          type: boolean
        passwordless_enabled:
          type: boolean
        flows:
          $ref: '#/components/schemas/ApplicationFlowConfig'
    RuntimeConfig:
      type: object
      required:
        - schema_version
        - api_base
        - issuer
        - application_id
        - public_config
        - auth
        - storage
      properties:
        schema_version:
          type: string
        api_base:
          type: string
          format: uri
        issuer:
          type: string
          format: uri
        application_id:
          $ref: '#/components/schemas/UUID'
        public_config:
          type: object
          additionalProperties: true
        auth:
          $ref: '#/components/schemas/RuntimeAuthConfig'
        storage:
          $ref: '#/components/schemas/RuntimeStorageConfig'
      additionalProperties: false
    PasswordSignIn:
      type: object
      required:
        - email
        - password
      properties:
        email:
          type: string
          format: email
        password:
          type: string
          writeOnly: true
          minLength: 12
          maxLength: 1024
      additionalProperties: false
    PasswordSignUp:
      type: object
      required:
        - email
        - password
      properties:
        email:
          type: string
          format: email
        password:
          type: string
          writeOnly: true
          minLength: 12
          maxLength: 1024
        first_name:
          type: string
        last_name:
          type: string
        locale:
          $ref: '#/components/schemas/Locale'
      additionalProperties: false
    EmailStart:
      type: object
      required:
        - email
        - intent
        - delivery
      properties:
        email:
          type: string
          format: email
        intent:
          enum:
            - sign_in
            - sign_up
            - automatic
        delivery:
          enum:
            - code
            - link
            - both
        redirect_uri:
          type: string
          format: uri
      additionalProperties: false
    EmailVerify:
      type: object
      required:
        - challenge_id
      properties:
        challenge_id:
          $ref: '#/components/schemas/UUID'
        code:
          type: string
          minLength: 8
          maxLength: 8
          writeOnly: true
        link_token:
          type: string
          writeOnly: true
      additionalProperties: false
    TokenResponse:
      type: object
      required:
        - access_token
        - refresh_token
        - token_type
        - expires_in
      properties:
        access_token:
          type: string
          writeOnly: true
        refresh_token:
          type: string
          writeOnly: true
        token_type:
          const: Bearer
        expires_in:
          type: integer
      additionalProperties: false
    User:
      type: object
      required:
        - id
        - application_id
        - email
        - locale
        - email_verified
        - is_org_verified
        - status
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        application_id:
          $ref: '#/components/schemas/UUID'
        email:
          type: string
          format: email
        first_name:
          type: string
        last_name:
          type: string
        username:
          type:
            - string
            - 'null'
        locale:
          $ref: '#/components/schemas/Locale'
        email_verified:
          type: boolean
        is_org_verified:
          type: boolean
        status:
          enum:
            - active
            - suspended
            - pending_deletion
            - anonymized
            - deleted
        custom_attributes:
          type: object
          additionalProperties: true
        version:
          type: integer
          format: int64
      additionalProperties: false
    UpdateUserProfile:
      type: object
      properties:
        first_name:
          type: string
        last_name:
          type: string
        username:
          type:
            - string
            - 'null'
        locale:
          $ref: '#/components/schemas/Locale'
      additionalProperties: false
    QueueNotification:
      type: object
      required:
        - template_key
      properties:
        template_key:
          type: string
          minLength: 3
          maxLength: 101
        locale:
          $ref: '#/components/schemas/Locale'
          description: Explicit locale override. When omitted
          the selected user's locale is used.: null
        recipient:
          type: string
          format: email
        user_id:
          $ref: '#/components/schemas/UUID'
        variables:
          type: object
          additionalProperties: true
        attachments:
          type: array
          items:
            type: object
            required:
              - filename
              - content_type
              - content_base64
            properties:
              filename:
                type: string
              content_type:
                type: string
              content_base64:
                type: string
                format: byte
            additionalProperties: false
      additionalProperties: false
    QueuedNotification:
      type: object
      required:
        - id
        - status
        - requested_locale
        - resolved_locale
        - fallback_used
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        status:
          enum:
            - queued
            - suppressed
        requested_locale:
          $ref: '#/components/schemas/Locale'
        resolved_locale:
          $ref: '#/components/schemas/Locale'
        fallback_used:
          type: boolean
      additionalProperties: false
    CreateInvitation:
      type: object
      required:
        - email
      properties:
        hosted_client_id: {$ref: '#/components/schemas/UUID'}
        hosted_redirect_uri: {type: string, format: uri}
        email:
          type: string
          format: email
        workspace_id:
          $ref: '#/components/schemas/UUID'
        application_role_keys:
          type: array
          items:
            type: string
          maxItems: 20
        workspace_role_keys:
          type: array
          items:
            type: string
          maxItems: 20
        onboarding_method:
          enum: [email, google, apple, microsoft, facebook, linkedin]
          default: email
        expires_in:
          type: integer
          format: int64
          minimum: 300
          maximum: 2592000
          default: 604800
      additionalProperties: false
    ExchangeInvitation:
      type: object
      required:
        - code_challenge
      oneOf:
        - required:
            - email
            - code
        - required:
            - invitation_id
            - link_token
      properties:
        invitation_id:
          $ref: '#/components/schemas/UUID'
        email:
          type: string
          format: email
        code:
          type: string
          minLength: 8
          maxLength: 8
          pattern: ^[ABCDEFGHJKLMNPQRSTUVWXYZ23456789]{8}$
          writeOnly: true
        link_token:
          type: string
          writeOnly: true
        code_challenge:
          type: string
          minLength: 43
          maxLength: 43
          pattern: ^[A-Za-z0-9_-]{43}$
          writeOnly: true
      additionalProperties: false
    RedeemInvitation:
      type: object
      required:
        - authorization_code
        - code_verifier
      properties:
        authorization_code:
          type: string
          writeOnly: true
        code_verifier:
          type: string
          minLength: 43
          maxLength: 128
          pattern: ^[A-Za-z0-9._~-]{43,128}$
          writeOnly: true
      additionalProperties: false
    RoleAssignment:
      type: object
      required:
        - role_id
      oneOf:
        - required:
            - user_id
        - required:
            - client_id
      properties:
        user_id:
          $ref: '#/components/schemas/UUID'
        client_id:
          $ref: '#/components/schemas/UUID'
        role_id:
          $ref: '#/components/schemas/UUID'
        workspace_id:
          $ref: '#/components/schemas/UUID'
      additionalProperties: false
    PermissionKey:
      type: string
      minLength: 1
      maxLength: 160
      pattern: ^(\*|[a-z0-9][a-z0-9._-]{0,63}(:[a-z0-9][a-z0-9._-]{0,63})*(:\*)?)$
    RoleKey:
      type: string
      minLength: 1
      maxLength: 63
      pattern: ^[a-z][a-z0-9_-]{0,62}$
    CreateRole:
      type: object
      required:
        - key
        - name
        - scope
        - permissions
      properties:
        key:
          $ref: '#/components/schemas/RoleKey'
        name:
          type: string
          minLength: 1
          maxLength: 255
        scope:
          type: string
          enum:
            - application
            - workspace
        permissions:
          type: array
          minItems: 1
          maxItems: 200
          uniqueItems: true
          items:
            $ref: '#/components/schemas/PermissionKey'
      additionalProperties: false
    UpdateRole:
      type: object
      minProperties: 1
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 255
        permissions:
          type: array
          minItems: 1
          maxItems: 200
          uniqueItems: true
          items:
            $ref: '#/components/schemas/PermissionKey'
      additionalProperties: false
    Role:
      type: object
      required:
        - key
        - name
        - scope
        - permissions
        - id
        - built_in
        - version
      properties:
        key:
          $ref: '#/components/schemas/RoleKey'
        name:
          type: string
          minLength: 1
          maxLength: 255
        scope:
          type: string
          enum:
            - application
            - workspace
        permissions:
          type: array
          minItems: 1
          maxItems: 200
          uniqueItems: true
          items:
            $ref: '#/components/schemas/PermissionKey'
        id:
          $ref: '#/components/schemas/UUID'
        built_in:
          type: boolean
        version:
          type: integer
          format: int64
          minimum: 1
      additionalProperties: false
    StructuredRoles:
      type: object
      required:
        - application
        - workspaces
      properties:
        application:
          type: array
          uniqueItems: true
          items:
            $ref: '#/components/schemas/RoleKey'
        workspaces:
          type: object
          additionalProperties:
            type: array
            uniqueItems: true
            items:
              $ref: '#/components/schemas/RoleKey'
      additionalProperties: false
    CreatePermissionGrant:
      type: object
      required:
        - subject_type
        - subject_id
        - permission
      properties:
        subject_type:
          type: string
          enum:
            - user
            - client
        subject_id:
          $ref: '#/components/schemas/UUID'
        workspace_id:
          $ref: '#/components/schemas/UUID'
        permission:
          $ref: '#/components/schemas/PermissionKey'
        reason:
          type: string
          maxLength: 500
      additionalProperties: false
    PermissionGrant:
      type: object
      required:
        - subject_type
        - subject_id
        - permission
        - id
        - application_id
        - canonical_scope
        - status
        - version
        - created_at
      properties:
        subject_type:
          type: string
          enum:
            - user
            - client
        subject_id:
          $ref: '#/components/schemas/UUID'
        workspace_id:
          $ref: '#/components/schemas/UUID'
        permission:
          $ref: '#/components/schemas/PermissionKey'
        reason:
          type: string
          maxLength: 500
        id:
          $ref: '#/components/schemas/UUID'
        application_id:
          $ref: '#/components/schemas/UUID'
        canonical_scope:
          type: string
        status:
          type: string
          enum:
            - active
            - revoked
        version:
          type: integer
          format: int64
          minimum: 1
        created_at:
          type: string
          format: date-time
        revoked_at:
          type:
            - string
            - 'null'
          format: date-time
      additionalProperties: false
    EffectiveAccess:
      type: object
      required:
        - subject_type
        - subject_id
        - roles
        - scopes
        - provenance
      properties:
        subject_type:
          type: string
          enum:
            - user
            - client
        subject_id:
          $ref: '#/components/schemas/UUID'
        roles:
          $ref: '#/components/schemas/StructuredRoles'
        scopes:
          type: array
          uniqueItems: true
          items:
            type: string
        provenance:
          type: array
          items:
            type: object
            required:
              - scope
              - source
            properties:
              scope:
                type: string
              source:
                type: string
                enum:
                  - role_marker
                  - role
                  - direct
                  - workspace_owner
              role_key:
                $ref: '#/components/schemas/RoleKey'
              grant_id:
                $ref: '#/components/schemas/UUID'
              workspace_id:
                $ref: '#/components/schemas/UUID'
              permission:
                $ref: '#/components/schemas/PermissionKey'
            additionalProperties: false
      additionalProperties: false
    OwnershipTransfer:
      type: object
      required:
        - new_owner_user_id
      properties:
        new_owner_user_id:
          $ref: '#/components/schemas/UUID'
        previous_owner_disposition:
          enum:
            - member
            - remove
          default: member
      additionalProperties: false
    OwnershipTransferResult:
      type: object
      required:
        - workspace_id
        - owner_user_id
        - previous_owner_user_id
        - previous_owner_disposition
      properties:
        workspace_id:
          $ref: '#/components/schemas/UUID'
        owner_user_id:
          $ref: '#/components/schemas/UUID'
        previous_owner_user_id:
          $ref: '#/components/schemas/UUID'
        previous_owner_disposition:
          enum:
            - member
            - remove
      additionalProperties: false
    ControlUserPasswordLogin:
      type: object
      required:
        - email
        - password
      properties:
        email:
          type: string
          format: email
        password:
          type: string
          minLength: 12
          maxLength: 1024
          writeOnly: true
      additionalProperties: false
    ControlUserPasswordChange:
      type: object
      required:
        - new_password
      properties:
        current_password:
          type: string
          maxLength: 1024
          writeOnly: true
        new_password:
          type: string
          minLength: 12
          maxLength: 1024
          writeOnly: true
      additionalProperties: false
    CreateEventType:
      type: object
      required:
        - name
        - data_schema
        - example_subject
        - example_data
      properties:
        name:
          type: string
          pattern: ^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)+$
          maxLength: 160
        description:
          type: string
          maxLength: 500
        schema_version:
          type: string
          pattern: ^[1-9][0-9]*\.[0-9]+$
          default: '1.0'
        data_schema:
          type: object
          additionalProperties: true
          description: JSON Schema 2020-12 with an object root.
        example_subject:
          type: string
          minLength: 1
          maxLength: 500
        example_data:
          type: object
          additionalProperties: true
          description: Must validate against data_schema.
      additionalProperties: false
    UpdateEventType:
      type: object
      properties:
        description:
          type: string
          maxLength: 500
        schema_version:
          type: string
          pattern: ^[1-9][0-9]*\.[0-9]+$
        data_schema:
          type: object
          additionalProperties: true
        example_subject:
          type: string
          minLength: 1
          maxLength: 500
        example_data:
          type: object
          additionalProperties: true
        status:
          enum:
            - active
            - archived
      additionalProperties: false
    EventEnvelope:
      type: object
      required:
        - specversion
        - id
        - source
        - type
        - contract_source
        - time
        - application_id
        - schema_version
        - data
      properties:
        specversion:
          type: string
          const: '1.0'
        id:
          $ref: '#/components/schemas/UUID'
        source:
          type: string
          format: uri
        type:
          type: string
        contract_source:
          type: string
          enum:
            - platform93
            - application
        time:
          type: string
          format: date-time
        application_id:
          $ref: '#/components/schemas/UUID'
        schema_version:
          type: string
          pattern: ^[1-9][0-9]*\.[0-9]+$
        subject:
          type:
            - string
            - 'null'
        actor:
          type:
            - object
            - 'null'
          additionalProperties: true
        correlation_id:
          type:
            - string
            - 'null'
          format: uuid
        causation_id:
          type:
            - string
            - 'null'
          format: uuid
        data:
          type: object
          additionalProperties: true
      additionalProperties: false
    EventTypeDefinition:
      type: object
      required:
        - id
        - name
        - description
        - schema_version
        - data_schema
        - example_subject
        - example_data
        - example_event
        - source
        - status
        - version
      properties:
        id:
          $ref: '#/components/schemas/UUID'
        name:
          type: string
        description:
          type: string
        schema_version:
          type: string
        data_schema:
          type: object
          additionalProperties: true
        example_subject:
          type: string
        example_data:
          type: object
          additionalProperties: true
        example_event:
          $ref: '#/components/schemas/EventEnvelope'
        source:
          type: string
          enum:
            - platform93
            - application
        status:
          type: string
          enum:
            - active
            - archived
        version:
          type: integer
          format: int64
        event_count:
          type: integer
          format: int64
        last_occurred_at:
          type:
            - string
            - 'null'
          format: date-time
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      additionalProperties: false
    PublishCustomEvent:
      type: object
      required:
        - type
        - subject
        - data
      properties:
        type:
          type: string
          pattern: ^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)+$
          maxLength: 160
        subject:
          type: string
          minLength: 1
          maxLength: 500
        data:
          type: object
          additionalProperties: true
        correlation_id:
          $ref: '#/components/schemas/UUID'
        causation_id:
          $ref: '#/components/schemas/UUID'
      additionalProperties: false
    CreatePersonalAPIKey:
      type: object
      properties:
        label:
          type: string
          maxLength: 255
        expires_in_days:
          type: integer
          minimum: 1
          maximum: 366
          default: 365
        scopes:
          type: array
          items:
            type: string
      additionalProperties: false
    CreateFeature:
      type: object
      required:
        - key
        - name
        - value_type
      properties:
        key:
          type: string
          minLength: 1
        name:
          type: string
          minLength: 1
        value_type:
          type: string
          enum:
            - boolean
            - quantity
            - free_form
        free_form_format:
          type: string
          enum:
            - text
            - csv
            - json
          description: Required when value_type is free_form and forbidden otherwise.
        metadata:
          type: object
          additionalProperties: true
      additionalProperties: false
    FeatureValue:
      type: object
      required:
        - feature_id
      properties:
        feature_id:
          $ref: '#/components/schemas/UUID'
        boolean_value:
          type: boolean
        quantity_value:
          type: integer
          minimum: 0
        free_form_value:
          description: A string for text or CSV features, or any valid JSON value for JSON features.
      additionalProperties: false
    CatalogFeatureSnapshot:
      type: object
      required: [feature_id]
      properties:
        feature_id:
          $ref: '#/components/schemas/UUID'
        key:
          type: string
        name:
          type: string
        value_type:
          type: string
          enum: [boolean, quantity, free_form]
        free_form_format:
          type: [string, 'null']
          enum: [text, csv, json, null]
        boolean_value:
          type: boolean
        quantity_value:
          type: integer
          format: int64
        free_form_value:
          description: The stored JSON feature value.
        value:
          description: The effective typed feature value.
      additionalProperties: false
    CreateProduct:
      type: object
      required:
        - key
        - name
      properties:
        key:
          type: string
        name:
          type: string
        description:
          type: string
        listable:
          type: boolean
          default: true
        status:
          enum:
            - draft
            - active
            - archived
        metadata:
          type: object
        entitlement_config:
          type: object
          additionalProperties: true
        features:
          type: array
          items:
            $ref: '#/components/schemas/FeatureValue'
      additionalProperties: false
    UpdateProduct:
      type: object
      properties:
        name:
          type: string
        description:
          type: string
        listable:
          type: boolean
        status:
          enum:
            - draft
            - active
            - archived
        metadata:
          type: object
        entitlement_config:
          type: object
          additionalProperties: true
        features:
          type: array
          items:
            $ref: '#/components/schemas/FeatureValue'
      additionalProperties: false
    CreatePrice:
      type: object
      required:
        - key
        - mode
        - amount_minor
        - currency
      properties:
        key:
          type: string
        mode:
          enum:
            - recurring
            - one_time
            - local
        amount_minor:
          type: integer
          minimum: 0
        currency:
          type: string
          minLength: 3
          maxLength: 3
        currency_exponent:
          type: integer
          default: 2
          minimum: 0
          maximum: 6
        interval_unit:
          enum:
            - day
            - week
            - month
            - year
        interval_count:
          type: integer
          minimum: 1
        validity_seconds:
          type: integer
          minimum: 1
        grace_seconds:
          type: integer
          minimum: 0
        tax_behavior:
          enum:
            - inclusive
            - exclusive
            - unspecified
        checkout_config:
          type: object
        entitlement_config:
          type: object
          additionalProperties: true
        features:
          type: array
          items:
            $ref: '#/components/schemas/FeatureValue'
      additionalProperties: false
    LocalCheckout:
      type: object
      required:
        - price_id
      properties:
        price_id:
          $ref: '#/components/schemas/UUID'
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        address_id:
          $ref: '#/components/schemas/UUID'
        external_reference:
          type: string
          minLength: 1
          maxLength: 255
      additionalProperties: false
    CreateBillingProvider:
      type: object
      required:
        - provider
        - secret
      properties:
        provider:
          const: stripe
        secret:
          type: string
          writeOnly: true
        webhook_secret:
          type: string
          writeOnly: true
        api_version:
          const: 2026-04-22.dahlia
        inheritable:
          type: boolean
          default: false
      additionalProperties: false
    CreateCheckout:
      type: object
      required:
        - price_id
        - success_uri
        - cancel_uri
      properties:
        price_id:
          $ref: '#/components/schemas/UUID'
        provider_id:
          $ref: '#/components/schemas/UUID'
          description: Optional provider pin; omission resolves the effective application
          organization: null
          or installation provider.: null
        subject_type:
          enum:
            - user
            - workspace
        subject_id:
          $ref: '#/components/schemas/UUID'
        payment_methods:
          type: array
          items:
            enum:
              - card
              - twint
        success_uri:
          type: string
          format: uri
        cancel_uri:
          type: string
          format: uri
        external_reference:
          type: string
          minLength: 1
          maxLength: 255
      additionalProperties: false