openapi: 3.0.0
info:
title: 'VerifyWise API'
description: 'AI Governance Platform API'
version: 2.0.0
servers:
-
url: /api
description: 'Main API server'
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
parameters:
ProjectId:
name: id
in: path
required: true
description: 'The numeric project ID'
schema:
type: integer
example: 1
PolicyId:
name: id
in: path
required: true
description: 'Numeric ID of the policy'
schema:
type: integer
example: 42
schemas:
Error:
type: object
properties:
data:
type: string
AiRiskClassification:
type: string
enum:
- Prohibited
- 'High risk'
- 'Limited risk'
- 'Minimal risk'
- GPAI
- 'General Risk'
- 'Out of scope'
description: 'EU AI Act risk classification level'
HighRiskRole:
type: string
enum:
- Deployer
- Provider
description: 'Role of the organization under the EU AI Act for high-risk systems'
ProjectStatus:
type: string
enum:
- 'Not started'
- 'In progress'
- 'Under review'
- Completed
- Closed
- 'On hold'
- Rejected
description: 'Current lifecycle status of the project'
CreateProjectRequest:
type: object
required:
- project_title
- owner
- start_date
- framework
properties:
project_title:
type: string
example: 'Customer Support Chatbot'
owner:
type: integer
example: 1
start_date:
type: string
format: date-time
example: '2026-01-15T00:00:00.000Z'
geography:
type: integer
default: 1
example: 1
ai_risk_classification:
$ref: '#/components/schemas/AiRiskClassification'
high_risk_roles:
type: array
nullable: true
items:
$ref: '#/components/schemas/HighRiskRole'
description: 'EU AI Act roles of the use case: Provider, Deployer or both. Replaces the stored list; duplicates are removed and the list is stored as Provider, Deployer. null or [] clears it.'
example:
- Provider
- Deployer
type_of_high_risk_role:
deprecated: true
nullable: true
description: 'Deprecated: use high_risk_roles. A role already in the use case''s list leaves the list unchanged; another role replaces the list with that one role; null clears it. Rejected with 400 when sent with a high_risk_roles list it does not match.'
allOf:
-
$ref: '#/components/schemas/HighRiskRole'
goal:
type: string
nullable: true
example: 'Automate tier-1 support queries'
target_industry:
type: string
nullable: true
example: 'Financial Services'
description:
type: string
nullable: true
example: 'An LLM-powered chatbot for handling customer inquiries'
status:
$ref: '#/components/schemas/ProjectStatus'
is_organizational:
type: boolean
default: false
members:
type: array
items:
type: integer
example:
- 2
- 3
- 5
framework:
type: array
items:
type: integer
example:
- 1
- 2
approval_workflow_id:
type: integer
nullable: true
example: null
enable_ai_data_insertion:
type: boolean
default: false
UpdateProjectRequest:
type: object
properties:
project_title:
type: string
owner:
type: integer
start_date:
type: string
format: date-time
geography:
type: integer
ai_risk_classification:
$ref: '#/components/schemas/AiRiskClassification'
high_risk_roles:
type: array
nullable: true
items:
$ref: '#/components/schemas/HighRiskRole'
description: 'EU AI Act roles of the use case: Provider, Deployer or both. Replaces the stored list; duplicates are removed and the list is stored as Provider, Deployer. null or [] clears it.'
example:
- Provider
- Deployer
type_of_high_risk_role:
deprecated: true
nullable: true
description: 'Deprecated: use high_risk_roles. A role already in the use case''s list leaves the list unchanged; another role replaces the list with that one role; null clears it. Rejected with 400 when sent with a high_risk_roles list it does not match.'
allOf:
-
$ref: '#/components/schemas/HighRiskRole'
goal:
type: string
nullable: true
target_industry:
type: string
nullable: true
description:
type: string
nullable: true
status:
$ref: '#/components/schemas/ProjectStatus'
last_updated:
type: string
format: date-time
last_updated_by:
type: integer
members:
type: array
items:
type: integer
example:
- 2
- 3
- 5
ProjectFramework:
type: object
properties:
project_framework_id:
type: integer
framework_id:
type: integer
name:
type: string
example: 'EU AI Act'
Project:
type: object
properties:
id:
type: integer
example: 42
uc_id:
type: string
nullable: true
example: UC-7
project_title:
type: string
example: 'Customer Support Chatbot'
owner:
type: integer
example: 1
start_date:
type: string
format: date-time
nullable: true
geography:
type: integer
nullable: true
example: 1
ai_risk_classification:
oneOf:
-
$ref: '#/components/schemas/AiRiskClassification'
-
type: 'null'
high_risk_roles:
type: array
items:
$ref: '#/components/schemas/HighRiskRole'
description: 'EU AI Act roles of the use case, Provider first. Empty when none is set.'
example:
- Provider
- Deployer
type_of_high_risk_role:
deprecated: true
description: 'Deprecated, derived from high_risk_roles: Provider when the list contains Provider, Deployer when it contains only Deployer, null when empty.'
oneOf:
-
$ref: '#/components/schemas/HighRiskRole'
-
type: 'null'
use_case_category:
type: string
nullable: true
use_case_purpose:
type: string
nullable: true
use_case_audience:
type: string
nullable: true
deployment_context:
type: string
nullable: true
goal:
type: string
nullable: true
target_industry:
type: string
nullable: true
description:
type: string
nullable: true
status:
$ref: '#/components/schemas/ProjectStatus'
last_updated:
type: string
format: date-time
nullable: true
last_updated_by:
type: integer
nullable: true
created_at:
type: string
format: date-time
is_organizational:
type: boolean
is_demo:
type: boolean
_source:
type: string
nullable: true
framework:
type: array
items:
$ref: '#/components/schemas/ProjectFramework'
members:
type: array
items:
type: integer
ProjectListItem:
allOf:
-
$ref: '#/components/schemas/Project'
-
type: object
properties:
has_pending_approval:
type: boolean
approval_status:
type: string
nullable: true
enum:
- pending
- rejected
- null
ProjectDetail:
allOf:
-
$ref: '#/components/schemas/Project'
-
type: object
properties:
owner_name:
type: string
example: 'John Doe'
has_pending_approval:
type: boolean
approval_status:
type: string
nullable: true
enum:
- pending
- rejected
- null
ProjectWithMembers:
allOf:
-
$ref: '#/components/schemas/Project'
-
type: object
properties:
members:
type: array
items:
type: integer
ProjectStats:
type: object
properties:
user:
type: object
properties:
name:
type: string
surname:
type: string
email:
type: string
format: email
project_last_updated:
type: string
format: date-time
userWhoUpdated:
type: object
properties:
id:
type: integer
name:
type: string
surname:
type: string
email:
type: string
format: email
ProjectRiskCount:
type: object
properties:
risk_level_autocalculated:
type: string
example: High
count:
type: string
example: '3'
VendorRiskCount:
type: object
properties:
risk_level:
type: string
example: Critical
count:
type: string
example: '2'
ComplianceProgress:
type: object
properties:
allsubControls:
oneOf:
-
type: string
-
type: integer
example: '45'
allDonesubControls:
oneOf:
-
type: string
-
type: integer
example: '12'
AssessmentProgress:
type: object
properties:
totalQuestions:
oneOf:
-
type: string
-
type: integer
example: '80'
answeredQuestions:
oneOf:
-
type: string
-
type: integer
example: '35'
ControlCategory:
type: object
properties:
id:
type: integer
project_id:
type: integer
name:
type: string
organization_id:
type: integer
controls:
type: array
items:
type: object
properties:
id:
type: integer
control_category_id:
type: integer
title:
type: string
description:
type: string
status:
type: string
numberOfSubcontrols:
type: integer
numberOfDoneSubcontrols:
type: integer
subControls:
type: array
items:
type: object
properties: {id: {type: integer}, control_id: {type: integer}, title: {type: string}, description: {type: string}, status: {type: string, enum: [Draft, 'In progress', Done]}, organization_id: {type: integer}}
ErrorResponse:
type: object
properties:
message:
type: string
example: 'Not Found'
data:
example: {}
ServerError:
type: object
properties:
message:
type: string
example: 'Internal Server Error'
error:
type: string
example: 'Unexpected error occurred'
UserSafe:
type: object
description: 'User object with password_hash excluded'
properties:
id:
type: integer
example: 1
name:
type: string
example: John
surname:
type: string
example: Doe
email:
type: string
format: email
example: john@example.com
role_id:
type: integer
description: '1=Admin, 2=Reviewer, 3=Editor, 4=Auditor, 5=SuperAdmin'
example: 1
createdAt:
type: string
format: date-time
last_login:
type: string
format: date-time
nullable: true
updatedAt:
type: string
format: date-time
is_demo:
type: boolean
default: false
organization_id:
type: integer
nullable: true
example: 1
profile_photo_id:
type: integer
nullable: true
sso_provider:
type: string
nullable: true
enum:
- AzureAD
- null
sso_user_id:
type: string
nullable: true
required:
- id
- name
- surname
- email
- role_id
- createdAt
StatusEnvelope:
type: object
properties:
message:
type: string
description: 'HTTP status text (e.g. "OK", "Created", "Accepted")'
data:
description: 'Response payload (varies by endpoint)'
ErrorEnvelope:
type: object
properties:
message:
type: string
description: 'HTTP status text or error category'
data:
type: string
description: 'Error detail message'
ProgressResponse:
type: object
properties:
assessmentsMetadata:
type: array
items:
type: object
properties:
projectId:
type: integer
totalAssessments:
type: integer
doneAssessments:
type: integer
controlsMetadata:
type: array
items:
type: object
properties:
projectId:
type: integer
totalSubControls:
type: integer
doneSubControls:
type: integer
allTotalAssessments:
type: integer
allDoneAssessments:
type: integer
allTotalSubControls:
type: integer
allDoneSubControls:
type: integer
Vendor:
type: object
properties:
id:
type: integer
description: 'Auto-generated primary key'
example: 42
order_no:
type: integer
nullable: true
description: 'Display order number'
vendor_name:
type: string
description: 'Name of the vendor'
example: 'Acme Corp'
vendor_provides:
type: string
description: 'What the vendor provides'
example: 'Cloud hosting services'
assignee:
type: integer
description: 'User ID of the assigned owner'
example: 5
website:
type: string
description: 'Vendor website URL'
example: 'https://acme.example.com'
vendor_contact_person:
type: string
description: 'Name of the vendor contact'
example: 'Jane Doe'
review_result:
type: string
nullable: true
description: 'Free-text review result summary'
review_status:
type: string
nullable: true
enum:
- 'Not started'
- 'In review'
- Reviewed
- 'Requires follow-up'
default: 'Not started'
description: 'Current review lifecycle status'
reviewer:
type: integer
nullable: true
description: 'User ID of the reviewer'
review_date:
type: string
format: date-time
nullable: true
description: 'Date the review was performed (ISO 8601)'
is_demo:
type: boolean
default: false
description: 'Whether this is a demo vendor (read-only after creation)'
projects:
type: array
items:
type: integer
description: 'Array of associated project IDs'
data_sensitivity:
type: string
nullable: true
enum:
- None
- 'Internal only'
- 'Personally identifiable information (PII)'
- 'Financial data'
- 'Health data (e.g. HIPAA)'
- 'Model weights or AI assets'
- 'Other sensitive data'
description: 'Scorecard - type of data the vendor accesses'
business_criticality:
type: string
nullable: true
enum:
- 'Low (vendor supports non-core functions)'
- 'Medium (affects operations but is replaceable)'
- 'High (critical to core services or products)'
description: 'Scorecard - how critical the vendor is to operations'
past_issues:
type: string
nullable: true
enum:
- None
- 'Minor incident (e.g. small delay, minor bug)'
- 'Major incident (e.g. data breach, legal issue)'
description: 'Scorecard - history of past incidents'
regulatory_exposure:
type: string
nullable: true
enum:
- None
- 'GDPR (EU)'
- 'HIPAA (US)'
- 'SOC 2'
- 'ISO 27001'
- 'EU AI act'
- 'CCPA (california)'
- Other
description: 'Scorecard - applicable regulatory framework'
risk_score:
type: integer
nullable: true
description: 'Computed risk score for the vendor'
created_at:
type: string
format: date-time
description: 'Creation timestamp (ISO 8601)'
updated_at:
type: string
format: date-time
description: 'Last update timestamp (ISO 8601)'
required:
- vendor_name
- vendor_provides
- assignee
- website
- vendor_contact_person
VendorWithReviewerName:
allOf:
-
$ref: '#/components/schemas/Vendor'
-
type: object
properties:
reviewer_name:
type: string
description: 'Full name of the reviewer (joined from users table)'
example: 'John Smith'
VendorInput:
type: object
required:
- vendor_name
- vendor_provides
- assignee
- website
- vendor_contact_person
properties:
vendor_name:
type: string
description: 'Name of the vendor (required, non-empty)'
vendor_provides:
type: string
description: 'What the vendor provides (required, non-empty)'
assignee:
type: integer
minimum: 1
description: 'User ID of the assigned owner (required, >= 1)'
website:
type: string
description: 'Vendor website URL (required, non-empty)'
vendor_contact_person:
type: string
description: 'Name of the vendor contact (required, non-empty)'
review_result:
type: string
description: 'Free-text review result summary'
review_status:
type: string
enum:
- 'Not started'
- 'In review'
- Reviewed
- 'Requires follow-up'
description: 'Current review lifecycle status'
reviewer:
type: integer
minimum: 1
description: 'User ID of the reviewer'
review_date:
type: string
format: date-time
description: 'Date of the review (ISO 8601)'
order_no:
type: integer
description: 'Display order number'
is_demo:
type: boolean
default: false
description: 'Mark as demo vendor'
projects:
type: array
items:
type: integer
description: 'Array of project IDs to associate'
data_sensitivity:
type: string
enum:
- None
- 'Internal only'
- 'Personally identifiable information (PII)'
- 'Financial data'
- 'Health data (e.g. HIPAA)'
- 'Model weights or AI assets'
- 'Other sensitive data'
business_criticality:
type: string
enum:
- 'Low (vendor supports non-core functions)'
- 'Medium (affects operations but is replaceable)'
- 'High (critical to core services or products)'
past_issues:
type: string
enum:
- None
- 'Minor incident (e.g. small delay, minor bug)'
- 'Major incident (e.g. data breach, legal issue)'
regulatory_exposure:
type: string
enum:
- None
- 'GDPR (EU)'
- 'HIPAA (US)'
- 'SOC 2'
- 'ISO 27001'
- 'EU AI act'
- 'CCPA (california)'
- Other
risk_score:
type: integer
description: 'Computed risk score'
VendorUpdate:
type: object
description: 'All fields are optional. Only provided fields are updated. Review and scorecard fields can be set to null to clear them.'
properties:
vendor_name:
type: string
vendor_provides:
type: string
assignee:
type: integer
minimum: 1
website:
type: string
vendor_contact_person:
type: string
review_result:
type: string
nullable: true
review_status:
type: string
nullable: true
enum:
- 'Not started'
- 'In review'
- Reviewed
- 'Requires follow-up'
reviewer:
type: integer
nullable: true
review_date:
type: string
format: date-time
nullable: true
order_no:
type: integer
projects:
type: array
items:
type: integer
data_sensitivity:
type: string
nullable: true
enum:
- None
- 'Internal only'
- 'Personally identifiable information (PII)'
- 'Financial data'
- 'Health data (e.g. HIPAA)'
- 'Model weights or AI assets'
- 'Other sensitive data'
business_criticality:
type: string
nullable: true
enum:
- 'Low (vendor supports non-core functions)'
- 'Medium (affects operations but is replaceable)'
- 'High (critical to core services or products)'
past_issues:
type: string
nullable: true
enum:
- None
- 'Minor incident (e.g. small delay, minor bug)'
- 'Major incident (e.g. data breach, legal issue)'
regulatory_exposure:
type: string
nullable: true
enum:
- None
- 'GDPR (EU)'
- 'HIPAA (US)'
- 'SOC 2'
- 'ISO 27001'
- 'EU AI act'
- 'CCPA (california)'
- Other
risk_score:
type: integer
nullable: true
ModelInventoryStatus:
type: string
enum:
- Approved
- Restricted
- Pending
- Blocked
- Rejected
- Retired
description: 'Current approval/review status of the model'
ModelInventoryType:
type: string
enum:
- 'Traditional ML'
- GenAI
- RAG
- 'Agentic AI'
nullable: true
description: 'Classification of the model AI paradigm (optional)'
Filedata:
type: object
description: 'Metadata for an uploaded security-assessment file'
properties:
id:
type: integer
description: 'File record ID'
filename:
type: string
description: 'Original file name'
size:
type: integer
description: 'File size in bytes'
mimetype:
type: string
description: 'MIME type (e.g. application/pdf)'
upload_date:
type: string
format: date-time
description: 'ISO 8601 upload timestamp'
uploaded_by:
type: integer
description: 'User ID who uploaded the file'
required:
- id
- filename
- size
- mimetype
- upload_date
- uploaded_by
ModelInventoryResponse:
type: object
description: 'Model inventory record as returned by the API'
properties:
id:
type: integer
description: 'Auto-generated primary key'
example: 42
provider_model:
type: string
nullable: true
description: 'Legacy combined provider+model field (backward compatibility)'
example: 'OpenAI / GPT-4'
provider:
type: string
description: 'Model provider name'
example: OpenAI
model:
type: string
description: 'Model name'
example: GPT-4
version:
type: string
description: 'Model version identifier'
example: turbo-2024-04-09
approver:
type: integer
nullable: true
description: 'User ID of the assigned approver'
example: 7
capabilities:
type: array
items:
type: string
description: "List of capability strings. Stored as comma-separated text in the DB, returned as an array.\n"
example:
- 'Text Generation'
- 'Code Generation'
- Reasoning
security_assessment:
type: boolean
description: 'Whether a security assessment has been completed'
example: false
status:
$ref: '#/components/schemas/ModelInventoryStatus'
status_date:
type: string
format: date-time
description: 'ISO 8601 timestamp of the last status change'
example: '2026-04-15T10:30:00.000Z'
type:
$ref: '#/components/schemas/ModelInventoryType'
reference_link:
type: string
nullable: true
description: 'URL to external model documentation or model card'
example: 'https://platform.openai.com/docs/models/gpt-4'
biases:
type: string
description: 'Known biases of the model'
example: 'May reflect biases present in training data'
limitations:
type: string
description: 'Known limitations of the model'
example: 'Knowledge cutoff, potential hallucinations'
hosting_provider:
type: string
description: 'Where the model is hosted'
example: 'Azure OpenAI'
security_assessment_data:
type: array
items:
$ref: '#/components/schemas/Filedata'
description: 'Uploaded security assessment file metadata'
is_demo:
type: boolean
description: 'Whether this is a demo/sample record'
example: false
created_at:
type: string
format: date-time
description: 'ISO 8601 creation timestamp'
example: '2026-04-10T08:00:00.000Z'
updated_at:
type: string
format: date-time
description: 'ISO 8601 last-updated timestamp'
example: '2026-04-15T10:30:00.000Z'
projects:
type: array
items:
type: integer
description: 'IDs of projects this model is associated with'
example:
- 1
- 3
frameworks:
type: array
items:
type: integer
description: 'IDs of frameworks this model is associated with'
example:
- 5
ModelInventoryCreateRequest:
type: object
description: 'Request body for creating a new model inventory record'
required:
- provider
- model
- version
- capabilities
- status
- status_date
- reference_link
- biases
- limitations
- hosting_provider
properties:
provider_model:
type: string
description: 'Legacy combined provider+model field (optional, backward compatibility)'
example: 'OpenAI / GPT-4'
provider:
type: string
description: 'Model provider name'
example: OpenAI
model:
type: string
description: 'Model name'
example: GPT-4
version:
type: string
description: 'Model version identifier'
example: turbo-2024-04-09
approver:
type: integer
nullable: true
description: 'User ID of the assigned approver'
example: 7
capabilities:
oneOf:
-
type: string
description: 'Comma-separated capabilities'
-
type: array
items:
type: string
description: 'Array of capability strings'
description: "Accepted as either a comma-separated string or an array of strings. Arrays are joined with \", \" before storage.\n"
example:
- 'Text Generation'
- 'Code Generation'
security_assessment:
type: boolean
description: 'Whether a security assessment has been completed'
default: false
status:
$ref: '#/components/schemas/ModelInventoryStatus'
status_date:
type: string
format: date-time
description: 'ISO 8601 timestamp for the status'
example: '2026-04-15T10:30:00.000Z'
type:
$ref: '#/components/schemas/ModelInventoryType'
reference_link:
type: string
description: 'URL to external model documentation or model card'
example: 'https://platform.openai.com/docs/models/gpt-4'
biases:
type: string
description: 'Known biases of the model'
example: 'May reflect biases present in training data'
limitations:
type: string
description: 'Known limitations of the model'
example: 'Knowledge cutoff, potential hallucinations'
hosting_provider:
type: string
description: 'Where the model is hosted'
example: 'Azure OpenAI'
security_assessment_data:
type: array
items:
$ref: '#/components/schemas/Filedata'
description: 'Uploaded security assessment file metadata'
default: []
is_demo:
type: boolean
description: 'Whether this is a demo/sample record'
default: false
projects:
type: array
items:
type: integer
description: 'Project IDs to associate with this model'
default: []
example:
- 1
- 3
frameworks:
type: array
items:
type: integer
description: 'Framework IDs to associate with this model'
default: []
example:
- 5
ModelInventoryUpdateRequest:
type: object
description: "Request body for updating a model inventory record. All fields are optional; only provided fields are modified.\n"
properties:
provider_model:
type: string
description: 'Legacy combined provider+model field'
provider:
type: string
description: 'Model provider name'
model:
type: string
description: 'Model name'
version:
type: string
description: 'Model version identifier'
approver:
type: integer
nullable: true
description: 'User ID of the assigned approver'
capabilities:
oneOf:
-
type: string
-
type: array
items:
type: string
description: 'Capabilities (string or array)'
security_assessment:
type: boolean
description: 'Whether a security assessment has been completed'
status:
$ref: '#/components/schemas/ModelInventoryStatus'
status_date:
type: string
format: date-time
description: 'ISO 8601 timestamp for the status'
type:
$ref: '#/components/schemas/ModelInventoryType'
reference_link:
type: string
description: 'URL to external model documentation'
biases:
type: string
description: 'Known biases of the model'
limitations:
type: string
description: 'Known limitations of the model'
hosting_provider:
type: string
description: 'Where the model is hosted'
security_assessment_data:
type: array
items:
$ref: '#/components/schemas/Filedata'
description: 'Uploaded security assessment file metadata'
is_demo:
type: boolean
description: 'Whether this is a demo/sample record'
projects:
type: array
items:
type: integer
description: "Project IDs to associate. When provided (even empty), replaces all existing project associations.\n"
frameworks:
type: array
items:
type: integer
description: "Framework IDs to associate. When provided (even empty), replaces all existing framework associations.\n"
deleteProjects:
type: boolean
description: "When true, clears all project associations even if projects array is empty. Used to force-delete associations without providing replacements.\n"
default: false
deleteFrameworks:
type: boolean
description: "When true, clears all framework associations even if frameworks array is empty. Used to force-delete associations without providing replacements.\n"
default: false
PolicyWithReviewers:
type: object
description: 'A policy record with computed assigned reviewer IDs'
properties:
id:
type: integer
description: 'Auto-generated primary key'
example: 42
organization_id:
type: integer
description: 'Tenant organization ID'
example: 1
title:
type: string
description: 'Policy title'
example: 'AI Ethics Policy'
content_html:
type: string
description: 'Full policy content as HTML'
example: 'AI Ethics Policy
...
'
status:
type: string
description: 'Policy lifecycle status'
example: draft
tags:
type: array
items:
type: string
enum:
- 'AI ethics'
- Fairness
- Transparency
- Explainability
- 'Bias mitigation'
- Privacy
- 'Data governance'
- 'Model risk'
- Accountability
- Security
- LLM
- 'Human oversight'
- 'EU AI Act'
- 'ISO 42001'
- 'NIST RMF'
- 'Red teaming'
- Audit
- Monitoring
- 'Vendor management'
description: 'Categorization tags'
next_review_date:
type: string
format: date-time
nullable: true
description: 'Scheduled next review date'
author_id:
type: integer
description: 'User ID of the policy creator'
example: 1
last_updated_by:
type: integer
description: 'User ID of the last editor'
example: 1
last_updated_at:
type: string
format: date-time
description: 'Timestamp of last update'
review_status:
type: string
nullable: true
enum:
- pending_review
- approved
- changes_requested
- null
description: 'Current review workflow status'
review_comment:
type: string
nullable: true
description: 'Most recent review comment'
reviewed_by:
type: integer
nullable: true
description: 'User ID of the last reviewer'
reviewed_at:
type: string
format: date-time
nullable: true
description: 'Timestamp of last review action'
is_demo:
type: boolean
description: 'Whether this is a demo/seed policy'
default: false
created_at:
type: string
format: date-time
description: 'Row creation timestamp (set by database)'
assigned_reviewer_ids:
type: array
items:
type: integer
description: 'User IDs of assigned reviewers (aggregated from mapping table)'
example:
- 2
- 5
PolicyCreateRequest:
type: object
required:
- title
- content_html
- status
properties:
title:
type: string
description: 'Policy title'
example: 'Data Governance Policy'
content_html:
type: string
description: 'Full policy content as HTML'
example: 'Data Governance
This policy outlines...
'
status:
type: string
description: 'Initial policy status'
example: draft
tags:
type: array
items:
type: string
description: 'Categorization tags (must be from the allowed tag list)'
example:
- 'Data governance'
- Privacy
next_review_date:
type: string
format: date-time
nullable: true
description: 'Scheduled next review date'
example: '2026-07-01T00:00:00.000Z'
assigned_reviewer_ids:
type: array
items:
type: integer
description: 'User IDs to assign as reviewers'
example:
- 2
- 5
is_demo:
type: boolean
description: 'Mark as a demo policy'
default: false
PolicyUpdateRequest:
type: object
description: 'All fields are optional. Only provided fields are updated.'
properties:
title:
type: string
description: 'Updated policy title'
content_html:
type: string
description: 'Updated policy content as HTML'
status:
type: string
description: 'Updated policy status'
tags:
type: array
items:
type: string
description: 'Replacement tag list (must be from the allowed tag list)'
next_review_date:
type: string
format: date-time
nullable: true
description: 'Updated next review date'
assigned_reviewer_ids:
type: array
items:
type: integer
description: 'Replacement reviewer list (fully replaces existing reviewers)'
ProjectRiskInput:
type: object
required:
- risk_name
- risk_owner
- risk_description
properties:
risk_name:
type: string
description: 'Name/title of the risk.'
risk_owner:
type: integer
description: 'User ID of the risk owner (must be >= 1).'
ai_lifecycle_phase:
type: string
enum:
- 'Problem definition & planning'
- 'Data collection & processing'
- 'Model development & training'
- 'Model validation & testing'
- 'Deployment & integration'
- 'Monitoring & maintenance'
- 'Decommissioning & retirement'
- null
nullable: true
risk_description:
type: string
description: 'Detailed description of the risk.'
nullable: true
risk_category:
type: array
items:
type: string
description: 'Array of category labels.'
impact:
type: string
nullable: true
assessment_mapping:
type: string
nullable: true
controls_mapping:
type: string
nullable: true
likelihood:
type: string
enum:
- Rare
- Unlikely
- Possible
- Likely
- 'Almost Certain'
- null
nullable: true
severity:
type: string
enum:
- Negligible
- Minor
- Moderate
- Major
- Catastrophic
- null
nullable: true
risk_level_autocalculated:
type: string
enum:
- 'No risk'
- 'Very low risk'
- 'Low risk'
- 'Medium risk'
- 'High risk'
- 'Very high risk'
- null
nullable: true
review_notes:
type: string
nullable: true
mitigation_status:
type: string
enum:
- 'Not Started'
- 'In Progress'
- Completed
- 'On Hold'
- Deferred
- Canceled
- 'Requires review'
- null
nullable: true
current_risk_level:
type: string
enum:
- 'No risk'
- 'Very low risk'
- 'Low risk'
- 'Medium risk'
- 'High risk'
- 'Very high risk'
- null
nullable: true
deadline:
type: string
format: date-time
nullable: true
mitigation_plan:
type: string
nullable: true
implementation_strategy:
type: string
nullable: true
mitigation_evidence_document:
type: string
nullable: true
likelihood_mitigation:
type: string
enum:
- Rare
- Unlikely
- Possible
- Likely
- 'Almost Certain'
- null
nullable: true
risk_severity:
type: string
enum:
- Negligible
- Minor
- Moderate
- Major
- Critical
- null
nullable: true
final_risk_level:
type: string
nullable: true
risk_approval:
type: integer
description: 'User ID of the approver.'
nullable: true
approval_status:
type: string
nullable: true
date_of_assessment:
type: string
format: date-time
nullable: true
is_demo:
type: boolean
default: false
projects:
type: array
items:
type: integer
description: 'Array of project IDs to link this risk to.'
frameworks:
type: array
items:
type: integer
description: 'Array of framework IDs to link this risk to.'
event_frequency_min:
type: number
nullable: true
event_frequency_likely:
type: number
nullable: true
event_frequency_max:
type: number
nullable: true
loss_regulatory_min:
type: number
nullable: true
loss_regulatory_likely:
type: number
nullable: true
loss_regulatory_max:
type: number
nullable: true
loss_operational_min:
type: number
nullable: true
loss_operational_likely:
type: number
nullable: true
loss_operational_max:
type: number
nullable: true
loss_litigation_min:
type: number
nullable: true
loss_litigation_likely:
type: number
nullable: true
loss_litigation_max:
type: number
nullable: true
loss_reputational_min:
type: number
nullable: true
loss_reputational_likely:
type: number
nullable: true
loss_reputational_max:
type: number
nullable: true
control_effectiveness:
type: number
nullable: true
description: 'Percentage 0-100.'
mitigation_cost_annual:
type: number
nullable: true
benchmark_id:
type: integer
nullable: true
currency:
type: string
nullable: true
default: USD
maxLength: 3
ProjectRiskResponse:
allOf:
-
$ref: '#/components/schemas/ProjectRiskInput'
-
type: object
properties:
id:
type: integer
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
total_loss_likely:
type: number
nullable: true
ale_estimate:
type: number
nullable: true
residual_ale:
type: number
nullable: true
roi_percentage:
type: number
nullable: true
projects:
type: array
items:
type: integer
frameworks:
type: array
items:
type: integer
subClauses:
type: array
items:
type: object
annexCategories:
type: array
items:
type: object
controls:
type: array
items:
type: object
assessments:
type: array
items:
type: object
annexControls_27001:
type: array
items:
type: object
subClauses_27001:
type: array
items:
type: object
organization_id:
type: integer
nullable: true
is_deleted:
type: boolean
deleted_at:
type: string
format: date-time
nullable: true
custom_fields:
type: array
items:
type: object
VendorRiskInput:
type: object
required:
- vendor_id
- risk_description
- impact_description
- likelihood
- risk_severity
- action_plan
- action_owner
- risk_level
properties:
vendor_id:
type: integer
description: 'ID of the vendor this risk belongs to.'
order_no:
type: integer
nullable: true
description: 'Optional ordering number.'
risk_description:
type: string
impact_description:
type: string
likelihood:
type: string
enum:
- Rare
- Unlikely
- Possible
- Likely
- 'Almost certain'
risk_severity:
type: string
enum:
- Negligible
- Minor
- Moderate
- Major
- Catastrophic
action_plan:
type: string
action_owner:
type: integer
description: 'User ID of the action owner.'
risk_level:
type: string
description: 'Free-text risk level.'
is_demo:
type: boolean
default: false
VendorRiskResponse:
type: object
properties:
id:
type: integer
vendor_id:
type: integer
order_no:
type: integer
nullable: true
risk_description:
type: string
impact_description:
type: string
impact:
type: string
nullable: true
likelihood:
type: string
enum:
- Rare
- Unlikely
- Possible
- Likely
- 'Almost certain'
risk_severity:
type: string
enum:
- Negligible
- Minor
- Moderate
- Major
- Catastrophic
action_plan:
type: string
action_owner:
type: integer
risk_level:
type: string
is_demo:
type: boolean
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
VendorRiskAllProjectsResponse:
description: 'Extended vendor risk with joined vendor/project info.'
type: object
properties:
risk_id:
type: integer
vendor_id:
type: integer
order_no:
type: integer
nullable: true
risk_description:
type: string
impact_description:
type: string
likelihood:
type: string
risk_severity:
type: string
action_plan:
type: string
action_owner:
type: integer
risk_level:
type: string
is_demo:
type: boolean
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
is_deleted:
type: boolean
deleted_at:
type: string
format: date-time
nullable: true
vendor_name:
type: string
project_id:
type: integer
nullable: true
project_title:
type: string
nullable: true
ModelRiskInput:
type: object
required:
- risk_name
- risk_category
- risk_level
- owner
- target_date
properties:
risk_name:
type: string
risk_category:
type: string
enum:
- Performance
- 'Bias & Fairness'
- Security
- 'Data Quality'
- Compliance
risk_level:
type: string
enum:
- Low
- Medium
- High
- Critical
status:
type: string
enum:
- Open
- 'In Progress'
- Resolved
- Accepted
default: Open
owner:
type: string
description: 'Name or identifier of the risk owner.'
target_date:
type: string
format: date
description: 'Next review / target date.'
description:
type: string
mitigation_plan:
type: string
impact:
type: string
likelihood:
type: string
key_metrics:
type: string
current_values:
type: string
threshold:
type: string
model_id:
type: integer
nullable: true
description: 'ID of the model inventory entry this risk is linked to.'
is_demo:
type: boolean
default: false
ModelRiskResponse:
type: object
properties:
id:
type: integer
risk_name:
type: string
risk_category:
type: string
enum:
- Performance
- 'Bias & Fairness'
- Security
- 'Data Quality'
- Compliance
risk_level:
type: string
enum:
- Low
- Medium
- High
- Critical
status:
type: string
enum:
- Open
- 'In Progress'
- Resolved
- Accepted
owner:
type: string
target_date:
type: string
format: date
description:
type: string
mitigation_plan:
type: string
impact:
type: string
likelihood:
type: string
key_metrics:
type: string
current_values:
type: string
threshold:
type: string
model_id:
type: integer
nullable: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
SuccessResponse:
type: object
properties:
status:
type: string
example: success
data:
description: 'Response payload (type varies per endpoint)'
ValidationErrorResponse:
type: object
properties:
status:
type: string
example: error
message:
type: string
example: 'Dataset creation validation failed'
errors:
type: array
items:
type: object
properties:
field:
type: string
message:
type: string
code:
type: string
Evidence:
type: object
properties:
id:
type: integer
evidence_name:
type: string
evidence_type:
type: string
description:
type: string
nullable: true
evidence_files:
type: array
items:
$ref: '#/components/schemas/FileResponse'
expiry_date:
type: string
format: date-time
nullable: true
mapped_model_ids:
type: array
items:
type: integer
nullable: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
FileResponse:
type: object
properties:
id:
oneOf:
-
type: string
-
type: integer
filename:
type: string
size:
oneOf:
-
type: number
-
type: string
mimetype:
type: string
uploaded_by:
type: integer
upload_date:
type: string
EvidenceCreateRequest:
type: object
required:
- evidence_name
- evidence_type
properties:
evidence_name:
type: string
maxLength: 255
evidence_type:
type: string
maxLength: 100
description:
type: string
nullable: true
evidence_files:
type: array
items:
type: object
properties:
id:
oneOf:
- {type: string}
- {type: integer}
description: 'Array of file references (by ID) to link'
expiry_date:
type: string
format: date-time
nullable: true
mapped_model_ids:
type: array
items:
type: integer
description: 'Model inventory IDs to map this evidence to'
EvidenceUpdateRequest:
type: object
properties:
evidence_name:
type: string
maxLength: 255
evidence_type:
type: string
maxLength: 100
description:
type: string
nullable: true
evidence_files:
type: array
items:
type: object
properties:
id:
oneOf:
- {type: string}
- {type: integer}
description: 'New files to link'
deleteFiles:
type: array
items:
oneOf:
-
type: string
-
type: integer
description: 'File IDs to unlink'
expiry_date:
type: string
format: date-time
nullable: true
mapped_model_ids:
type: array
items:
type: integer
Dataset:
type: object
properties:
id:
type: integer
name:
type: string
description:
type: string
version:
type: string
owner:
type: string
type:
type: string
enum:
- training
- validation
- testing
- production
- reference
- synthetic
function:
type: string
source:
type: string
license:
type: string
nullable: true
format:
type: string
nullable: true
classification:
type: string
enum:
- public
- internal
- confidential
- restricted
contains_pii:
type: boolean
pii_types:
type: string
nullable: true
status:
type: string
enum:
- draft
- active
- deprecated
- archived
status_date:
type: string
format: date-time
known_biases:
type: string
nullable: true
bias_mitigation:
type: string
nullable: true
collection_method:
type: string
nullable: true
preprocessing_steps:
type: string
nullable: true
documentation_data:
type: array
items:
$ref: '#/components/schemas/DocumentationFile'
is_demo:
type: boolean
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
models:
type: array
items:
type: integer
description: 'Related model inventory IDs'
projects:
type: array
items:
type: integer
description: 'Related project IDs'
DocumentationFile:
type: object
description: 'File metadata stored in JSONB documentation_data column'
properties:
id:
type: string
filename:
type: string
size:
type: number
mimetype:
type: string
DatasetCreateRequest:
type: object
required:
- name
- description
- version
- owner
- type
- function
- source
- classification
- contains_pii
- status
properties:
name:
type: string
maxLength: 255
description:
type: string
version:
type: string
maxLength: 50
owner:
type: string
maxLength: 255
type:
type: string
enum:
- training
- validation
- testing
- production
- reference
- synthetic
function:
type: string
source:
type: string
maxLength: 255
license:
type: string
maxLength: 255
format:
type: string
maxLength: 100
classification:
type: string
enum:
- public
- internal
- confidential
- restricted
contains_pii:
type: boolean
pii_types:
type: string
status:
type: string
enum:
- draft
- active
- deprecated
- archived
status_date:
type: string
format: date-time
description: 'Defaults to current time if omitted'
known_biases:
type: string
bias_mitigation:
type: string
collection_method:
type: string
preprocessing_steps:
type: string
documentation_data:
type: array
items:
$ref: '#/components/schemas/DocumentationFile'
is_demo:
type: boolean
default: false
models:
type: array
items:
type: integer
description: 'Model inventory IDs to associate'
projects:
type: array
items:
type: integer
description: 'Project IDs to associate'
DatasetUpdateRequest:
type: object
description: 'All fields optional. Only provided fields are updated.'
properties:
name:
type: string
maxLength: 255
description:
type: string
version:
type: string
maxLength: 50
owner:
type: string
maxLength: 255
type:
type: string
enum:
- training
- validation
- testing
- production
- reference
- synthetic
function:
type: string
source:
type: string
maxLength: 255
license:
type: string
maxLength: 255
format:
type: string
maxLength: 100
classification:
type: string
enum:
- public
- internal
- confidential
- restricted
contains_pii:
type: boolean
pii_types:
type: string
status:
type: string
enum:
- draft
- active
- deprecated
- archived
status_date:
type: string
format: date-time
known_biases:
type: string
bias_mitigation:
type: string
collection_method:
type: string
preprocessing_steps:
type: string
documentation_data:
type: array
items:
$ref: '#/components/schemas/DocumentationFile'
is_demo:
type: boolean
models:
type: array
items:
type: integer
description: 'Replace model associations (provide full list)'
projects:
type: array
items:
type: integer
description: 'Replace project associations (provide full list)'
deleteModels:
type: boolean
description: 'If true, remove all model associations (even if models array is empty)'
deleteProjects:
type: boolean
description: 'If true, remove all project associations (even if projects array is empty)'
DatasetChangeHistoryEntry:
type: object
properties:
id:
type: integer
dataset_id:
type: integer
change_type:
type: string
description: 'e.g. created, deleted, field_change'
field_name:
type: string
nullable: true
old_value:
type: string
nullable: true
new_value:
type: string
nullable: true
changed_by:
type: integer
nullable: true
created_at:
type: string
format: date-time
AutomationTrigger:
type: object
properties:
id:
type: integer
key:
type: string
description: 'Machine-readable trigger identifier'
label:
type: string
description: 'Human-readable name'
event_name:
type: string
description:
type: string
nullable: true
AutomationAction:
type: object
properties:
id:
type: integer
key:
type: string
description: 'Machine-readable action identifier'
label:
type: string
description: 'Human-readable name'
description:
type: string
nullable: true
default_params:
type: object
nullable: true
description: 'Default parameters for this action type'
Automation:
type: object
properties:
id:
type: integer
name:
type: string
trigger_id:
type: integer
params:
type: object
description: 'Trigger-specific parameters (JSON)'
is_active:
type: boolean
created_by:
type: integer
nullable: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
AutomationWithActions:
allOf:
-
$ref: '#/components/schemas/Automation'
-
type: object
properties:
actions:
type: array
items:
$ref: '#/components/schemas/TenantAutomationAction'
TenantAutomationAction:
type: object
properties:
id:
type: integer
automation_id:
type: integer
action_type_id:
type: integer
params:
type: object
nullable: true
description: 'Action-specific parameters (JSON)'
order:
type: integer
description: 'Execution order (1-based)'
AutomationCreateRequest:
type: object
required:
- triggerId
- name
- actions
properties:
triggerId:
type: integer
description: 'ID of the automation trigger'
name:
type: string
description: 'Automation name'
params:
type: string
description: 'JSON-encoded trigger parameters (parsed server-side)'
default: '{}'
actions:
type: array
minItems: 1
items:
type: object
required:
- action_type_id
properties:
action_type_id:
type: integer
description: 'ID of the action type'
params:
type: object
nullable: true
description: 'Action-specific parameters'
AutomationUpdateRequest:
type: object
properties:
name:
type: string
triggerId:
type: integer
params:
type: string
description: 'JSON-encoded trigger parameters'
default: '{}'
is_active:
type: boolean
actions:
type: array
items:
type: object
required:
- action_type_id
properties:
action_type_id:
type: integer
params:
type: object
nullable: true
description: 'If provided, replaces all existing actions'
AutomationHistoryResponse:
type: object
properties:
logs:
type: array
items:
type: object
properties:
id:
type: integer
automation_id:
type: integer
status:
type: string
triggered_at:
type: string
format: date-time
completed_at:
type: string
format: date-time
nullable: true
actions:
type: array
items:
type: object
description: 'Per-action execution results'
total:
type: integer
description: 'Total number of log entries'
limit:
type: integer
offset:
type: integer
AutomationStats:
type: object
description: 'Aggregated execution statistics for an automation'
properties:
total_executions:
type: integer
successful:
type: integer
failed:
type: integer
last_executed_at:
type: string
format: date-time
ApiResponse:
type: object
properties:
statusCode:
type: integer
data:
description: 'Response payload (varies by endpoint)'
Pagination:
type: object
properties:
total:
type: integer
page:
type: integer
limit:
type: integer
total_pages:
type: integer
ScanStatus:
type: string
enum:
- pending
- cloning
- scanning
- completed
- failed
- cancelled
ScanMode:
type: string
enum:
- full
- incremental
FindingStatus:
type: string
enum:
- active
- fixed
- carried_forward
FindingType:
type: string
enum:
- library
- dependency
- api_call
- secret
- model_ref
- rag_component
- agent
- prompt_injection
- pii_exposure
- excessive_agency
- jailbreak_risk
- training_data_poisoning
- model_dos
- supply_chain
- insecure_plugin
- overreliance
- model_theft
ConfidenceLevel:
type: string
enum:
- high
- medium
- low
RiskLevel:
type: string
enum:
- high
- medium
- low
GovernanceStatus:
type: string
enum:
- reviewed
- approved
- flagged
nullable: true
LicenseRiskLevel:
type: string
enum:
- high
- medium
- low
- unknown
StartScanRequest:
type: object
required:
- repository_url
properties:
repository_url:
type: string
description: 'GitHub repository URL'
example: 'https://github.com/owner/repo'
scan_mode:
$ref: '#/components/schemas/ScanMode'
base_commit_sha:
type: string
pattern: '^[0-9a-fA-F]{7,40}$'
description: 'Required for incremental scans'
head_commit_sha:
type: string
pattern: '^[0-9a-fA-F]{7,40}$'
description: 'Required for incremental scans'
ScanStatusResponse:
type: object
properties:
id:
type: integer
status:
$ref: '#/components/schemas/ScanStatus'
progress:
type: number
format: float
current_file:
type: string
files_scanned:
type: integer
total_files:
type: integer
nullable: true
findings_count:
type: integer
error_message:
type: string
nullable: true
TriggeredByUser:
type: object
properties:
id:
type: integer
name:
type: string
surname:
type: string
ScanResponse:
type: object
properties:
scan:
type: object
properties:
id:
type: integer
repository_url:
type: string
repository_owner:
type: string
repository_name:
type: string
status:
$ref: '#/components/schemas/ScanStatus'
findings_count:
type: integer
files_scanned:
type: integer
started_at:
type: string
format: date-time
nullable: true
completed_at:
type: string
format: date-time
nullable: true
duration_ms:
type: integer
nullable: true
error_message:
type: string
nullable: true
triggered_by:
$ref: '#/components/schemas/TriggeredByUser'
risk_score:
type: number
nullable: true
risk_score_grade:
type: string
nullable: true
risk_score_details:
type: object
nullable: true
risk_score_calculated_at:
type: string
format: date-time
nullable: true
scan_mode:
$ref: '#/components/schemas/ScanMode'
base_commit_sha:
type: string
nullable: true
head_commit_sha:
type: string
nullable: true
baseline_scan_id:
type: integer
nullable: true
changed_files_count:
type: integer
nullable: true
created_at:
type: string
format: date-time
summary:
$ref: '#/components/schemas/ScanSummary'
ScanSummary:
type: object
properties:
total:
type: integer
by_confidence:
type: object
properties:
high:
type: integer
medium:
type: integer
low:
type: integer
by_provider:
type: object
additionalProperties:
type: integer
ScanListItem:
type: object
properties:
id:
type: integer
repository_url:
type: string
repository_owner:
type: string
repository_name:
type: string
status:
$ref: '#/components/schemas/ScanStatus'
findings_count:
type: integer
files_scanned:
type: integer
started_at:
type: string
format: date-time
nullable: true
completed_at:
type: string
format: date-time
nullable: true
duration_ms:
type: integer
nullable: true
triggered_by:
$ref: '#/components/schemas/TriggeredByUser'
risk_score:
type: number
nullable: true
risk_score_grade:
type: string
nullable: true
scan_mode:
$ref: '#/components/schemas/ScanMode'
baseline_scan_id:
type: integer
nullable: true
changed_files_count:
type: integer
nullable: true
created_at:
type: string
format: date-time
ScansResponse:
type: object
properties:
scans:
type: array
items:
$ref: '#/components/schemas/ScanListItem'
pagination:
$ref: '#/components/schemas/Pagination'
CancelScanResponse:
type: object
properties:
id:
type: integer
status:
type: string
enum:
- cancelled
message:
type: string
DeleteScanResponse:
type: object
properties:
message:
type: string
FilePath:
type: object
properties:
path:
type: string
line_number:
type: integer
nullable: true
matched_text:
type: string
Finding:
type: object
properties:
id:
type: integer
finding_type:
$ref: '#/components/schemas/FindingType'
category:
type: string
name:
type: string
provider:
type: string
confidence:
$ref: '#/components/schemas/ConfidenceLevel'
risk_level:
$ref: '#/components/schemas/RiskLevel'
description:
type: string
nullable: true
documentation_url:
type: string
nullable: true
file_count:
type: integer
file_paths:
type: array
items:
$ref: '#/components/schemas/FilePath'
governance_status:
$ref: '#/components/schemas/GovernanceStatus'
governance_updated_at:
type: string
format: date-time
nullable: true
governance_updated_by:
type: integer
nullable: true
license_id:
type: string
nullable: true
license_name:
type: string
nullable: true
license_risk:
$ref: '#/components/schemas/LicenseRiskLevel'
license_source:
type: string
enum:
- package
- huggingface
- pypi
- npm
- manual
nullable: true
mitigation:
type: string
nullable: true
data_flow_summary:
type: string
nullable: true
vulnerability_details:
type: object
nullable: true
finding_status:
$ref: '#/components/schemas/FindingStatus'
FindingsResponse:
type: object
properties:
findings:
type: array
items:
$ref: '#/components/schemas/Finding'
pagination:
$ref: '#/components/schemas/Pagination'
UpdateGovernanceStatusRequest:
type: object
properties:
governance_status:
type: string
enum:
- reviewed
- approved
- flagged
nullable: true
description: 'Set to null to clear governance status'
UpdateGovernanceStatusResponse:
type: object
properties:
id:
type: integer
governance_status:
type: string
nullable: true
governance_updated_at:
type: string
format: date-time
governance_updated_by:
type: integer
RiskScoreResponse:
type: object
properties:
score:
type: number
nullable: true
grade:
type: string
nullable: true
details:
type: object
nullable: true
calculated_at:
type: string
format: date-time
nullable: true
DimensionWeights:
type: object
properties:
data_sovereignty:
type: number
minimum: 0
maximum: 1
transparency:
type: number
minimum: 0
maximum: 1
security:
type: number
minimum: 0
maximum: 1
autonomy:
type: number
minimum: 0
maximum: 1
supply_chain:
type: number
minimum: 0
maximum: 1
description: 'All values must sum to 1.0'
VulnerabilityTypesEnabled:
type: object
properties:
prompt_injection:
type: boolean
pii_exposure:
type: boolean
excessive_agency:
type: boolean
jailbreak_risk:
type: boolean
training_data_poisoning:
type: boolean
model_dos:
type: boolean
supply_chain:
type: boolean
insecure_plugin:
type: boolean
overreliance:
type: boolean
model_theft:
type: boolean
RiskScoringConfig:
type: object
properties:
id:
type: integer
nullable: true
llm_enabled:
type: boolean
llm_key_id:
type: integer
nullable: true
dimension_weights:
$ref: '#/components/schemas/DimensionWeights'
vulnerability_scan_enabled:
type: boolean
vulnerability_types_enabled:
$ref: '#/components/schemas/VulnerabilityTypesEnabled'
updated_by:
type: integer
nullable: true
updated_at:
type: string
format: date-time
nullable: true
UpdateRiskScoringConfigRequest:
type: object
properties:
llm_enabled:
type: boolean
llm_key_id:
type: integer
nullable: true
dimension_weights:
$ref: '#/components/schemas/DimensionWeights'
vulnerability_scan_enabled:
type: boolean
vulnerability_types_enabled:
$ref: '#/components/schemas/VulnerabilityTypesEnabled'
DependencyGraphResponse:
type: object
properties:
nodes:
type: array
items:
type: object
properties:
id:
type: string
label:
type: string
type:
type: string
metadata:
type: object
edges:
type: array
items:
type: object
properties:
source:
type: string
target:
type: string
relationship:
type: string
metadata:
type: object
ComplianceMappingResponse:
type: object
properties:
mappings:
type: array
items:
type: object
checklist:
type: array
items:
type: object
summary:
type: object
Repository:
type: object
properties:
id:
type: integer
repository_url:
type: string
repository_owner:
type: string
repository_name:
type: string
display_name:
type: string
nullable: true
default_branch:
type: string
github_token_id:
type: integer
nullable: true
schedule_enabled:
type: boolean
schedule_frequency:
type: string
enum:
- daily
- weekly
- monthly
nullable: true
schedule_day_of_week:
type: integer
minimum: 0
maximum: 6
nullable: true
schedule_day_of_month:
type: integer
minimum: 1
maximum: 31
nullable: true
schedule_hour:
type: integer
minimum: 0
maximum: 23
schedule_minute:
type: integer
minimum: 0
maximum: 59
webhook_secret:
type: string
nullable: true
ci_enabled:
type: boolean
ci_min_score:
type: number
ci_max_critical:
type: integer
ci_post_comments:
type: boolean
ci_status_checks:
type: boolean
last_scan_id:
type: integer
nullable: true
last_scan_status:
type: string
nullable: true
last_scan_at:
type: string
format: date-time
nullable: true
next_scan_at:
type: string
format: date-time
nullable: true
is_enabled:
type: boolean
created_by:
type: integer
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
CreateRepositoryRequest:
type: object
required:
- repository_url
properties:
repository_url:
type: string
description: 'GitHub repository URL'
example: 'https://github.com/owner/repo'
display_name:
type: string
nullable: true
default_branch:
type: string
default: main
github_token_id:
type: integer
nullable: true
schedule_enabled:
type: boolean
default: false
schedule_frequency:
type: string
enum:
- daily
- weekly
- monthly
description: 'Required when schedule_enabled is true'
schedule_day_of_week:
type: integer
minimum: 0
maximum: 6
description: 'Required for weekly schedule (0=Sunday)'
schedule_day_of_month:
type: integer
minimum: 1
maximum: 31
description: 'Required for monthly schedule'
schedule_hour:
type: integer
minimum: 0
maximum: 23
default: 2
schedule_minute:
type: integer
minimum: 0
maximum: 59
default: 0
UpdateRepositoryRequest:
type: object
properties:
display_name:
type: string
nullable: true
default_branch:
type: string
github_token_id:
type: integer
nullable: true
schedule_enabled:
type: boolean
schedule_frequency:
type: string
enum:
- daily
- weekly
- monthly
schedule_day_of_week:
type: integer
minimum: 0
maximum: 6
schedule_day_of_month:
type: integer
minimum: 1
maximum: 31
schedule_hour:
type: integer
minimum: 0
maximum: 23
schedule_minute:
type: integer
minimum: 0
maximum: 59
is_enabled:
type: boolean
ci_enabled:
type: boolean
ci_min_score:
type: number
ci_max_critical:
type: integer
ci_post_comments:
type: boolean
ci_status_checks:
type: boolean
RepositoryListResponse:
type: object
properties:
repositories:
type: array
items:
$ref: '#/components/schemas/Repository'
pagination:
$ref: '#/components/schemas/Pagination'
AITrustCentreOverview:
type: object
description: 'Full overview with all sections'
properties:
intro:
type: object
properties:
id:
type: integer
purpose_visible:
type: boolean
purpose_text:
type: string
our_statement_visible:
type: boolean
our_statement_text:
type: string
our_mission_visible:
type: boolean
our_mission_text:
type: string
compliance_badges:
type: object
properties:
id:
type: integer
soc2_type_i:
type: boolean
soc2_type_ii:
type: boolean
iso_27001:
type: boolean
iso_42001:
type: boolean
ccpa:
type: boolean
gdpr:
type: boolean
hipaa:
type: boolean
eu_ai_act:
type: boolean
company_description:
type: object
properties:
id:
type: integer
background_visible:
type: boolean
background_text:
type: string
core_benefits_visible:
type: boolean
core_benefits_text:
type: string
compliance_doc_visible:
type: boolean
compliance_doc_text:
type: string
terms_and_contact:
type: object
properties:
id:
type: integer
terms_visible:
type: boolean
terms_text:
type: string
privacy_visible:
type: boolean
privacy_text:
type: string
email_visible:
type: boolean
email_text:
type: string
info:
type: object
properties:
id:
type: integer
title:
type: string
header_color:
type: string
visible:
type: boolean
intro_visible:
type: boolean
compliance_badges_visible:
type: boolean
company_description_visible:
type: boolean
terms_and_contact_visible:
type: boolean
resources_visible:
type: boolean
subprocessor_visible:
type: boolean
updated_at:
type: string
format: date-time
AITrustCentreResource:
type: object
properties:
id:
type: integer
organization_id:
type: integer
name:
type: string
description:
type: string
file_id:
type: integer
visible:
type: boolean
filename:
type: string
AITrustCentreSubprocessor:
type: object
properties:
id:
type: integer
organization_id:
type: integer
name:
type: string
purpose:
type: string
location:
type: string
url:
type: string
CreateSubprocessorRequest:
type: object
required:
- name
- purpose
- location
properties:
name:
type: string
purpose:
type: string
location:
type: string
url:
type: string
UpdateSubprocessorRequest:
type: object
properties:
name:
type: string
purpose:
type: string
location:
type: string
url:
type: string
AITrustCentrePublicPage:
type: object
description: 'Conditionally includes sections based on visibility settings'
properties:
info:
type: object
properties:
title:
type: string
header_color:
type: string
logo:
type: integer
nullable: true
intro:
type: object
nullable: true
properties:
purpose:
type: string
nullable: true
statement:
type: string
nullable: true
mission:
type: string
nullable: true
compliance_badges:
type: object
nullable: true
properties:
soc2_type_i:
type: boolean
soc2_type_ii:
type: boolean
iso_27001:
type: boolean
iso_42001:
type: boolean
ccpa:
type: boolean
gdpr:
type: boolean
hipaa:
type: boolean
eu_ai_act:
type: boolean
company_description:
type: object
nullable: true
properties:
background:
type: string
nullable: true
core_benefits:
type: string
nullable: true
compliance_doc:
type: string
nullable: true
terms_and_contact:
type: object
nullable: true
properties:
terms:
type: string
nullable: true
privacy:
type: string
nullable: true
email:
type: string
nullable: true
resources:
type: array
nullable: true
items:
type: object
properties:
id:
type: integer
name:
type: string
description:
type: string
file_id:
type: integer
visible:
type: boolean
subprocessors:
type: array
nullable: true
items:
type: object
properties:
id:
type: integer
name:
type: string
purpose:
type: string
location:
type: string
url:
type: string
IncidentType:
type: string
enum:
- Malfunction
- 'Unexpected behavior'
- 'Model drift'
- Misuse
- 'Data corruption'
- 'Security breach'
- 'Performance degradation'
IncidentSeverity:
type: string
enum:
- Minor
- Serious
- 'Very serious'
IncidentStatus:
type: string
enum:
- Open
- Investigating
- Mitigated
- Closed
- Suspended
- 'Emergency action'
IncidentApprovalStatus:
type: string
enum:
- Approved
- Rejected
- Pending
- 'Not required'
Incident:
type: object
properties:
id:
type: integer
incident_id:
type: string
nullable: true
ai_project:
type: string
type:
$ref: '#/components/schemas/IncidentType'
severity:
$ref: '#/components/schemas/IncidentSeverity'
status:
$ref: '#/components/schemas/IncidentStatus'
occurred_date:
type: string
format: date-time
date_detected:
type: string
format: date-time
reporter:
type: string
categories_of_harm:
type: array
items:
type: string
affected_persons_groups:
type: string
nullable: true
description:
type: string
relationship_causality:
type: string
nullable: true
immediate_mitigations:
type: string
nullable: true
planned_corrective_actions:
type: string
nullable: true
model_system_version:
type: string
nullable: true
interim_report:
type: boolean
archived:
type: boolean
approval_status:
$ref: '#/components/schemas/IncidentApprovalStatus'
approved_by:
type: string
nullable: true
approval_date:
type: string
format: date-time
nullable: true
approval_notes:
type: string
nullable: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
CreateIncidentRequest:
type: object
required:
- ai_project
- type
- severity
- status
- occurred_date
- date_detected
- reporter
- approval_status
- categories_of_harm
- description
- relationship_causality
properties:
ai_project:
type: string
type:
$ref: '#/components/schemas/IncidentType'
severity:
$ref: '#/components/schemas/IncidentSeverity'
status:
$ref: '#/components/schemas/IncidentStatus'
occurred_date:
type: string
format: date-time
date_detected:
type: string
format: date-time
reporter:
type: string
approval_status:
$ref: '#/components/schemas/IncidentApprovalStatus'
approved_by:
type: string
categories_of_harm:
oneOf:
-
type: array
items:
type: string
-
type: string
description: 'Comma-separated string (will be split)'
affected_persons_groups:
type: string
description:
type: string
description: 'Incident description. Lengths are measured after trimming leading and trailing whitespace.'
minLength: 5
maxLength: 32767
relationship_causality:
type: string
immediate_mitigations:
type: string
planned_corrective_actions:
type: string
model_system_version:
type: string
interim_report:
type: boolean
default: false
archived:
type: boolean
default: false
approval_date:
type: string
format: date-time
approval_notes:
type: string
UpdateIncidentRequest:
type: object
description: 'All fields are optional; only provided fields are updated.'
properties:
ai_project:
type: string
type:
$ref: '#/components/schemas/IncidentType'
severity:
$ref: '#/components/schemas/IncidentSeverity'
status:
$ref: '#/components/schemas/IncidentStatus'
occurred_date:
type: string
format: date-time
date_detected:
type: string
format: date-time
reporter:
type: string
approval_status:
$ref: '#/components/schemas/IncidentApprovalStatus'
approved_by:
type: string
categories_of_harm:
oneOf:
-
type: array
items:
type: string
-
type: string
affected_persons_groups:
type: string
description:
type: string
description: 'Incident description. Lengths are measured after trimming leading and trailing whitespace.'
minLength: 5
maxLength: 32767
relationship_causality:
type: string
immediate_mitigations:
type: string
planned_corrective_actions:
type: string
model_system_version:
type: string
interim_report:
type: boolean
archived:
type: boolean
approval_date:
type: string
format: date-time
approval_notes:
type: string
Framework:
type: object
properties:
id:
type: integer
name:
type: string
description:
type: string
organization_id:
type: integer
ISO27001Clause:
type: object
properties:
id:
type: integer
arrangement:
type: integer
title:
type: string
ISO27001ClauseWithSubClauses:
type: object
properties:
id:
type: integer
arrangement:
type: integer
title:
type: string
subClauses:
type: array
items:
$ref: '#/components/schemas/ISO27001SubClause'
ISO27001SubClause:
type: object
properties:
id:
type: integer
subclause_meta_id:
type: integer
projects_frameworks_id:
type: integer
organization_id:
type: integer
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
owner:
type: integer
nullable: true
reviewer:
type: integer
nullable: true
approver:
type: integer
nullable: true
implementation_details:
type: string
nullable: true
evidence_links:
type: array
items:
type: object
risks_mitigated:
type: array
items:
type: integer
tags:
type: array
items:
type: string
ISO27001Annex:
type: object
properties:
id:
type: integer
arrangement:
type: string
order_no:
type: integer
title:
type: string
ISO27001AnnexWithControls:
type: object
properties:
id:
type: integer
arrangement:
type: string
order_no:
type: integer
title:
type: string
controls:
type: array
items:
$ref: '#/components/schemas/ISO27001AnnexControl'
ISO27001AnnexControl:
type: object
properties:
id:
type: integer
annexcontrol_meta_id:
type: integer
projects_frameworks_id:
type: integer
organization_id:
type: integer
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
owner:
type: integer
nullable: true
reviewer:
type: integer
nullable: true
approver:
type: integer
nullable: true
implementation_details:
type: string
nullable: true
evidence_links:
type: array
items:
type: object
risks_mitigated:
type: array
items:
type: integer
tags:
type: array
items:
type: string
ISO27001SaveClauseRequest:
type: object
properties:
user_id:
type: string
description: 'User ID for file upload attribution'
project_id:
type: string
description: 'Project ID for file upload association'
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
owner:
type: integer
nullable: true
reviewer:
type: integer
nullable: true
approver:
type: integer
nullable: true
implementation_details:
type: string
tags:
type: string
description: 'JSON-encoded array of tag strings'
delete:
type: string
description: 'JSON-encoded array of file IDs to unlink'
risksDelete:
type: string
description: 'JSON-encoded array of risk IDs to remove'
risksMitigated:
type: string
description: 'JSON-encoded array of risk IDs to add'
files:
type: array
items:
type: string
format: binary
description: 'Evidence files to upload'
ISO27001SaveAnnexRequest:
type: object
properties:
user_id:
type: string
description: 'User ID for file upload attribution'
project_id:
type: string
description: 'Project ID for file upload association'
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
owner:
type: integer
nullable: true
reviewer:
type: integer
nullable: true
approver:
type: integer
nullable: true
implementation_details:
type: string
tags:
type: string
description: 'JSON-encoded array of tag strings'
delete:
type: string
description: 'JSON-encoded array of file IDs to unlink'
risksDelete:
type: string
description: 'JSON-encoded array of risk IDs to remove'
risksMitigated:
type: string
description: 'JSON-encoded array of risk IDs to add'
files:
type: array
items:
type: string
format: binary
description: 'Evidence files to upload'
ISO42001Clause:
type: object
properties:
id:
type: integer
clause_no:
type: integer
title:
type: string
ISO42001ClauseWithSubClauses:
type: object
properties:
id:
type: integer
clause_no:
type: integer
title:
type: string
subClauses:
type: array
items:
$ref: '#/components/schemas/ISO42001SubClause'
ISO42001SubClause:
type: object
properties:
id:
type: integer
subclause_meta_id:
type: integer
projects_frameworks_id:
type: integer
organization_id:
type: integer
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
owner:
type: integer
nullable: true
reviewer:
type: integer
nullable: true
approver:
type: integer
nullable: true
implementation_details:
type: string
nullable: true
evidence_links:
type: array
items:
type: object
risks_mitigated:
type: array
items:
type: integer
tags:
type: array
items:
type: string
ISO42001Annex:
type: object
properties:
id:
type: integer
annex_no:
type: integer
title:
type: string
ISO42001AnnexWithCategories:
type: object
properties:
id:
type: integer
annex_no:
type: integer
title:
type: string
categories:
type: array
items:
$ref: '#/components/schemas/ISO42001AnnexCategory'
ISO42001AnnexCategory:
type: object
properties:
id:
type: integer
annexcategory_meta_id:
type: integer
projects_frameworks_id:
type: integer
organization_id:
type: integer
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
owner:
type: integer
nullable: true
reviewer:
type: integer
nullable: true
approver:
type: integer
nullable: true
implementation_details:
type: string
nullable: true
evidence_links:
type: array
items:
type: object
risks_mitigated:
type: array
items:
type: integer
tags:
type: array
items:
type: string
ISO42001SaveClauseRequest:
type: object
properties:
user_id:
type: string
project_id:
type: string
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
owner:
type: integer
nullable: true
reviewer:
type: integer
nullable: true
approver:
type: integer
nullable: true
implementation_details:
type: string
tags:
type: string
description: 'JSON-encoded array of tag strings'
delete:
type: string
description: 'JSON-encoded array of file IDs to unlink'
risksDelete:
type: string
description: 'JSON-encoded array of risk IDs to remove'
risksMitigated:
type: string
description: 'JSON-encoded array of risk IDs to add'
files:
type: array
items:
type: string
format: binary
ISO42001SaveAnnexRequest:
type: object
properties:
user_id:
type: string
project_id:
type: string
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
owner:
type: integer
nullable: true
reviewer:
type: integer
nullable: true
approver:
type: integer
nullable: true
implementation_details:
type: string
tags:
type: string
description: 'JSON-encoded array of tag strings'
delete:
type: string
description: 'JSON-encoded array of file IDs to unlink'
risksDelete:
type: string
description: 'JSON-encoded array of risk IDs to remove'
risksMitigated:
type: string
description: 'JSON-encoded array of risk IDs to add'
files:
type: array
items:
type: string
format: binary
NISTFunction:
type: object
properties:
id:
type: integer
title:
type: string
example: GOVERN
description:
type: string
organization_id:
type: integer
NISTCategory:
type: object
properties:
id:
type: integer
title:
type: string
description:
type: string
function_id:
type: integer
organization_id:
type: integer
NISTSubcategory:
type: object
properties:
id:
type: integer
subcategory_meta_id:
type: integer
organization_id:
type: integer
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
owner:
type: integer
nullable: true
reviewer:
type: integer
nullable: true
approver:
type: integer
nullable: true
implementation_details:
type: string
nullable: true
evidence_links:
type: array
items:
type: object
risks_mitigated:
type: array
items:
type: integer
tags:
type: array
items:
type: string
NISTSubcategoryUpdateRequest:
type: object
properties:
user_id:
type: string
description: 'User ID for file upload attribution'
project_id:
type: string
description: 'Project ID for file upload association'
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
owner:
type: integer
nullable: true
reviewer:
type: integer
nullable: true
approver:
type: integer
nullable: true
implementation_details:
type: string
tags:
type: string
description: 'JSON-encoded array of tag strings'
delete:
type: string
description: 'JSON-encoded array of file IDs to unlink'
risksDelete:
type: string
description: 'JSON-encoded array of risk IDs to remove'
risksMitigated:
type: string
description: 'JSON-encoded array of risk IDs to add'
files:
type: array
items:
type: string
format: binary
description: 'Evidence files to upload'
NISTSubcategoryStatusUpdate:
type: object
required:
- status
properties:
status:
type: string
enum:
- 'Not started'
- Draft
- 'In review'
- Done
description: 'New status value'
NISTProgress:
type: object
properties:
totalSubcategories:
type: integer
doneSubcategories:
type: integer
NISTAssignments:
type: object
properties:
totalSubcategories:
type: integer
assignedSubcategories:
type: integer
ComplianceScore:
type: object
properties:
organizationId:
type: integer
overallScore:
type: integer
minimum: 0
maximum: 100
calculatedAt:
type: string
format: date-time
modules:
type: object
properties:
riskManagement:
$ref: '#/components/schemas/ModuleScore'
vendorManagement:
$ref: '#/components/schemas/ModuleScore'
projectGovernance:
$ref: '#/components/schemas/ModuleScore'
modelLifecycle:
$ref: '#/components/schemas/ModuleScore'
policyDocumentation:
$ref: '#/components/schemas/ModuleScore'
metadata:
$ref: '#/components/schemas/ComplianceMetadata'
ModuleScore:
type: object
properties:
score:
type: number
minimum: 0
maximum: 100
weight:
type: number
description: 'Module weight (sums to 1.0 across all modules)'
components:
type: array
items:
$ref: '#/components/schemas/ComponentScore'
totalDataPoints:
type: integer
qualityScore:
type: number
minimum: 0
maximum: 1
description: 'Data completeness indicator'
ComponentScore:
type: object
properties:
name:
type: string
score:
type: number
weight:
type: number
dataPoints:
type: integer
details:
type: object
description: 'Module-specific details'
ComplianceMetadata:
type: object
properties:
totalProjects:
type: integer
applicableProjects:
type: integer
lastUpdated:
type: string
format: date-time
dataFreshness:
type: object
properties:
risks:
type: string
format: date-time
vendors:
type: string
format: date-time
projects:
type: string
format: date-time
models:
type: string
format: date-time
policies:
type: string
format: date-time
calculationMethod:
type: string
enum:
- balanced_weighted_average
version:
type: string
ComplianceDetails:
allOf:
-
$ref: '#/components/schemas/ComplianceScore'
-
type: object
properties:
insights:
type: object
properties:
strongestModule:
type: object
properties: {name: {type: string}, score: {type: number}}
weakestModule:
type: object
properties: {name: {type: string}, score: {type: number}}
improvementPriority:
type: array
items: {type: object, properties: {module: {type: string}, score: {type: number}, weight: {type: number}, impact: {type: number, description: '(100 - score) * weight'}}}
overallTrend:
type: string
enum: [up, down, stable]
dataQuality:
type: object
properties: {riskManagement: {type: number}, vendorManagement: {type: number}, projectGovernance: {type: number}, modelLifecycle: {type: number}, policyDocumentation: {type: number}}
AssignmentResponse:
type: object
properties:
total:
type: integer
assigned:
type: integer
RisksResponse:
type: object
properties:
message:
type: string
data:
type: array
items:
$ref: '#/components/schemas/Risk'
Risk:
type: object
properties:
id:
type: integer
title:
type: string
description:
type: string
risk_level:
type: string
status:
type: string
organization_id:
type: integer
StatusCodeWrapper:
type: object
properties:
code:
type: integer
data:
description: 'Response payload'
ShareLinkSettings:
type: object
properties:
shareAllFields:
type: boolean
default: false
allowDataExport:
type: boolean
default: true
allowViewersToOpenRecords:
type: boolean
default: false
displayToolbar:
type: boolean
default: true
ShareLinkCreateRequest:
type: object
required:
- resource_type
- resource_id
properties:
resource_type:
type: string
enum:
- model
- vendor
- project
- policy
- risk
resource_id:
type: integer
minimum: 0
description: 'Use 0 for sharing the entire table/list view'
settings:
$ref: '#/components/schemas/ShareLinkSettings'
expires_at:
type: string
format: date-time
nullable: true
ShareLinkUpdateRequest:
type: object
properties:
settings:
$ref: '#/components/schemas/ShareLinkSettings'
is_enabled:
type: boolean
expires_at:
type: string
format: date-time
nullable: true
ShareLinkResponse:
type: object
properties:
id:
type: integer
share_token:
type: string
resource_type:
type: string
resource_id:
type: integer
settings:
$ref: '#/components/schemas/ShareLinkSettings'
is_enabled:
type: boolean
expires_at:
type: string
format: date-time
nullable: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
shareable_url:
type: string
format: uri
ShareLinkListItem:
allOf:
-
$ref: '#/components/schemas/ShareLinkResponse'
-
properties:
is_valid:
type: boolean
description: 'Whether the link is currently active and not expired'
ShareLinkMetadata:
type: object
properties:
id:
type: integer
share_token:
type: string
resource_type:
type: string
resource_id:
type: integer
settings:
$ref: '#/components/schemas/ShareLinkSettings'
is_enabled:
type: boolean
expires_at:
type: string
format: date-time
nullable: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
is_valid:
type: boolean
SharedDataResponse:
type: object
properties:
share_link:
type: object
properties:
resource_type:
type: string
settings:
$ref: '#/components/schemas/ShareLinkSettings'
data:
description: 'Resource data (object for single record, array for table view)'
oneOf:
-
type: object
-
type: array
items:
type: object
permissions:
type: object
properties:
allowDataExport:
type: boolean
allowViewersToOpenRecords:
type: boolean
NoteCreateRequest:
type: object
required:
- content
- attached_to
- attached_to_id
properties:
content:
type: string
maxLength: 5000
attached_to:
type: string
enum:
- project
- vendor
- model
- risk
- policy
- task
- incident
attached_to_id:
type: string
Note:
type: object
properties:
id:
type: integer
content:
type: string
author_id:
type: integer
attached_to:
type: string
attached_to_id:
type: string
organization_id:
type: integer
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
SearchResponse:
type: object
properties:
results:
type: object
description: 'Results grouped by entity type (projects, vendors, models, etc.)'
additionalProperties:
type: array
items:
type: object
description: 'Entity-specific result object'
totalCount:
type: integer
query:
type: string
message:
type: string
description: 'Present when query is too short'
ReportGenerateRequest:
type: object
required:
- projectId
- frameworkId
- projectFrameworkId
- reportType
properties:
projectId:
type: integer
frameworkId:
type: integer
projectFrameworkId:
type: integer
reportType:
oneOf:
-
type: string
enum:
- projectRisks
- vendorRisks
- modelRisks
- compliance
- assessment
- clausesAndAnnexes
- nistSubcategories
- vendors
- models
- trainingRegistry
- policyManager
- incidentManagement
- all
-
type: array
items:
type: string
reportName:
type: string
format:
type: string
enum:
- pdf
- docx
default: docx
aiEnhanced:
type: boolean
default: false
llmKeyId:
type: integer
description: 'LLM key ID for AI-enhanced reports'
GeneratedReport:
type: object
properties:
id:
type: integer
filename:
type: string
project_id:
type: integer
report_type:
type: string
created_by:
type: integer
organization_id:
type: integer
created_at:
type: string
format: date-time
DashboardData:
type: object
properties:
projects:
type: integer
description: 'Total project count'
trainings:
type: integer
description: 'Total training records'
models:
type: integer
description: 'Total model count'
reports:
type: integer
description: 'Total report count'
task_radar:
type: object
properties:
overdue:
type: integer
due:
type: integer
upcoming:
type: integer
projects_list:
type: array
items:
type: object
description: 'Project summary objects'
ConformityStep:
type: object
properties:
id:
type: integer
step:
type: string
description:
type: string
nullable: true
status:
type: string
enum:
- 'Not started'
- 'In progress'
- Completed
- 'Not needed'
owner:
type: string
nullable: true
dueDate:
type: string
format: date
nullable: true
completedDate:
type: string
format: date
nullable: true
CEMarkingResponse:
type: object
properties:
isHighRiskAISystem:
type: boolean
roleInProduct:
type: string
enum:
- standalone
- safety_component
- product_itself
annexIIICategory:
type: string
controlsCompleted:
type: integer
controlsTotal:
type: integer
assessmentsCompleted:
type: integer
assessmentsTotal:
type: integer
conformitySteps:
type: array
items:
$ref: '#/components/schemas/ConformityStep'
completedStepsCount:
type: integer
totalStepsCount:
type: integer
declarationStatus:
type: string
enum:
- draft
- ready
- signed
signedOn:
type: string
format: date
nullable: true
signatory:
type: string
nullable: true
declarationDocument:
type: string
nullable: true
registrationStatus:
type: string
enum:
- not_registered
- pending
- registered
euRegistrationId:
type: string
nullable: true
registrationDate:
type: string
format: date
nullable: true
euRecordUrl:
type: string
format: uri
nullable: true
policiesLinked:
type: integer
evidenceLinked:
type: integer
linkedPolicies:
type: array
items:
type: integer
linkedEvidences:
type: array
items:
type: integer
totalIncidents:
type: integer
aiActReportableIncidents:
type: integer
lastIncident:
type: string
format: date-time
nullable: true
linkedIncidents:
type: array
items:
type: integer
CEMarkingUpdateRequest:
type: object
properties:
isHighRiskAISystem:
type: boolean
roleInProduct:
type: string
annexIIICategory:
type: string
declarationStatus:
type: string
signedOn:
type: string
format: date
signatory:
type: string
declarationDocument:
type: string
registrationStatus:
type: string
euRegistrationId:
type: string
registrationDate:
type: string
format: date
euRecordUrl:
type: string
linkedPolicies:
type: array
items:
type: integer
linkedEvidences:
type: array
items:
type: integer
linkedIncidents:
type: array
items:
type: integer
conformitySteps:
type: array
items:
type: object
properties:
id:
type: integer
description:
type: string
status:
type: string
enum:
- 'Not started'
- 'In progress'
- Completed
- 'Not needed'
owner:
type: string
dueDate:
type: string
format: date
completedDate:
type: string
format: date
Role:
type: object
properties:
id:
type: integer
name:
type: string
enum:
- Admin
- Reviewer
- Editor
- Auditor
description:
type: string
SubscriptionCreateRequest:
type: object
required:
- organization_id
- tier_id
- status
- start_date
properties:
organization_id:
type: integer
tier_id:
type: integer
stripe_sub_id:
type: string
nullable: true
status:
type: string
enum:
- active
- cancelled
- past_due
- trialing
start_date:
type: string
format: date-time
end_date:
type: string
format: date-time
nullable: true
SubscriptionUpdateRequest:
type: object
properties:
tier_id:
type: integer
stripe_sub_id:
type: string
status:
type: string
enum:
- active
- cancelled
- past_due
- trialing
start_date:
type: string
format: date-time
end_date:
type: string
format: date-time
nullable: true
Subscription:
type: object
properties:
id:
type: integer
organization_id:
type: integer
tier_id:
type: integer
stripe_sub_id:
type: string
nullable: true
status:
type: string
start_date:
type: string
format: date-time
end_date:
type: string
format: date-time
nullable: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
TierFeatures:
type: object
description: 'Tier details with associated feature flags'
properties:
id:
type: integer
name:
type: string
features:
type: array
items:
type: object
properties:
id:
type: integer
name:
type: string
enabled:
type: boolean
ApiTokenCreateRequest:
type: object
required:
- name
- expires_in_days
properties:
name:
type: string
description: 'Descriptive name for the token'
expires_in_days:
type: integer
minimum: 1
description: 'Number of days until token expires'
ApiToken:
type: object
properties:
id:
type: integer
name:
type: string
expires_at:
type: string
format: date-time
created_by:
type: integer
organization_id:
type: integer
created_at:
type: string
format: date-time
ApiTokenCreated:
allOf:
-
$ref: '#/components/schemas/ApiToken'
-
properties:
token:
type: string
description: 'Full JWT token value (only shown on creation)'
LLMKeyCreateRequest:
type: object
required:
- name
- key
properties:
name:
type: string
enum:
- Anthropic
- OpenAI
- OpenRouter
- Custom
description: 'LLM provider name'
key:
type: string
description: 'API key value'
model:
type: string
description: 'Default model to use with this key'
url:
type: string
format: uri
description: 'Required for Custom provider; auto-populated for others'
custom_headers:
type: object
additionalProperties:
type: string
nullable: true
description: 'Optional custom headers (string key-value pairs)'
LLMKeyUpdateRequest:
type: object
properties:
name:
type: string
enum:
- Anthropic
- OpenAI
- OpenRouter
- Custom
key:
type: string
model:
type: string
url:
type: string
format: uri
custom_headers:
type: object
additionalProperties:
type: string
nullable: true
LLMKey:
type: object
properties:
id:
type: integer
name:
type: string
key:
type: string
description: 'Masked key value'
url:
type: string
model:
type: string
nullable: true
custom_headers:
type: object
additionalProperties:
type: string
nullable: true
organization_id:
type: integer
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
LLMKeyStatus:
type: object
properties:
hasKeys:
type: boolean
keyCount:
type: integer
providers:
type: array
items:
type: string
UserPreferenceCreateRequest:
type: object
required:
- user_id
- date_format
properties:
user_id:
type: integer
minimum: 1
date_format:
type: string
description: 'Preferred date format (e.g., YYYY-MM-DD, DD/MM/YYYY)'
UserPreferenceUpdateRequest:
type: object
properties:
date_format:
type: string
parallel_agents:
type: boolean
UserPreference:
type: object
properties:
id:
type: integer
user_id:
type: integer
date_format:
type: string
example: DD-MM-YYYY
language:
type: string
example: en
parallel_agents:
type: boolean
example: false
theme:
type: string
example: light
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
FileUploadResponse:
type: object
properties:
id:
type: integer
filename:
type: string
size:
type: integer
mimetype:
type: string
upload_date:
type: string
format: date-time
uploaded_by:
type: integer
modelId:
type: integer
nullable: true
review_status:
type: string
enum:
- draft
- pending_review
approval_workflow_id:
type: integer
nullable: true
approval_request_id:
type: integer
nullable: true
FileListResponse:
type: object
properties:
files:
type: array
items:
$ref: '#/components/schemas/FileListItem'
pagination:
$ref: '#/components/schemas/Pagination'
FileListItem:
type: object
properties:
id:
type: integer
filename:
type: string
size:
type: integer
formattedSize:
type: string
mimetype:
type: string
upload_date:
type: string
format: date-time
uploaded_by:
type: integer
uploader_name:
type: string
uploader_surname:
type: string
review_status:
type: string
approval_workflow_id:
type: integer
nullable: true
FileSearchResponse:
type: object
properties:
files:
type: array
items:
type: object
properties:
id:
type: integer
filename:
type: string
snippet:
type: string
description: 'Highlighted text snippet matching the query'
rank:
type: number
pagination:
$ref: '#/components/schemas/Pagination'
FileMetadata:
type: object
properties:
id:
type: integer
tags:
type: array
items:
type: string
review_status:
type: string
enum:
- draft
- pending_review
- approved
- rejected
- expired
version:
type: string
expiry_date:
type: string
format: date-time
nullable: true
description:
type: string
nullable: true
UpdateFileMetadataRequest:
type: object
properties:
tags:
type: array
items:
type: string
maxItems: 50
description: 'Each tag max 100 chars, alphanumeric/spaces/hyphens/underscores only'
review_status:
type: string
enum:
- draft
- pending_review
- approved
- rejected
- expired
version:
type: string
expiry_date:
type: string
format: date-time
description:
type: string
HighlightedFiles:
type: object
properties:
due_for_update:
type: array
items:
type: integer
pending_approval:
type: array
items:
type: integer
recently_modified:
type: array
items:
type: integer
VirtualFolder:
type: object
properties:
id:
type: integer
name:
type: string
description:
type: string
nullable: true
parent_id:
type: integer
nullable: true
color:
type: string
nullable: true
icon:
type: string
nullable: true
is_system:
type: boolean
file_count:
type: integer
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
CreateFolderRequest:
type: object
required:
- name
properties:
name:
type: string
maxLength: 255
description:
type: string
parent_id:
type: integer
nullable: true
description: 'Parent folder ID (null for root)'
color:
type: string
description: 'Hex color code'
icon:
type: string
description: 'Icon identifier'
UpdateFolderRequest:
type: object
properties:
name:
type: string
maxLength: 255
description:
type: string
parent_id:
type: integer
nullable: true
description: 'New parent (null to move to root). Cannot create circular refs.'
color:
type: string
icon:
type: string
AssignFilesRequest:
type: object
required:
- file_ids
properties:
file_ids:
type: array
items:
type: integer
minItems: 1
ConnectionTestResult:
type: object
properties:
success:
type: boolean
message:
type: string
testedAt:
type: string
format: date-time
ShadowAiToolStatus:
type: string
enum:
- detected
- under_review
- approved
- restricted
- blocked
- dismissed
ApiKeyCreateResponse:
type: object
properties:
id:
type: integer
key:
type: string
description: 'Full API key (shown only on creation)'
key_prefix:
type: string
label:
type: string
nullable: true
created_at:
type: string
format: date-time
ApiKeyRecord:
type: object
properties:
id:
type: integer
key_prefix:
type: string
label:
type: string
nullable: true
is_active:
type: boolean
created_at:
type: string
format: date-time
revoked_at:
type: string
format: date-time
nullable: true
InsightsSummary:
type: object
properties:
total_events:
type: integer
total_users:
type: integer
total_tools:
type: integer
total_departments:
type: integer
UserDetail:
type: object
properties:
email:
type: string
department:
type: string
tools:
type: array
items:
type: object
properties:
tool_name:
type: string
event_count:
type: integer
total_prompts:
type: integer
ShadowAiToolDetail:
type: object
properties:
id:
type: integer
name:
type: string
domain:
type: string
status:
$ref: '#/components/schemas/ShadowAiToolStatus'
first_seen:
type: string
format: date-time
last_seen:
type: string
format: date-time
event_count:
type: integer
user_count:
type: integer
departments:
type: array
items:
type: object
properties:
department:
type: string
user_count:
type: integer
top_users:
type: array
items:
type: object
properties:
email:
type: string
event_count:
type: integer
StartGovernanceRequest:
type: object
required:
- model_inventory
- governance_owner_id
properties:
model_inventory:
type: object
required:
- provider
- model
properties:
provider:
type: string
model:
type: string
version:
type: string
status:
type: string
enum:
- Approved
- Restricted
- Pending
- Blocked
- Retired
governance_owner_id:
type: integer
minimum: 1
start_lifecycle:
type: boolean
default: false
StartGovernanceResponse:
type: object
properties:
model_inventory_id:
type: integer
tool_id:
type: integer
lifecycle_initialized:
type: boolean
ShadowAiRule:
type: object
properties:
id:
type: integer
name:
type: string
description:
type: string
nullable: true
is_active:
type: boolean
trigger_type:
type: string
trigger_config:
type: object
actions:
type: array
items:
type: object
cooldown_minutes:
type: integer
nullable: true
notification_user_ids:
type: array
items:
type: integer
created_at:
type: string
format: date-time
CreateRuleRequest:
type: object
required:
- name
- trigger_type
- actions
properties:
name:
type: string
description:
type: string
is_active:
type: boolean
default: true
trigger_type:
type: string
trigger_config:
type: object
default: {}
actions:
type: array
items:
type: object
cooldown_minutes:
type: integer
notification_user_ids:
type: array
items:
type: integer
UpdateRuleRequest:
type: object
properties:
name:
type: string
description:
type: string
is_active:
type: boolean
trigger_type:
type: string
trigger_config:
type: object
actions:
type: array
items:
type: object
cooldown_minutes:
type: integer
notification_user_ids:
type: array
items:
type: integer
SyslogConfig:
type: object
properties:
id:
type: integer
source_identifier:
type: string
parser_type:
type: string
enum:
- zscaler
- netskope
- squid
- generic_kv
is_active:
type: boolean
created_at:
type: string
format: date-time
CreateSyslogConfigRequest:
type: object
required:
- source_identifier
- parser_type
properties:
source_identifier:
type: string
parser_type:
type: string
enum:
- zscaler
- netskope
- squid
- generic_kv
is_active:
type: boolean
default: true
UpdateSyslogConfigRequest:
type: object
properties:
source_identifier:
type: string
parser_type:
type: string
enum:
- zscaler
- netskope
- squid
- generic_kv
is_active:
type: boolean
ShadowAiSettings:
type: object
properties:
rate_limit_max_events_per_hour:
type: integer
retention_events_days:
type: integer
retention_daily_rollups_days:
type: integer
retention_alert_history_days:
type: integer
UpdateSettingsRequest:
type: object
properties:
rate_limit_max_events_per_hour:
type: integer
retention_events_days:
type: integer
retention_daily_rollups_days:
type: integer
retention_alert_history_days:
type: integer
PMMConfig:
type: object
properties:
id:
type: integer
project_id:
type: integer
frequency:
type: string
description: 'Monitoring frequency (e.g., "monthly", "quarterly")'
stakeholder_id:
type: integer
nullable: true
is_active:
type: boolean
questions_count:
type: integer
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
PMMConfigCreateRequest:
type: object
required:
- project_id
properties:
project_id:
type: integer
frequency:
type: string
stakeholder_id:
type: integer
is_active:
type: boolean
default: true
PMMConfigUpdateRequest:
type: object
properties:
frequency:
type: string
stakeholder_id:
type: integer
is_active:
type: boolean
PMMQuestion:
type: object
properties:
id:
type: integer
config_id:
type: integer
nullable: true
question_text:
type: string
question_type:
type: string
enum:
- yes_no
- multi_select
- multi_line_text
options:
type: array
items:
type: string
nullable: true
is_required:
type: boolean
is_default:
type: boolean
display_order:
type: integer
created_at:
type: string
format: date-time
PMMQuestionCreate:
type: object
required:
- question_text
- question_type
properties:
config_id:
type: integer
nullable: true
question_text:
type: string
question_type:
type: string
enum:
- yes_no
- multi_select
- multi_line_text
options:
type: array
items:
type: string
is_required:
type: boolean
default: false
display_order:
type: integer
PMMQuestionUpdate:
type: object
properties:
question_text:
type: string
question_type:
type: string
enum:
- yes_no
- multi_select
- multi_line_text
options:
type: array
items:
type: string
is_required:
type: boolean
display_order:
type: integer
PMMCycle:
type: object
properties:
id:
type: integer
config_id:
type: integer
project_id:
type: integer
project_title:
type: string
cycle_number:
type: integer
status:
type: string
enum:
- active
- completed
assigned_stakeholder_id:
type: integer
nullable: true
due_date:
type: string
format: date-time
nullable: true
completed_at:
type: string
format: date-time
nullable: true
created_at:
type: string
format: date-time
PMMResponse:
type: object
properties:
id:
type: integer
cycle_id:
type: integer
question_id:
type: integer
response_value:
type: string
is_flagged:
type: boolean
created_at:
type: string
format: date-time
PMMSaveResponsesRequest:
type: object
required:
- responses
properties:
responses:
type: array
minItems: 1
items:
type: object
required:
- question_id
- response_value
properties:
question_id:
type: integer
response_value:
type: string
is_flagged:
type: boolean
default: false
PMMSubmitCycleResponse:
type: object
properties:
message:
type: string
report_generated:
type: boolean
report_filename:
type: string
nullable: true
PMMReportsResponse:
type: object
properties:
reports:
type: array
items:
type: object
properties:
id:
type: integer
cycle_id:
type: integer
file_id:
type: integer
nullable: true
completed_by:
type: integer
created_at:
type: string
format: date-time
total:
type: integer
page:
type: integer
limit:
type: integer
TaskPriority:
type: string
enum:
- Low
- Medium
- High
description: 'Task priority level.'
TaskStatus:
type: string
enum:
- Open
- 'In Progress'
- Completed
- Overdue
- Deleted
description: 'Task lifecycle status. "Deleted" represents a soft-deleted (archived) task.'
EntityType:
type: string
enum:
- vendor
- model
- policy
- nist_subcategory
- iso42001_subclause
- iso42001_annexcategory
- iso27001_subclause
- iso27001_annexcontrol
- eu_control
- eu_subcontrol
description: 'Type of entity that can be linked to a task.'
CreateTaskRequest:
type: object
required:
- title
properties:
title:
type: string
example: 'Review vendor risk assessment'
description:
type: string
nullable: true
due_date:
type: string
format: date-time
nullable: true
example: '2026-05-15T00:00:00.000Z'
priority:
$ref: '#/components/schemas/TaskPriority'
status:
$ref: '#/components/schemas/TaskStatus'
categories:
type: array
items:
type: string
example:
- compliance
- vendor
assignees:
type: array
items:
oneOf:
-
type: integer
-
type: object
properties:
user_id: {type: integer}
required:
- user_id
example:
- 1
- 2
- 3
entity_links:
type: array
items:
type: object
properties:
entity_id:
type: integer
entity_type:
$ref: '#/components/schemas/EntityType'
entity_name:
type: string
UpdateTaskRequest:
type: object
properties:
title:
type: string
description:
type: string
nullable: true
due_date:
type: string
format: date-time
nullable: true
priority:
$ref: '#/components/schemas/TaskPriority'
status:
$ref: '#/components/schemas/TaskStatus'
categories:
type: array
items:
type: string
assignees:
type: array
items:
type: integer
entity_links:
type: array
items:
type: object
properties:
entity_id:
type: integer
entity_type:
$ref: '#/components/schemas/EntityType'
entity_name:
type: string
AddEntityLinkRequest:
type: object
required:
- entity_id
- entity_type
properties:
entity_id:
type: integer
example: 42
entity_type:
$ref: '#/components/schemas/EntityType'
entity_name:
type: string
example: 'Acme Corp'
Task:
type: object
properties:
id:
type: integer
example: 1
title:
type: string
example: 'Review vendor risk assessment'
description:
type: string
nullable: true
creator_id:
type: integer
organization_id:
type: integer
due_date:
type: string
format: date-time
nullable: true
priority:
$ref: '#/components/schemas/TaskPriority'
status:
$ref: '#/components/schemas/TaskStatus'
categories:
type: array
items:
type: string
is_demo:
type: boolean
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
TaskWithAssignees:
allOf:
-
$ref: '#/components/schemas/Task'
-
type: object
properties:
assignees:
type: array
items:
type: integer
TaskWithRelations:
allOf:
-
$ref: '#/components/schemas/Task'
-
type: object
properties:
assignees:
type: array
items:
type: integer
entity_links:
type: array
items:
$ref: '#/components/schemas/EntityLinkSummary'
TaskDetail:
allOf:
-
$ref: '#/components/schemas/Task'
-
type: object
properties:
assignees:
type: array
items:
type: integer
creator_name:
type: string
example: 'Jane Smith'
assignee_names:
type: array
items:
type: string
example:
- 'John Doe'
- 'Alice Johnson'
entity_links:
type: array
items:
$ref: '#/components/schemas/EntityLinkSummary'
EntityLinkSummary:
type: object
properties:
id:
type: integer
entity_id:
type: integer
entity_type:
$ref: '#/components/schemas/EntityType'
entity_name:
type: string
TaskEntityLink:
type: object
properties:
id:
type: integer
task_id:
type: integer
entity_id:
type: integer
entity_type:
$ref: '#/components/schemas/EntityType'
entity_name:
type: string
nullable: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
EnvelopeBase:
type: object
properties:
message:
type: string
required:
- message
EnvelopeEmpty:
allOf:
-
$ref: '#/components/schemas/EnvelopeBase'
-
type: object
properties:
message:
example: 'No Content'
data:
type: array
items: {}
example: []
EnvelopeNotFound:
allOf:
-
$ref: '#/components/schemas/EnvelopeBase'
-
type: object
properties:
message:
example: 'Not Found'
data:
nullable: true
example: null
EnvelopeBadRequest:
allOf:
-
$ref: '#/components/schemas/EnvelopeBase'
-
type: object
properties:
message:
example: 'Bad Request'
data:
type: string
example: 'Invalid training ID'
EnvelopeError:
type: object
properties:
message:
type: string
example: 'Internal Server Error'
error:
type: string
required:
- message
- error
Training:
type: object
properties:
id:
type: integer
example: 42
training_name:
type: string
example: 'AI Governance Fundamentals'
duration:
type: string
example: '2 hours'
provider:
type: string
example: Internal
department:
type: string
example: Compliance
status:
type: string
enum:
- Planned
- 'In Progress'
- Completed
example: Planned
numberOfPeople:
type: integer
example: 25
description:
type: string
example: 'Introductory course on EU AI Act compliance'
progressPercentage:
type: integer
enum:
- 0
- 50
- 100
example: 0
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
required:
- id
- training_name
- duration
- provider
- department
- status
- numberOfPeople
- description
- progressPercentage
TrainingCreateRequest:
type: object
required:
- training_name
- duration
- provider
- department
- status
- numberOfPeople
properties:
training_name:
type: string
example: 'AI Governance Fundamentals'
duration:
type: string
example: '2 hours'
provider:
type: string
example: Internal
department:
type: string
example: Compliance
status:
type: string
enum:
- Planned
- 'In Progress'
- Completed
example: Planned
numberOfPeople:
type: integer
example: 25
description:
type: string
example: 'Introductory course on EU AI Act compliance'
is_demo:
type: boolean
default: false
TrainingUpdateRequest:
type: object
properties:
training_name:
type: string
example: 'Advanced AI Risk Management'
duration:
type: string
example: '3 days'
provider:
type: string
example: External
department:
type: string
example: Engineering
status:
type: string
enum:
- Planned
- 'In Progress'
- Completed
example: 'In Progress'
numberOfPeople:
type: integer
example: 30
description:
type: string
example: 'Updated scope to cover ISO 42001'
TrainingListResponse:
allOf:
-
$ref: '#/components/schemas/EnvelopeBase'
-
type: object
properties:
message:
example: OK
data:
type: array
items:
$ref: '#/components/schemas/Training'
TrainingSingleResponse:
allOf:
-
$ref: '#/components/schemas/EnvelopeBase'
-
type: object
properties:
message:
example: OK
data:
$ref: '#/components/schemas/Training'
ChangeHistoryEntry:
type: object
properties:
id:
type: integer
example: 101
entity_type:
type: string
example: training
entity_id:
type: integer
example: 42
field_name:
type: string
example: status
old_value:
type: string
nullable: true
example: Planned
new_value:
type: string
nullable: true
example: 'In Progress'
change_type:
type: string
enum:
- created
- updated
- deleted
example: updated
changed_by:
type: integer
example: 5
user_name:
type: string
example: Gorkem
user_surname:
type: string
example: Cetin
organization_id:
type: integer
example: 1
created_at:
type: string
format: date-time
ChangeHistoryData:
type: object
required:
- data
- hasMore
- total
properties:
data:
type: array
items:
$ref: '#/components/schemas/ChangeHistoryEntry'
hasMore:
type: boolean
example: false
total:
type: integer
example: 5
ChangeHistoryResponse:
allOf:
-
$ref: '#/components/schemas/EnvelopeBase'
-
type: object
properties:
message:
example: OK
data:
$ref: '#/components/schemas/ChangeHistoryData'
CreateOrganizationRequest:
type: object
required:
- name
- userEmail
- userName
- userSurname
- userPassword
properties:
name:
type: string
example: 'Acme Corp'
logo:
type: string
format: uri
nullable: true
example: 'https://example.com/logo.png'
userEmail:
type: string
format: email
example: admin@acme.com
userName:
type: string
example: John
userSurname:
type: string
example: Doe
userPassword:
type: string
format: password
example: SecurePassword123!
UpdateOrganizationRequest:
type: object
properties:
name:
type: string
example: 'Acme Corporation'
logo:
type: string
format: uri
nullable: true
example: 'https://example.com/new-logo.png'
Organization:
type: object
properties:
id:
type: integer
example: 1
name:
type: string
example: 'Acme Corp'
logo:
type: string
nullable: true
example: 'https://example.com/logo.png'
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
onboarding_status:
type: string
enum:
- pending
- completed
example: pending
tenant_id:
type: string
nullable: true
example: a1b2c3d4e5
risk_assessment_mode:
type: string
enum:
- qualitative
- quantitative
example: qualitative
ageInDays:
type: integer
example: 45
OrganizationExistsResult:
type: object
properties:
exists:
type: boolean
example: true
CreateOrganizationResponse:
type: object
properties:
user:
$ref: '#/components/schemas/SafeUser'
organization:
type: object
properties:
id:
type: integer
example: 1
name:
type: string
example: 'Acme Corp'
token:
type: string
example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
SafeUser:
type: object
properties:
id:
type: integer
example: 1
email:
type: string
format: email
example: admin@acme.com
name:
type: string
example: John
surname:
type: string
example: Doe
role_id:
type: integer
example: 1
organization_id:
type: integer
example: 1
OnboardingStatusResponse:
type: object
properties:
onboarding_status:
type: string
enum:
- completed
example: completed
NotificationType:
type: string
enum:
- task_assigned
- task_updated
- task_completed
- review_requested
- review_approved
- review_rejected
- approval_requested
- approval_approved
- approval_rejected
- approval_complete
- policy_due_soon
- policy_overdue
- training_assigned
- training_completed
- vendor_review_due
- file_uploaded
- comment_added
- mention
- shadow_ai_alert
- ai_gateway_budget_warning
- ai_gateway_budget_exhausted
- ai_gateway_guardrail_spike
- ai_gateway_config_change
- ai_gateway_virtual_key_budget_exhausted
- system
- assignment_owner
- assignment_reviewer
- assignment_approver
- assignment_member
- assignment_assignee
- assignment_action_owner
NotificationEntityType:
type: string
enum:
- project
- task
- policy
- vendor
- model
- training
- file
- use_case
- risk
- assessment
- comment
- user
- shadow_ai_tool
- ai_gateway
NotificationJSON:
type: object
required:
- id
- user_id
- type
- title
- message
- is_read
- created_at
properties:
id:
type: integer
example: 42
user_id:
type: integer
example: 7
type:
$ref: '#/components/schemas/NotificationType'
title:
type: string
example: 'Task assigned to you'
message:
type: string
example: 'You have been assigned to task ''Review vendor contract''.'
entity_type:
allOf:
-
$ref: '#/components/schemas/NotificationEntityType'
nullable: true
entity_id:
type: integer
nullable: true
example: 15
entity_name:
type: string
nullable: true
example: 'Review vendor contract'
action_url:
type: string
nullable: true
example: /projects/3/tasks/15
is_read:
type: boolean
example: false
read_at:
type: string
format: date-time
nullable: true
created_at:
type: string
format: date-time
example: '2026-04-20T10:00:00.000Z'
created_by:
type: integer
nullable: true
example: 3
metadata:
type: object
nullable: true
additionalProperties: true
NotificationSummary:
type: object
required:
- unread_count
- total_count
- recent_notifications
properties:
unread_count:
type: integer
example: 3
total_count:
type: integer
example: 47
recent_notifications:
type: array
maxItems: 10
items:
$ref: '#/components/schemas/NotificationJSON'
RealtimeNotification:
type: object
required:
- type
- data
properties:
type:
type: string
enum:
- notification
data:
$ref: '#/components/schemas/NotificationJSON'
ApiEnvelope:
type: object
properties:
status:
type: integer
example: 200
data:
description: 'Response payload (varies per endpoint)'
FriaErrorEnvelope:
type: object
properties:
status:
type: integer
example: 400
data:
type: string
example: 'Invalid project ID'
DeletedResponse:
type: object
properties:
deleted:
type: boolean
example: true
FriaStatus:
type: string
enum:
- draft
- submitted
- approved
- rejected
FriaRiskLevel:
type: string
enum:
- Low
- Medium
- High
FriaLikelihood:
type: string
enum:
- Low
- Medium
- High
FriaSeverity:
type: string
enum:
- Low
- Medium
- High
FriaAssessment:
type: object
properties:
id:
type: integer
organization_id:
type: integer
project_id:
type: integer
version:
type: integer
status:
$ref: '#/components/schemas/FriaStatus'
assessment_owner:
type: string
nullable: true
assessment_date:
type: string
nullable: true
operational_context:
type: string
nullable: true
is_high_risk:
type: string
nullable: true
high_risk_basis:
type: string
nullable: true
deployer_type:
type: string
nullable: true
annex_iii_category:
type: string
nullable: true
first_use_date:
type: string
nullable: true
review_cycle:
type: string
nullable: true
period_frequency:
type: string
nullable: true
fria_rationale:
type: string
nullable: true
affected_groups:
type: string
nullable: true
vulnerability_context:
type: string
nullable: true
group_flags:
type: array
items:
type: string
nullable: true
risk_scenarios:
type: string
nullable: true
provider_info_used:
type: string
nullable: true
human_oversight:
type: string
nullable: true
transparency_measures:
type: string
nullable: true
redress_process:
type: string
nullable: true
data_governance:
type: string
nullable: true
legal_review:
type: string
nullable: true
dpo_review:
type: string
nullable: true
owner_approval:
type: string
nullable: true
stakeholders_consulted:
type: string
nullable: true
consultation_notes:
type: string
nullable: true
deployment_decision:
type: string
nullable: true
decision_conditions:
type: string
nullable: true
completion_pct:
type: integer
risk_score:
type: integer
risk_level:
$ref: '#/components/schemas/FriaRiskLevel'
rights_flagged:
type: integer
created_by:
type: integer
updated_by:
type: integer
nullable: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
nullable: true
project_title:
type: string
nullable: true
organization_name:
type: string
nullable: true
created_by_name:
type: string
nullable: true
updated_by_name:
type: string
nullable: true
FriaUpdateRequest:
type: object
properties:
status:
$ref: '#/components/schemas/FriaStatus'
assessment_owner:
type: string
assessment_date:
type: string
operational_context:
type: string
is_high_risk:
type: string
high_risk_basis:
type: string
deployer_type:
type: string
annex_iii_category:
type: string
first_use_date:
type: string
review_cycle:
type: string
period_frequency:
type: string
fria_rationale:
type: string
affected_groups:
type: string
vulnerability_context:
type: string
group_flags:
type: array
items:
type: string
risk_scenarios:
type: string
provider_info_used:
type: string
human_oversight:
type: string
transparency_measures:
type: string
redress_process:
type: string
data_governance:
type: string
legal_review:
type: string
dpo_review:
type: string
owner_approval:
type: string
stakeholders_consulted:
type: string
consultation_notes:
type: string
deployment_decision:
type: string
decision_conditions:
type: string
FriaFullResponse:
type: object
properties:
assessment:
$ref: '#/components/schemas/FriaAssessment'
rights:
type: array
items:
$ref: '#/components/schemas/FriaRight'
riskItems:
type: array
items:
$ref: '#/components/schemas/FriaRiskItem'
modelLinks:
type: array
items:
$ref: '#/components/schemas/FriaModelLink'
FriaRight:
type: object
properties:
id:
type: integer
organization_id:
type: integer
fria_id:
type: integer
right_key:
type: string
right_title:
type: string
charter_ref:
type: string
flagged:
type: boolean
severity:
type: integer
confidence:
type: integer
impact_pathway:
type: string
nullable: true
mitigation:
type: string
nullable: true
FriaRightsUpdateRequest:
type: object
required:
- rights
properties:
rights:
type: array
items:
type: object
required:
- right_key
properties:
right_key:
type: string
flagged:
type: boolean
severity:
type: integer
confidence:
type: integer
impact_pathway:
type: string
mitigation:
type: string
FriaRiskItem:
type: object
properties:
id:
type: integer
organization_id:
type: integer
fria_id:
type: integer
risk_description:
type: string
likelihood:
$ref: '#/components/schemas/FriaLikelihood'
severity:
$ref: '#/components/schemas/FriaSeverity'
existing_controls:
type: string
nullable: true
further_action:
type: string
nullable: true
linked_project_risk_id:
type: integer
nullable: true
sort_order:
type: integer
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
nullable: true
linked_risk_name:
type: string
nullable: true
linked_risk_description:
type: string
nullable: true
FriaRiskItemCreateRequest:
type: object
required:
- risk_description
properties:
risk_description:
type: string
likelihood:
$ref: '#/components/schemas/FriaLikelihood'
severity:
$ref: '#/components/schemas/FriaSeverity'
existing_controls:
type: string
further_action:
type: string
linked_project_risk_id:
type: integer
sort_order:
type: integer
FriaRiskItemUpdateRequest:
type: object
properties:
risk_description:
type: string
likelihood:
$ref: '#/components/schemas/FriaLikelihood'
severity:
$ref: '#/components/schemas/FriaSeverity'
existing_controls:
type: string
further_action:
type: string
linked_project_risk_id:
type: integer
sort_order:
type: integer
FriaModelLink:
type: object
properties:
id:
type: integer
organization_id:
type: integer
fria_id:
type: integer
model_id:
type: integer
provider:
type: string
nullable: true
model:
type: string
nullable: true
version:
type: string
nullable: true
model_status:
type: string
nullable: true
FriaEvidenceLinkRequest:
type: object
required:
- file_id
- entity_type
properties:
file_id:
type: integer
entity_type:
type: string
FriaSnapshot:
type: object
properties:
id:
type: integer
organization_id:
type: integer
fria_id:
type: integer
version:
type: integer
snapshot_data:
type: object
properties:
assessment:
$ref: '#/components/schemas/FriaAssessment'
rights:
type: array
items:
$ref: '#/components/schemas/FriaRight'
riskItems:
type: array
items:
$ref: '#/components/schemas/FriaRiskItem'
modelLinks:
type: array
items:
$ref: '#/components/schemas/FriaModelLink'
snapshot_reason:
type: string
nullable: true
created_by:
type: integer
created_at:
type: string
format: date-time
created_by_name:
type: string
nullable: true
FriaSubmitRequest:
type: object
properties:
reason:
type: string
StandardResponse:
type: object
properties:
message:
type: string
data:
description: 'Response payload (present on 1xx-4xx)'
error:
type: string
ErrorResponse400:
type: object
properties:
message:
type: string
example: 'Bad Request'
data:
type: string
example: 'userId query parameter is required'
ErrorResponse401:
type: object
properties:
message:
type: string
example: Unauthorized
data:
type: string
ErrorResponse403:
type: object
properties:
message:
type: string
example: Forbidden
data:
type: string
ErrorResponse404:
type: object
properties:
message:
type: string
example: 'Not Found'
data:
type: string
ErrorResponse500:
type: object
properties:
message:
type: string
example: 'Internal Server Error'
error:
type: string
SlackNotificationRoutingType:
type: string
enum:
- 'Membership and roles'
- 'Projects and organizations'
- 'Policy reminders and status'
- 'Evidence and task alerts'
- 'Control or policy changes'
SlackWebhookFull:
type: object
properties:
id:
type: integer
example: 1
access_token:
type: string
access_token_iv:
type: string
scope:
type: string
example: 'incoming-webhook,chat:write'
user_id:
type: integer
example: 5
team_name:
type: string
example: 'Acme Corp'
team_id:
type: string
example: T01234ABC
channel:
type: string
example: '#general'
channel_id:
type: string
example: C01234ABC
configuration_url:
type: string
format: uri
url:
type: string
url_iv:
type: string
is_active:
type: boolean
example: true
routing_type:
type: array
items:
$ref: '#/components/schemas/SlackNotificationRoutingType'
nullable: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
SlackWebhookJSON:
type: object
properties:
id:
type: integer
scope:
type: string
user_id:
type: integer
team_name:
type: string
team_id:
type: string
channel:
type: string
channel_id:
type: string
created_at:
type: string
format: date-time
is_active:
type: boolean
routing_type:
type: array
items:
$ref: '#/components/schemas/SlackNotificationRoutingType'
nullable: true
CreateSlackWebhookRequest:
type: object
required:
- code
- userId
properties:
code:
type: string
example: 1234567890.abcdef
userId:
type: integer
example: 5
UpdateSlackWebhookRequest:
type: object
properties:
is_active:
type: boolean
example: false
routing_type:
type: array
items:
$ref: '#/components/schemas/SlackNotificationRoutingType'
SendSlackMessageRequest:
type: object
required:
- title
- message
properties:
title:
type: string
example: 'New policy update'
message:
type: string
example: 'Policy *Data Retention* has been updated.'
SlackMessageSentResult:
type: object
properties:
success:
type: boolean
example: true
messageId:
type: string
example: '1234567890.123456'
channel:
type: string
example: C01234ABC
GitHubTokenStatus:
type: object
properties:
configured:
type: boolean
example: true
token_name:
type: string
example: 'GitHub Personal Access Token'
last_used_at:
type: string
format: date-time
nullable: true
created_at:
type: string
format: date-time
SaveGitHubTokenRequest:
type: object
required:
- token
properties:
token:
type: string
example: ghp_your_token_here
token_name:
type: string
default: 'GitHub Personal Access Token'
example: 'CI/CD Scanner Token'
TestGitHubTokenRequest:
type: object
required:
- token
properties:
token:
type: string
example: ghp_your_token_here
GitHubTokenTestResult:
type: object
properties:
valid:
type: boolean
example: true
scopes:
type: array
items:
type: string
example:
- repo
- 'read:org'
rate_limit:
type: object
properties:
limit:
type: integer
example: 5000
remaining:
type: integer
example: 4999
reset:
type: string
format: date-time
error:
type: string
example: 'Invalid or expired token'
GitHubWebhookPayload:
type: object
required:
- repository
properties:
repository:
type: object
required:
- owner
- name
properties:
owner:
type: object
required:
- login
properties:
login:
type: string
example: verifywise-ai
name:
type: string
example: verifywise
ref:
type: string
example: refs/heads/main
action:
type: string
example: opened
pull_request:
type: object
GitHubWebhookResult:
type: object
properties:
triggered:
type: boolean
reason:
type: string
example: 'Scan triggered for push to main'
GitHubWebhookPong:
type: object
properties:
message:
type: string
example: pong
GitHubWebhookSkipped:
type: object
properties:
message:
type: string
example: 'Repository not registered or CI not enabled'
SuccessResponse_SlackWebhookArray:
type: object
properties:
message:
type: string
example: OK
data:
type: array
items:
$ref: '#/components/schemas/SlackWebhookFull'
SuccessResponse_SlackWebhookJSON:
type: object
properties:
message:
type: string
example: OK
data:
$ref: '#/components/schemas/SlackWebhookJSON'
CreatedResponse_SlackWebhookFull:
type: object
properties:
message:
type: string
example: Created
data:
$ref: '#/components/schemas/SlackWebhookFull'
AcceptedResponse_SlackWebhookFull:
type: object
properties:
message:
type: string
example: Accepted
data:
$ref: '#/components/schemas/SlackWebhookFull'
SuccessResponse_SlackMessageSent:
type: object
properties:
message:
type: string
example: OK
data:
$ref: '#/components/schemas/SlackMessageSentResult'
SuccessResponse_GitHubTokenStatus:
type: object
properties:
message:
type: string
example: OK
data:
$ref: '#/components/schemas/GitHubTokenStatus'
CreatedResponse_GitHubTokenStatus:
type: object
properties:
message:
type: string
example: Created
data:
$ref: '#/components/schemas/GitHubTokenStatus'
SuccessResponse_GitHubTokenDeleted:
type: object
properties:
message:
type: string
example: OK
data:
type: object
properties:
message:
type: string
example: 'GitHub token deleted successfully'
SuccessResponse_GitHubTokenTest:
type: object
properties:
message:
type: string
example: OK
data:
$ref: '#/components/schemas/GitHubTokenTestResult'
tags:
-
name: 'AI Advisor'
-
name: 'AI Approval Rules'
-
name: 'AI Approvals'
-
name: 'AI Apps'
-
name: 'AI Audit'
-
name: 'AI Confirmation'
-
name: 'AI Content'
-
name: 'AI Detection'
-
name: 'AI Gateway'
-
name: 'AI Trust Centre'
-
name: 'Agent Discovery'
-
name: 'Ai Trust Index'
-
name: 'Approval Workflows'
-
name: Assessments
-
name: Audit
-
name: Authentication
-
name: Automations
-
name: 'CE Marking'
-
name: 'Change History'
-
name: Compliance
-
name: 'Custom Fields'
-
name: Dashboard
-
name: 'Data Retention'
-
name: Datasets
-
name: Deadlines
-
name: 'Demo Data'
-
name: 'EU AI Act'
-
name: 'Entity Graph'
-
name: 'Eu Ai Act Classification'
-
name: Evidence
-
name: 'Evidence AI'
-
name: Extensions
-
name: 'Extensions/Jira Incidents'
-
name: FRIA
-
name: Files
-
name: Frameworks
-
name: 'Governance OS'
-
name: 'ISO 27001'
-
name: 'ISO 42001'
-
name: Incidents
-
name: 'Intake Forms'
-
name: Integrations
-
name: Internal
-
name: Invitations
-
name: 'LLM Evals'
-
name: 'LLM Keys'
-
name: Mail
-
name: Mcp
-
name: 'Model Inventory'
-
name: 'Model Risks'
-
name: Mrm
-
name: 'NIST AI RMF'
-
name: Notes
-
name: Notifications
-
name: Observability
-
name: Organizations
-
name: Policies
-
name: 'Post-Market Monitoring'
-
name: 'Project Risks'
-
name: Projects
-
name: 'Quantitative Risks'
-
name: Readiness
-
name: Reporting
-
name: Reporting/Runs
-
name: 'Reporting/Scheduled Reports'
-
name: Reporting/Templates
-
name: 'Risk Benchmarks'
-
name: 'Risk History'
-
name: RiskLinks
-
name: Roles
-
name: 'SSO Config'
-
name: Search
-
name: Settings
-
name: 'Shadow AI'
-
name: 'Share Links'
-
name: Subscriptions
-
name: 'Super Admin'
-
name: System
-
name: Tasks
-
name: Telemetry
-
name: Training
-
name: Users
-
name: 'Vendor Risks'
-
name: Vendors
-
name: Webhooks
paths:
/webhooks/github:
post:
tags:
- Webhooks
summary: 'Github Webhook Controller'
operationId: githubWebhookController
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'500':
description: 'Internal server error'
/users:
get:
summary: 'List all users in organization'
description: "Returns all users belonging to the authenticated user's organization,\nordered by created_at DESC, id ASC. Password hashes are excluded.\n"
tags:
- Users
security:
-
bearerAuth: []
responses:
'200':
description: 'Users found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/UserSafe'}}
'204':
description: 'No users found (empty organization)'
'500':
description: 'Internal server error'
operationId: getAllUsers
/users/preferences:
get:
summary: 'Get current user preferences'
description: "Returns the authenticated user's persisted preferences (date_format,\nlanguage, parallel_agents) from user_preferences. If no row exists, returns safe\ndefaults including a transient theme default and parallel_agents false.\n"
tags:
- Users
security:
-
bearerAuth: []
responses:
'200':
description: 'Preferences found or defaults returned'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/UserPreference'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
operationId: getPreferencesForCurrentUser
/users/me/preferences:
get:
summary: 'Get current user preferences'
description: "Returns the authenticated user's persisted preferences (date_format,\nlanguage, parallel_agents) from user_preferences. If no row exists, returns safe\ndefaults including a transient theme default and parallel_agents false. Preferred alias of\nGET /users/preferences.\n"
tags:
- Users
security:
-
bearerAuth: []
responses:
'200':
description: 'Preferences found or defaults returned'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/UserPreference'}
'401':
description: Unauthorized
'404':
description: 'User not found'
'500':
description: 'Internal server error'
operationId: users_getPreferencesForCurrentUser
patch:
summary: 'Update current user preferences'
description: "Upserts the authenticated user's date_format, language, and/or\nparallel_agents. At least one field is required. Unknown format strings,\nlanguages, and non-boolean parallel_agents values are rejected.\nAny user_id in the body is ignored; the JWT user is always the target.\n"
tags:
- Users
security:
-
bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
date_format:
type: string
enum: [DD-MM-YYYY, MM-DD-YYYY, DD/MM/YY, MM/DD/YY]
example: MM-DD-YYYY
language:
type: string
enum: [en, de, fr, es]
example: en
parallel_agents:
type: boolean
example: false
responses:
'200':
description: 'Preferences saved'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/UserPreference'}
'400':
description: 'Validation error (missing fields or unknown format/language)'
'401':
description: Unauthorized
'404':
description: 'User not found'
'500':
description: 'Internal server error'
operationId: patchPreferencesForCurrentUser
'/users/{id}':
get:
summary: 'Get user by ID'
description: "Retrieves a single user by their numeric ID. Super-admins can access\nany user; regular users can only access users within their organization\n(or their own record).\n"
tags:
- Users
security:
-
bearerAuth: []
parameters:
-
in: path
name: id
required: true
schema:
type: integer
description: 'User ID'
responses:
'200':
description: 'User found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/UserSafe'}
'403':
description: 'Access denied (user belongs to different organization)'
'404':
description: 'User not found'
'500':
description: 'Internal server error'
operationId: getUserById
patch:
summary: 'Update user by ID'
description: "Updates user fields (name, surname, email, roleId, last_login).\nOnly provided fields are updated. Organization isolation enforced.\nSends Slack notification on role change. Sends email notification\nwhen role changes from Editor (3) to Admin (1).\n"
tags:
- Users
security:
-
bearerAuth: []
parameters:
-
in: path
name: id
required: true
schema:
type: integer
description: 'User ID to update'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
name:
type: string
description: 'First name'
example: Jane
surname:
type: string
description: 'Last name'
example: Smith
email:
type: string
format: email
example: jane@example.com
roleId:
type: integer
description: 'New role ID (1=Admin, 2=Reviewer, 3=Editor, 4=Auditor). Can be sent as string.'
example: 1
last_login:
type: string
format: date-time
description: 'Override last login timestamp'
description: 'All fields are optional; only provided fields are updated'
responses:
'202':
description: 'User updated'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {$ref: '#/components/schemas/UserSafe'}
'400':
description: 'Validation error'
'403':
description: 'Access denied or business logic error'
'404':
description: 'User not found'
'500':
description: 'Internal server error'
operationId: updateUserById
delete:
summary: 'Delete user by ID'
description: 'Requires role: Admin or SuperAdmin'
tags:
- Users
security:
-
bearerAuth: []
parameters:
-
in: path
name: id
required: true
schema:
type: integer
description: 'User ID to delete'
responses:
'202':
description: 'User deleted'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {type: boolean, description: 'true if deletion succeeded'}
'403':
description: 'Forbidden: demo user, super-admin, or wrong organization'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'404':
description: 'User not found'
'500':
description: 'Internal server error'
operationId: deleteUserById
/users/register:
post:
summary: 'Register a new user'
description: "Creates a new user account. Requires a valid registration JWT (set by registerJWT middleware).\nValidates email uniqueness, password strength, and required fields.\nThe account takes the invited email, role and organization from the invitation link, which must match the current pending invitation (a resent or re-invited link replaces earlier ones). The invitation is accepted in the same transaction, so a link registers once; a link that was revoked, used or replaced is refused with 403.\n"
tags:
- Users
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- name
- surname
- email
- password
- roleId
- organizationId
properties:
name:
type: string
description: 'User''s first name'
example: John
surname:
type: string
description: 'User''s last name'
example: Doe
email:
type: string
format: email
example: john@example.com
password:
type: string
format: password
description: 'Must be 8+ chars with uppercase, lowercase, and digit'
example: SecurePassword123!
roleId:
type: integer
description: '1=Admin, 2=Reviewer, 3=Editor, 4=Auditor'
example: 3
organizationId:
type: integer
description: 'Organization to assign the user to'
example: 1
responses:
'201':
description: 'User created successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Created}
data: {$ref: '#/components/schemas/UserSafe'}
'400':
description: 'Validation error (missing fields, weak password, invalid email)'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'403':
description: 'Business logic error'
'409':
description: 'User with this email already exists'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'500':
description: 'Internal server error'
operationId: createNewUser
/users/login:
post:
summary: 'Authenticate user'
description: "Validates email/password credentials via bcrypt. Returns a JWT access token\nin the response body and sets a refresh token in an HTTP-only cookie.\nRate-limited to 5 requests per minute per IP.\n"
tags:
- Users
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- email
- password
properties:
email:
type: string
format: email
example: user@example.com
password:
type: string
format: password
example: SecurePassword123!
responses:
'202':
description: 'Authentication successful'
headers:
Set-Cookie:
schema:
type: string
description: 'refresh_token=; Path=/api/users; HttpOnly; Secure (prod); SameSite=none (prod) / lax (dev)'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {type: object, properties: {token: {type: string, description: 'JWT access token'}, isSuperAdmin: {type: boolean, description: 'Only present when user is super-admin (role_id=5)'}, onboarding_status: {type: string, description: 'Organization onboarding status (not present for super-admin)', example: completed}, is_org_creator: {type: boolean, description: 'Whether user is the first admin of the org (not present for super-admin)'}}}
'401':
description: 'Invalid email or password'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'429':
description: 'Too many login attempts'
'500':
description: 'Internal server error'
operationId: loginUser
/users/login-microsoft:
post:
summary: 'Login User With Microsoft'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Users
operationId: loginUserWithMicrosoft
/users/refresh-token:
post:
summary: 'Refresh access token'
description: "Reads the refresh_token from an HTTP-only cookie and issues a new\nJWT access token if the refresh token is still valid.\n"
tags:
- Users
parameters:
-
in: cookie
name: refresh_token
required: true
schema:
type: string
description: 'JWT refresh token set during login'
responses:
'200':
description: 'New access token issued'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: object, properties: {token: {type: string, description: 'New JWT access token'}}}
'400':
description: 'Refresh token missing from cookie'
'401':
description: 'Invalid refresh token'
'406':
description: 'Refresh token expired'
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {type: object, properties: {message: {type: string, example: 'Token expired'}}}
'500':
description: 'Internal server error'
operationId: refreshAccessToken
/users/logout:
post:
summary: 'Log out current session'
description: "Revokes the presented refresh token server-side and clears the\nrefresh_token cookie. No bearer token required: only the token presented\nin the cookie is revoked.\n"
tags:
- Users
parameters:
-
in: cookie
name: refresh_token
required: false
schema:
type: string
description: 'JWT refresh token set during login'
responses:
'200':
description: 'Logged out; refresh token revoked and cookie cleared'
'500':
description: 'Internal server error'
operationId: logoutUser
/users/reset-password:
post:
summary: 'Reset user password'
description: "Resets the password for a user identified by email. Protected by\nresetPasswordMiddleware (validates reset token/permission).\nPassword is hashed via bcrypt before storage.\n"
tags:
- Users
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- email
- newPassword
properties:
email:
type: string
format: email
example: user@example.com
newPassword:
type: string
format: password
description: 'Must be 8+ chars with uppercase, lowercase, and digit'
example: NewSecure123!
responses:
'202':
description: 'Password reset successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {$ref: '#/components/schemas/UserSafe'}
'400':
description: 'Validation error (weak password)'
'403':
description: 'Business logic error'
'404':
description: 'User not found'
'500':
description: 'Internal server error'
operationId: resetPassword
'/users/chng-pass/{id}':
patch:
summary: 'Change password (authenticated)'
description: "Changes the password for the authenticated user. Requires the current\npassword for verification. Protected by selfOnly middleware (users can\nonly change their own password). Rate-limited.\n"
tags:
- Users
security:
-
bearerAuth: []
parameters:
-
in: path
name: id
required: true
schema:
type: integer
description: 'User ID (must match authenticated user via selfOnly middleware)'
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- id
- currentPassword
- newPassword
properties:
id:
type: integer
description: 'User ID (must match path parameter)'
example: 1
currentPassword:
type: string
format: password
description: 'Current password for verification'
example: OldPassword123!
newPassword:
type: string
format: password
description: 'Must be 8+ chars with uppercase, lowercase, and digit'
example: NewPassword456!
responses:
'202':
description: 'Password changed successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Password updated successfully'}
data: {$ref: '#/components/schemas/UserSafe'}
'400':
description: 'Validation error (weak password, missing fields)'
content:
application/json:
schema:
type: object
properties:
message: {type: string}
'403':
description: 'Business logic error (wrong current password)'
content:
application/json:
schema:
type: object
properties:
message: {type: string}
'404':
description: 'User not found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'User not found'}
'500':
description: 'Internal server error'
operationId: ChangePassword
/users/check/exists:
get:
summary: 'Check if any user exists'
description: "Returns a boolean indicating whether any user record exists in the database.\nUsed during initial setup flow to determine if onboarding is needed.\n"
tags:
- Users
security:
-
bearerAuth: []
responses:
'200':
description: 'Check result'
content:
application/json:
schema:
type: boolean
example: true
'500':
description: 'Internal server error'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Internal server error'}
operationId: checkUserExists
'/users/{id}/calculate-progress':
get:
summary: 'Calculate user project progress'
description: "Computes completion metrics across all projects the user is a member of.\nCalculates subcontrol completion (status=\"Done\") and assessment question\ncompletion (has answer) per project and as aggregated totals.\n"
tags:
- Users
security:
-
bearerAuth: []
parameters:
-
in: path
name: id
required: true
schema:
type: integer
description: 'User ID to calculate progress for'
responses:
'200':
description: 'Progress calculated'
content:
application/json:
schema:
$ref: '#/components/schemas/ProgressResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Internal server error'}
operationId: calculateProgress
'/users/{id}/profile-photo':
post:
summary: 'Upload profile photo'
description: "Uploads a profile photo for the specified user. The file is stored in the\ntenant-scoped files table. If the user already has a profile photo, the old\none is deleted and replaced. Uses multer for multipart file handling.\n"
tags:
- Users
security:
-
bearerAuth: []
parameters:
-
in: path
name: id
required: true
schema:
type: integer
description: 'User ID'
requestBody:
required: true
content:
multipart/form-data:
schema:
type: object
required:
- photo
properties:
photo:
type: string
format: binary
description: 'Image file (JPEG, PNG, etc.)'
responses:
'200':
description: 'Profile photo uploaded'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: object, properties: {profile_photo_id: {type: integer, description: 'ID of the new file record'}}}
'400':
description: 'No file provided'
'403':
description: 'Access denied (wrong organization)'
'500':
description: 'Internal server error'
operationId: uploadUserProfilePhoto
get:
summary: 'Get profile photo'
description: "Returns the profile photo binary content for the specified user.\nThe response includes the raw file content and its MIME type.\n"
tags:
- Users
security:
-
bearerAuth: []
parameters:
-
in: path
name: id
required: true
schema:
type: integer
description: 'User ID'
responses:
'200':
description: 'Profile photo returned'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: object, properties: {content: {type: string, format: byte, description: 'Base64-encoded file content'}, type: {type: string, description: 'MIME type', example: image/png}}}
'404':
description: 'No profile photo found'
'500':
description: 'Internal server error'
operationId: getUserProfilePhoto
delete:
summary: 'Delete profile photo'
description: "Removes the profile photo from the user record and deletes the associated\nfile from the files table.\n"
tags:
- Users
security:
-
bearerAuth: []
parameters:
-
in: path
name: id
required: true
schema:
type: integer
description: 'User ID'
responses:
'200':
description: 'Profile photo deleted'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: boolean, description: 'true if photo was deleted'}
'500':
description: 'Internal server error'
operationId: deleteUserProfilePhoto
'/vendorRisks/by-projid/{id}':
get:
tags:
- 'Vendor Risks'
summary: 'Get All Vendor Risks'
operationId: getAllVendorRisks
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: string
-
name: filter
in: query
required: false
schema:
type: string
enum:
- active
- deleted
- all
default: active
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {type: array, items: {$ref: '#/components/schemas/VendorRiskResponse'}}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/vendorRisks/by-vendorid/{id}':
get:
tags:
- 'Vendor Risks'
summary: 'Get All Vendor Risks By Vendor Id'
operationId: getAllVendorRisksByVendorId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
-
name: filter
in: query
required: false
schema:
type: string
enum:
- active
- deleted
- all
default: active
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {type: array, items: {$ref: '#/components/schemas/VendorRiskResponse'}}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/vendorRisks/by-frameworkid/{id}':
get:
summary: 'Get Vendor Risks By Framework Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Vendor Risks'
operationId: getVendorRisksByFrameworkId
security:
-
bearerAuth: []
/vendorRisks/all:
get:
tags:
- 'Vendor Risks'
summary: 'Get All Vendor Risks All Projects'
operationId: getAllVendorRisksAllProjects
security:
-
bearerAuth: []
parameters:
-
name: filter
in: query
required: false
schema:
type: string
enum:
- active
- deleted
- all
default: active
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {type: array, items: {$ref: '#/components/schemas/VendorRiskAllProjectsResponse'}}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/vendorRisks/{id}':
get:
tags:
- 'Vendor Risks'
summary: 'Get Vendor Risk By Id'
operationId: getVendorRiskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/VendorRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- 'Vendor Risks'
summary: 'Update Vendor Risk By Id'
operationId: updateVendorRiskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/VendorRiskInput'
responses:
'202':
description: Accepted
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/VendorRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Vendor Risks'
summary: 'Delete Vendor Risk By Id'
operationId: deleteVendorRiskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'202':
description: Accepted
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/VendorRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/vendorRisks:
post:
tags:
- 'Vendor Risks'
summary: 'Create Vendor Risk'
operationId: createVendorRisk
security:
-
bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/VendorRiskInput'
responses:
'201':
description: 'Created successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/VendorRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/vendors:
get:
tags:
- Vendors
summary: 'Get all vendors'
description: 'Retrieves all vendors for the authenticated user''s organization, ordered by creation date descending. Each vendor includes its associated project IDs and the reviewer''s full name.'
security:
-
bearerAuth: []
responses:
'200':
description: 'Vendors retrieved successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/VendorWithReviewerName'}}
'204':
description: 'No vendors found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'No Content'}
data: {type: 'null'}
'401':
description: 'Unauthorized - missing or invalid JWT'
'500':
description: 'Internal server error'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Internal Server Error'}
error: {type: string}
operationId: getAllVendors
post:
tags:
- Vendors
summary: 'Create a vendor'
description: "Creates a new vendor in the authenticated user's organization.\nValidates required fields, checks demo restrictions, associates\nprojects via the vendors_projects join table, records creation\nin change history, fires automation triggers (vendor_added),\nand sends in-app assignment notifications to assignee and reviewer.\n"
security:
-
bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/VendorInput'
responses:
'201':
description: 'Vendor created successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Created}
data: {$ref: '#/components/schemas/Vendor'}
'400':
description: 'Validation error (missing or invalid required fields)'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Bad Request'}
data: {type: string, description: 'Validation error message'}
'401':
description: 'Unauthorized - missing or invalid JWT'
'403':
description: 'Business logic error (e.g. demo vendor restriction)'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Forbidden}
data: {type: string}
'500':
description: 'Internal server error'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Internal Server Error'}
error: {type: string}
'503':
description: 'Service unavailable - vendor creation returned null'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Service Unavailable'}
error: {type: object}
operationId: createVendor
'/vendors/project-id/{id}':
get:
tags:
- Vendors
summary: 'Get vendors by project ID'
description: 'Retrieves all vendors associated with a specific project. Returns 404 if the project does not exist.'
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
description: 'Project ID'
responses:
'200':
description: 'Vendors retrieved successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/Vendor'}}
'401':
description: 'Unauthorized - missing or invalid JWT'
'404':
description: 'Project not found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Not Found'}
data: {type: array, items: {}}
'500':
description: 'Internal server error'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Internal Server Error'}
error: {type: string}
operationId: getVendorByProjectId
'/vendors/{id}':
get:
tags:
- Vendors
summary: 'Get vendor by ID'
description: 'Retrieves a single vendor by its ID, including associated project IDs.'
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
description: 'Vendor ID'
responses:
'200':
description: 'Vendor retrieved successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/Vendor'}
'401':
description: 'Unauthorized - missing or invalid JWT'
'404':
description: 'Vendor not found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Not Found'}
data: {type: 'null'}
'500':
description: 'Internal server error'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Internal Server Error'}
error: {type: string}
operationId: getVendorById
patch:
tags:
- Vendors
summary: 'Update a vendor'
description: "Partially updates an existing vendor. Only provided fields are updated.\nReview and scorecard fields can be explicitly set to null to clear them.\nRequired fields (vendor_name, vendor_provides, website, vendor_contact_person)\nare only updated if they have a non-empty value.\nRecords field-level changes in change history, fires automation triggers\n(vendor_updated), and sends in-app notifications when assignee or reviewer changes.\n"
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
description: 'Vendor ID'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/VendorUpdate'
responses:
'202':
description: 'Vendor updated successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {$ref: '#/components/schemas/Vendor'}
'400':
description: 'Validation error'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Bad Request'}
data: {type: string}
'401':
description: 'Unauthorized - missing or invalid JWT, or missing userId/role'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Unauthorized}
'403':
description: 'Business logic error (e.g. demo vendor restriction)'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Forbidden}
data: {type: string}
'404':
description: 'Vendor not found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Not Found'}
data: {type: object}
'500':
description: 'Internal server error'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Internal Server Error'}
error: {type: string}
operationId: updateVendorById
delete:
tags:
- Vendors
summary: 'Delete a vendor'
description: "Deletes a vendor and all associated data in a transaction:\n1. Deletes vendor risks (vendor_risks table)\n2. Deletes project associations (vendors_projects table)\n3. Deletes the vendor record itself\nFires automation triggers (vendor_deleted).\n"
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
description: 'Vendor ID'
responses:
'202':
description: 'Vendor deleted successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {type: boolean, example: true}
'401':
description: 'Unauthorized - missing or invalid JWT'
'404':
description: 'Vendor not found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Not Found'}
data: {type: object}
'500':
description: 'Internal server error'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Internal Server Error'}
error: {type: string}
operationId: deleteVendorById
'/vendors/{id}/riskSuggestions':
get:
summary: 'Get Vendor Risk Suggestions'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Vendors
operationId: getVendorRiskSuggestions
security:
-
bearerAuth: []
'/vendor-change-history/{id}':
get:
tags:
- 'Change History'
summary: 'Get Vendor Change History By Id'
operationId: getVendorChangeHistoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/projects:
get:
summary: 'Get all projects'
description: "Returns all projects visible to the authenticated user. Admins and SuperAdmins see all projects in the organization; other roles see only projects they own or are members of.\n"
operationId: getAllProjects
tags:
- Projects
security:
-
bearerAuth: []
responses:
'200':
description: 'List of projects retrieved successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/ProjectListItem'}}
'401':
description: 'Unauthorized — missing or invalid JWT'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
post:
summary: 'Create a new project (use case)'
description: "Creates a new project with associated members and frameworks. If an approval_workflow_id is provided, framework creation is deferred until the approval request is approved.\n"
operationId: createProject
tags:
- Projects
security:
-
bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateProjectRequest'
responses:
'201':
description: 'Project created successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Created}
data: {type: object, properties: {project: {$ref: '#/components/schemas/Project'}, frameworks: {type: object, additionalProperties: true}}}
'400':
description: 'Validation error'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'403':
description: 'Business logic error (e.g. framework not allowed)'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'503':
description: 'Service unavailable — project creation returned null'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'/projects/calculateProjectRisks/{id}':
get:
summary: 'Calculate project risk distribution'
operationId: getProjectRisksCalculations
tags:
- Projects
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/ProjectId'
responses:
'200':
description: 'Risk calculations returned'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/ProjectRiskCount'}}
'204':
description: 'No risk data available'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'No Content'}
data: {nullable: true}
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'/projects/calculateVendorRisks/{id}':
get:
summary: 'Calculate vendor risk distribution'
operationId: getVendorRisksCalculations
tags:
- Projects
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/ProjectId'
responses:
'200':
description: 'Vendor risk calculations returned'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/VendorRiskCount'}}
'204':
description: 'No vendor risk data available'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'No Content'}
data: {nullable: true}
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'/projects/{id}':
get:
summary: 'Get a project by ID'
description: 'Returns a single project with its frameworks, owner name, members, and approval status.'
operationId: getProjectById
tags:
- Projects
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/ProjectId'
responses:
'200':
description: 'Project found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/ProjectDetail'}
'404':
description: 'Project not found'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
patch:
summary: 'Update a project by ID'
description: 'Partially updates a project and its member list. Only provided fields are updated.'
operationId: updateProjectById
tags:
- Projects
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/ProjectId'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateProjectRequest'
responses:
'202':
description: 'Project updated successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {$ref: '#/components/schemas/ProjectWithMembers'}
'400':
description: 'Validation error'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'403':
description: 'Business logic error'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: 'Project not found'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
delete:
summary: 'Delete a project by ID'
description: 'Deletes a project and all dependent entities (files, risks, members, framework data).'
operationId: deleteProjectById
tags:
- Projects
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/ProjectId'
responses:
'202':
description: 'Project deleted successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {type: boolean, example: true}
'404':
description: 'Project not found'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'/projects/stats/{id}':
get:
summary: 'Get project statistics by ID'
operationId: getProjectStatsById
tags:
- Projects
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/ProjectId'
responses:
'202':
description: 'Project stats retrieved'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {$ref: '#/components/schemas/ProjectStats'}
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'/projects/complainces/{projid}':
get:
summary: 'Get compliance data for a project'
operationId: getCompliances
tags:
- Projects
security:
-
bearerAuth: []
parameters:
-
name: projid
in: path
required: true
description: 'The project ID'
schema:
type: integer
responses:
'200':
description: 'Compliance data returned'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/ControlCategory'}}
'404':
description: 'Project not found'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'/projects/compliance/progress/{id}':
get:
summary: 'Get compliance progress for a single project'
operationId: projectComplianceProgress
tags:
- Projects
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/ProjectId'
responses:
'200':
description: 'Compliance progress returned'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/ComplianceProgress'}
'404':
description: 'Project not found'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'/projects/assessment/progress/{id}':
get:
summary: 'Get assessment progress for a single project'
operationId: projectAssessmentProgress
tags:
- Projects
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/ProjectId'
responses:
'200':
description: 'Assessment progress returned'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/AssessmentProgress'}
'404':
description: 'Project not found'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'/projects/{id}/eu-ai-act-classification':
get:
summary: 'Get Use Case Classification'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Projects
operationId: getUseCaseClassification
security:
-
bearerAuth: []
post:
summary: 'Classify Use Case'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Projects
operationId: classifyUseCase
security:
-
bearerAuth: []
/projects/all/compliance/progress:
get:
summary: 'Get compliance progress across all projects'
operationId: allProjectsComplianceProgress
tags:
- Projects
security:
-
bearerAuth: []
responses:
'200':
description: 'Aggregated compliance progress returned'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/ComplianceProgress'}
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: 'No projects found'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
/projects/all/assessment/progress:
get:
summary: 'Get assessment progress across all projects'
operationId: allProjectsAssessmentProgress
tags:
- Projects
security:
-
bearerAuth: []
responses:
'200':
description: 'Aggregated assessment progress returned'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/AssessmentProgress'}
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: 'No projects found'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'/projects/{id}/status':
patch:
summary: 'Update project status'
operationId: updateProjectStatus
tags:
- Projects
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/ProjectId'
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- status
properties:
status:
$ref: '#/components/schemas/ProjectStatus'
responses:
'200':
description: 'Project status updated successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/ProjectWithMembers'}
'404':
description: 'Project not found'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
/eu-ai-act-classification/questionnaire:
get:
summary: 'Get Questionnaire'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Eu Ai Act Classification'
operationId: getQuestionnaire
security:
-
bearerAuth: []
/eu-ai-act-classification/score:
post:
summary: 'Score Answers'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Eu Ai Act Classification'
operationId: scoreAnswers
security:
-
bearerAuth: []
/questions:
get:
tags:
- Assessments
summary: 'Get All Questions'
operationId: getAllQuestions
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/questions/{id}':
get:
tags:
- Assessments
summary: 'Get Question By Id'
operationId: getQuestionById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/questions/bysubtopic/{id}':
get:
tags:
- Assessments
summary: 'Get Questions By Subtopic Id'
operationId: getQuestionsBySubtopicId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/questions/bytopic/{id}':
get:
tags:
- Assessments
summary: 'Get Questions By Topic Id'
operationId: getQuestionsByTopicId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/autoDrivers:
post:
tags:
- 'Demo Data'
summary: 'Post Auto Driver'
operationId: postAutoDriver
security:
-
bearerAuth: []
description: 'Requires role: Admin'
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
delete:
tags:
- 'Demo Data'
summary: 'Delete Auto Driver'
operationId: deleteAutoDriver
security:
-
bearerAuth: []
description: 'Requires role: Admin'
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/assessments:
get:
tags:
- Assessments
summary: 'Get All Assessments'
operationId: getAllAssessments
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
summary: 'Create Assessment'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Assessments
operationId: createAssessment
security:
-
bearerAuth: []
'/assessments/getAnswers/{id}':
get:
tags:
- Assessments
summary: 'Get Answers'
operationId: getAnswers
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/assessments/{id}':
get:
tags:
- Assessments
summary: 'Get Assessment By Id'
operationId: getAssessmentById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
summary: 'Update Assessment By Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Assessments
operationId: updateAssessmentById
security:
-
bearerAuth: []
delete:
summary: 'Delete Assessment By Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Assessments
operationId: deleteAssessmentById
security:
-
bearerAuth: []
'/assessments/project/byid/{id}':
get:
tags:
- Assessments
summary: 'Get Assessment By Project Id'
operationId: getAssessmentByProjectId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/projectRisks:
get:
tags:
- 'Project Risks'
summary: 'Get All Risks'
operationId: getAllRisks
security:
-
bearerAuth: []
parameters:
-
name: filter
in: query
required: false
schema:
type: string
enum:
- active
- deleted
- all
default: active
description: 'Filter by soft-delete state.'
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {type: array, items: {$ref: '#/components/schemas/ProjectRiskResponse'}}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'Project Risks'
summary: 'Create Risk'
operationId: createRisk
security:
-
bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ProjectRiskInput'
responses:
'201':
description: 'Created successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/ProjectRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/projectRisks/by-projid/{id}':
get:
tags:
- 'Project Risks'
summary: 'Get Risks By Project'
operationId: getRisksByProject
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: string
-
name: filter
in: query
required: false
schema:
type: string
enum:
- active
- deleted
- all
default: active
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {type: array, items: {$ref: '#/components/schemas/ProjectRiskResponse'}}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/projectRisks/by-frameworkid/{id}':
get:
tags:
- 'Project Risks'
summary: 'Get Risks By Framework'
operationId: getRisksByFramework
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
-
name: filter
in: query
required: false
schema:
type: string
enum:
- active
- deleted
- all
default: active
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {type: array, items: {$ref: '#/components/schemas/ProjectRiskResponse'}}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/projectRisks/{id}':
get:
tags:
- 'Project Risks'
summary: 'Get Risk By Id'
operationId: getRiskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/ProjectRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
tags:
- 'Project Risks'
summary: 'Update Risk By Id'
operationId: updateRiskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ProjectRiskInput'
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/ProjectRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Project Risks'
summary: 'Delete Risk By Id'
operationId: deleteRiskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/ProjectRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/projectRisks/bulk:
patch:
summary: 'Bulk Update Project Risks'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Project Risks'
operationId: bulkUpdateProjectRisks
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
/projectRisks/suggest-ai:
post:
summary: 'Suggest Risks With AI'
responses:
'200':
description: 'Suggestions generated'
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {type: object, properties: {matched: {type: array, items: {type: object, properties: {source: {type: string, enum: [mit, ibm]}, id: {type: integer}, summary: {type: string}, description: {type: string}, risk_category: {type: array, items: {type: string}}, likelihood: {type: string}, severity: {type: string}, reason: {type: string}, ai_lifecycle_phase: {type: string}}}}, suggested: {type: array, items: {type: object, properties: {risk_name: {type: string}, risk_description: {type: string}, risk_category: {type: array, items: {type: string}}, ai_lifecycle_phase: {type: string}, likelihood: {type: integer, minimum: 1, maximum: 5}, severity: {type: integer, minimum: 1, maximum: 5}, impact: {type: string}, mitigation_plan: {type: string}}}}, suppressed_count: {type: integer}}}
'400':
description: 'Invalid request, or no LLM keys configured for the organization'
'401':
description: Unauthorized
'404':
description: 'Project not found'
'429':
description: 'Rate limit exceeded (10 requests per hour per user)'
'500':
description: 'Internal server error'
'502':
description: 'The configured AI provider rejected or failed the request'
tags:
- 'Project Risks'
operationId: suggestRisksWithAI
security:
-
bearerAuth: []
description: 'Read-only: the org-configured LLM returns matching entries from the built-in MIT and IBM risk catalogs plus free-form suggested risks for the use case of the project. Nothing is persisted. Rate limited to 10 requests per hour per user.'
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- projectId
properties:
projectId:
type: integer
minimum: 1
technologySummary:
type: string
maxLength: 2000
description: 'Optional technology summary; overrides project fields in the prompt.'
llmKeyId:
type: integer
minimum: 1
description: 'Optional LLM key id; defaults to the most recent key of the organization.'
/riskLinks/recompute:
post:
summary: 'Recompute All Risk Links'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: recomputeAllRiskLinks
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
/riskLinks/suggest-hierarchy:
post:
summary: 'Suggest Risk Hierarchy'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: suggestRiskHierarchy
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
/riskLinks:
post:
summary: 'Create Risk Link'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: createRiskLink
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
get:
summary: 'Get Risk Graph'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getRiskGraph
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
/riskLinks/dismissals:
get:
summary: 'Get Dismissal Analytics'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getDismissalAnalytics
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
/riskLinks/duplicates:
get:
summary: 'Get Duplicate Candidates'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getDuplicateCandidates
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
/riskLinks/coverage:
get:
summary: 'Get Control Coverage'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getControlCoverage
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
/riskLinks/vendor-exposure:
get:
summary: 'Get Vendor Exposure'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getVendorExposure
security:
-
bearerAuth: []
/riskLinks/vendor-duplicates:
get:
summary: 'Get Vendor Duplicate Candidates'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getVendorDuplicateCandidates
security:
-
bearerAuth: []
/riskLinks/vendor-coverage:
get:
summary: 'Get Vendor Framework Coverage'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getVendorFrameworkCoverage
security:
-
bearerAuth: []
'/riskLinks/vendor-risks/{vendorRiskId}':
get:
summary: 'Get Vendor Risk Links'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getVendorRiskLinks
security:
-
bearerAuth: []
'/riskLinks/vendor-risks/{vendorRiskId}/shared-projects':
get:
summary: 'Get Vendor Risk Shared Projects'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getVendorRiskSharedProjects
security:
-
bearerAuth: []
/riskLinks/vendor-risks/recompute:
post:
summary: 'Recompute All Vendor Risk Links'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: recomputeAllVendorRiskLinks
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
'/riskLinks/vendor-risks/{vendorRiskId}/suggest-hierarchy':
post:
summary: 'Suggest Vendor Risk Hierarchy'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: suggestVendorRiskHierarchy
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
'/riskLinks/{riskId}':
get:
summary: 'Get Risk Links'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getRiskLinks
security:
-
bearerAuth: []
'/riskLinks/{riskId}/shared-projects':
get:
summary: 'Get Shared Projects'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: getSharedProjects
security:
-
bearerAuth: []
'/riskLinks/{id}':
patch:
summary: 'Update Risk Link Status'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: updateRiskLinkStatus
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor or Reviewer'
'/riskLinks/{id}/acknowledge-parent-change':
post:
summary: 'Acknowledge Parent Level Change'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- RiskLinks
operationId: acknowledgeParentLevelChange
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
/roles:
get:
tags:
- Roles
summary: 'Get All Roles'
operationId: getAllRoles
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
summary: 'Create Role'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Roles
operationId: createRole
security:
-
bearerAuth: []
/roles/permissions/catalog:
get:
summary: 'Get Permission Catalog'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Roles
operationId: getPermissionCatalog
security:
-
bearerAuth: []
/roles/my-permissions:
get:
summary: 'Get My Permissions'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Roles
operationId: getMyPermissions
security:
-
bearerAuth: []
'/roles/{id}':
get:
tags:
- Roles
summary: 'Get Role By Id'
operationId: getRoleById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
summary: 'Update Role By Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Roles
operationId: updateRoleById
security:
-
bearerAuth: []
delete:
summary: 'Delete Role By Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Roles
operationId: deleteRoleById
security:
-
bearerAuth: []
'/roles/{id}/permissions':
get:
summary: 'Get Role Permissions By Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Roles
operationId: getRolePermissionsById
security:
-
bearerAuth: []
put:
summary: 'Replace Role Permissions'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Roles
operationId: replaceRolePermissions
security:
-
bearerAuth: []
/files:
get:
tags:
- Files
summary: 'Get User Files Meta Data'
operationId: files_getAllFolders
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Files
summary: 'Post File Content'
operationId: files_createFolder
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/files/by-projid/{id}':
get:
tags:
- Files
summary: 'Get File Meta By Project Id'
operationId: getFileMetaByProjectId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/files/entity/{framework_type}/{entity_type}/{entity_id}':
get:
tags:
- Files
summary: 'Get Entity Files'
operationId: getEntityFiles
security:
-
bearerAuth: []
parameters:
-
name: framework_type
in: path
required: true
schema:
type: string
-
name: entity_type
in: path
required: true
schema:
type: string
-
name: entity_id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/files/attach:
post:
tags:
- Files
summary: 'Attach File To Entity'
operationId: attachFileToEntity
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/files/attach-bulk:
post:
tags:
- Files
summary: 'Attach Files To Entity'
operationId: attachFilesToEntity
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/files/detach:
delete:
tags:
- Files
summary: 'Detach File From Entity'
operationId: detachFileFromEntity
security:
-
bearerAuth: []
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/files/bulk-tags:
patch:
summary: 'Bulk Update File Tags'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Files
operationId: bulkUpdateFileTags
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/files/{id}':
get:
tags:
- Files
summary: 'Get File Content By Id'
operationId: files_getFolderById
security:
-
bearerAuth: []
description: 'Requires role: Admin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
patch:
tags:
- Files
summary: 'Update Folder'
operationId: files_updateFolder
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Files
summary: 'Delete Folder'
operationId: files_deleteFolder
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/mail/invite:
post:
tags:
- Mail
summary: 'Invite a user'
operationId: anonymous
security:
-
bearerAuth: []
description: 'Requires the invitation.super permission (Admin by default). The invite always goes to the caller''s organization; an organizationId in the body is ignored, and a SuperAdmin without an organization uses /super-admin/organizations/{id}/invite. Only an Admin may grant a built-in role; other inviting roles may grant only the organization''s custom roles with no permission they lack.'
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: 'Invitation email sent'
'206':
description: 'Invitation saved but the email failed; the response carries the link'
'400':
description: 'Unknown or invalid role'
'401':
description: Unauthorized
'403':
description: 'Forbidden - missing permission, no organization, or the role grants more access than the caller has'
'500':
description: 'Internal server error'
/mail/reset-password:
post:
tags:
- Mail
summary: Email
operationId: mail_anonymous
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'500':
description: 'Internal server error'
/invitations:
get:
tags:
- Invitations
summary: 'Get Invitations'
operationId: getInvitations
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/invitations/{id}':
delete:
tags:
- Invitations
summary: 'Revoke Invitation'
operationId: revokeInvitation
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/invitations/{id}/resend':
post:
tags:
- Invitations
summary: 'Resend Invitation'
operationId: resendInvitation
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/frameworks:
get:
tags:
- Frameworks
summary: 'Get All Frameworks'
operationId: getAllFrameworks
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/frameworks/{id}':
get:
tags:
- Frameworks
summary: 'Get Framework By Id'
operationId: getFrameworkById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/frameworks/toProject:
post:
tags:
- Frameworks
summary: 'Add Framework To Project'
operationId: addFrameworkToProject
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/frameworks/fromProject:
delete:
tags:
- Frameworks
summary: 'Delete Framework From Project'
operationId: deleteFrameworkFromProject
security:
-
bearerAuth: []
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/frameworks/{frameworkId}/tree/{projectId}':
get:
summary: 'Get framework tree'
responses:
'200':
description: 'Framework tree'
'400':
description: 'Invalid parameters'
'404':
description: 'Framework not found or not attached to this project'
'500':
description: 'Internal server error'
tags:
- Frameworks
operationId: getFrameworkTree
security:
-
bearerAuth: []
description: 'Returns the framework metadata (id, key, framework_type, display_name, entity_types, hierarchy_type) and the full structure tree with the project''s implementation rows. Generic endpoint for the bundled frameworks declared in Servers/structures.'
parameters:
-
name: frameworkId
in: path
required: true
description: 'Framework id (the bundled frameworks use ids 5-25)'
schema:
type: integer
-
name: projectId
in: path
required: true
description: 'Project (use case) id, or the organizational project id'
schema:
type: integer
'/frameworks/{frameworkId}/dashboard/{projectFrameworkId}':
get:
summary: 'Get framework dashboard'
responses:
'200':
description: 'Status counts'
'400':
description: 'Invalid parameters'
'404':
description: 'Framework not found or not attached to this project'
'500':
description: 'Internal server error'
tags:
- Frameworks
operationId: getFrameworkDashboard
security:
-
bearerAuth: []
description: 'Returns status counts for the framework''s implementation rows in the given project.'
parameters:
-
name: frameworkId
in: path
required: true
description: 'Framework id (the bundled frameworks use ids 5-25)'
schema:
type: integer
-
name: projectFrameworkId
in: path
required: true
description: 'projects_frameworks row id linking the framework to the project'
schema:
type: integer
'/frameworks/{frameworkId}/impl/{level}/{id}':
get:
summary: 'Get implementation row'
responses:
'200':
description: 'Implementation row'
'400':
description: 'Invalid parameters'
'404':
description: 'Framework or record not found'
'500':
description: 'Internal server error'
tags:
- Frameworks
operationId: getImplById
security:
-
bearerAuth: []
description: 'Returns one implementation row (status, owner, reviewer, approver, due date, notes, evidence).'
parameters:
-
name: frameworkId
in: path
required: true
description: 'Framework id (the bundled frameworks use ids 5-25)'
schema:
type: integer
-
name: level
in: path
required: true
description: 'Implementation level: l2 (two-level frameworks) or l3 (leaf level of three-level frameworks)'
schema:
type: string
enum:
- l2
- l3
-
name: id
in: path
required: true
description: 'Implementation row id'
schema:
type: integer
patch:
summary: 'Update implementation row'
responses:
'200':
description: 'Updated implementation row'
'400':
description: 'Invalid parameters'
'404':
description: 'Framework or record not found'
'500':
description: 'Internal server error'
tags:
- Frameworks
operationId: updateImpl
security:
-
bearerAuth: []
description: 'Multipart form. Fields: status, implementation_description, owner, reviewer, approver, due_date, auditor_feedback, risksMitigated (JSON array), risksDelete (JSON array), delete (JSON array of file ids to detach), user_id; attach evidence as file parts.'
parameters:
-
name: frameworkId
in: path
required: true
description: 'Framework id (the bundled frameworks use ids 5-25)'
schema:
type: integer
-
name: level
in: path
required: true
description: 'Implementation level: l2 (two-level frameworks) or l3 (leaf level of three-level frameworks)'
schema:
type: string
enum:
- l2
- l3
-
name: id
in: path
required: true
description: 'Implementation row id'
schema:
type: integer
requestBody:
content:
multipart/form-data:
schema:
type: object
properties:
status:
type: string
implementation_description:
type: string
owner:
type: string
reviewer:
type: string
approver:
type: string
due_date:
type: string
auditor_feedback:
type: string
risksMitigated:
type: string
risksDelete:
type: string
delete:
type: string
user_id:
type: string
'/frameworks/{frameworkId}/impl/{level}/{id}/risks':
get:
summary: 'Get implementation row risks'
responses:
'200':
description: 'Linked risks'
'400':
description: 'Invalid parameters'
'404':
description: 'Framework not found'
'500':
description: 'Internal server error'
tags:
- Frameworks
operationId: getImplRisks
security:
-
bearerAuth: []
description: 'Returns the risks linked to one implementation row.'
parameters:
-
name: frameworkId
in: path
required: true
description: 'Framework id (the bundled frameworks use ids 5-25)'
schema:
type: integer
-
name: level
in: path
required: true
description: 'Implementation level: l2 (two-level frameworks) or l3 (leaf level of three-level frameworks)'
schema:
type: string
enum:
- l2
- l3
-
name: id
in: path
required: true
description: 'Implementation row id'
schema:
type: integer
/eu-ai-act/controlCategories:
get:
tags:
- 'EU AI Act'
summary: 'Get All Control Categories'
operationId: getAllControlCategories
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/eu-ai-act/controls/byControlCategoryId/{id}':
get:
tags:
- 'EU AI Act'
summary: 'Get Controls By Control Category Id'
operationId: getControlsByControlCategoryId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/eu-ai-act/topics:
get:
tags:
- 'EU AI Act'
summary: 'Get All Topics'
operationId: getAllTopics
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/eu-ai-act/assessments/byProjectId/{id}':
get:
tags:
- 'EU AI Act'
summary: 'Get Assessments By Project Id'
operationId: getAssessmentsByProjectId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'EU AI Act'
summary: 'Delete Assessments By Project Id'
operationId: deleteAssessmentsByProjectId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/eu-ai-act/compliances/byProjectId/{id}':
get:
tags:
- 'EU AI Act'
summary: 'Get Compliances By Project Id'
operationId: getCompliancesByProjectId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'EU AI Act'
summary: 'Delete Compliances By Project Id'
operationId: deleteCompliancesByProjectId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/eu-ai-act/compliances/progress/{id}':
get:
tags:
- 'EU AI Act'
summary: 'Get Project Compliance Progress'
operationId: getProjectComplianceProgress
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/eu-ai-act/assessments/progress/{id}':
get:
tags:
- 'EU AI Act'
summary: 'Get Project Assessment Progress'
operationId: getProjectAssessmentProgress
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/eu-ai-act/all/compliances/progress:
get:
tags:
- 'EU AI Act'
summary: 'Get All Projects Compliance Progress'
operationId: getAllProjectsComplianceProgress
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/eu-ai-act/all/assessments/progress:
get:
tags:
- 'EU AI Act'
summary: 'Get All Projects Assessment Progress'
operationId: getAllProjectsAssessmentProgress
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/eu-ai-act/topicById:
get:
tags:
- 'EU AI Act'
summary: 'Get Topic By Id'
operationId: getTopicById
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/eu-ai-act/controlById:
get:
tags:
- 'EU AI Act'
summary: 'Get Control By Id'
operationId: getControlById
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/eu-ai-act/saveControls/{id}':
patch:
tags:
- 'EU AI Act'
summary: 'Save Controls'
operationId: saveControls
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/eu-ai-act/saveAnswer/{id}':
patch:
tags:
- 'EU AI Act'
summary: 'Update Question By Id'
operationId: updateQuestionById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/organizations/exists:
get:
tags:
- Organizations
summary: 'Get Organizations Exists'
operationId: getOrganizationsExists
responses:
'200':
description: Success
'500':
description: 'Internal server error'
'/organizations/{id}':
get:
tags:
- Organizations
summary: 'Get Organization By Id'
operationId: getOrganizationById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- Organizations
summary: 'Update Organization By Id'
operationId: updateOrganizationById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
description: 'Requires role: Admin'
/organizations:
post:
tags:
- Organizations
summary: 'Create Organization'
operationId: createOrganization
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
description: 'Requires role: Super Admin'
'/organizations/{id}/onboarding-status':
patch:
tags:
- Organizations
summary: 'Update Onboarding Status'
operationId: updateOnboardingStatus
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
description: 'Requires role: Admin'
/iso-42001/clauses:
get:
tags:
- 'ISO 42001'
summary: 'Get All Clauses'
operationId: getAllClauses
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/clauses/struct/byProjectId/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get All Clauses Struct For Project'
operationId: getAllClausesStructForProject
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/iso-42001/annexes:
get:
tags:
- 'ISO 42001'
summary: 'Get All Annexes'
operationId: getAllAnnexes
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/annexes/struct/byProjectId/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get All Annexes Struct For Project'
operationId: getAllAnnexesStructForProject
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/clauses/byProjectId/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get Clauses By Project Id'
operationId: getClausesByProjectId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'ISO 42001'
summary: 'Delete Management System Clauses'
operationId: deleteManagementSystemClauses
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/annexes/byProjectId/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get Annexes By Project Id'
operationId: getAnnexesByProjectId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'ISO 42001'
summary: 'Delete Reference Controls'
operationId: deleteReferenceControls
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/subClauses/byClauseId/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get Sub Clauses By Clause Id'
operationId: getSubClausesByClauseId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/annexCategories/byAnnexId/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get Annex Categories By Annex Id'
operationId: getAnnexCategoriesByAnnexId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/subClause/byId/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get Sub Clause By Id'
operationId: getSubClauseById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/subclauses/{id}/risks':
get:
tags:
- 'ISO 42001'
summary: 'Get Sub Clause Risks'
operationId: getSubClauseRisks
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/annexCategories/{id}/risks':
get:
tags:
- 'ISO 42001'
summary: 'Get Annex Category Risks'
operationId: getAnnexCategoryRisks
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/annexCategory/byId/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get Annex Category By Id'
operationId: getAnnexCategoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/clauses/progress/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get Project Clauses Progress'
operationId: getProjectClausesProgress
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/annexes/progress/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get Project Annxes Progress'
operationId: getProjectAnnxesProgress
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/iso-42001/all/clauses/progress:
get:
tags:
- 'ISO 42001'
summary: 'Get All Projects Clauses Progress'
operationId: getAllProjectsClausesProgress
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/iso-42001/all/annexes/progress:
get:
tags:
- 'ISO 42001'
summary: 'Get All Projects Annxes Progress'
operationId: getAllProjectsAnnxesProgress
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/clauses/assignments/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get Project Clauses Assignments'
operationId: getProjectClausesAssignments
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/annexes/assignments/{id}':
get:
tags:
- 'ISO 42001'
summary: 'Get Project Annexes Assignments'
operationId: getProjectAnnexesAssignments
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/saveClauses/{id}':
patch:
tags:
- 'ISO 42001'
summary: 'Save Clauses'
operationId: saveClauses
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-42001/saveAnnexes/{id}':
patch:
tags:
- 'ISO 42001'
summary: 'Save Annexes'
operationId: saveAnnexes
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/iso-27001/clauses:
get:
tags:
- 'ISO 27001'
summary: 'Get All Clauses'
operationId: iso_27001_getAllClauses
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/clauses/struct/byProjectId/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get All Clauses Struct For Project'
operationId: iso_27001_getAllClausesStructForProject
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/iso-27001/annexes:
get:
tags:
- 'ISO 27001'
summary: 'Get All Annexes'
operationId: iso_27001_getAllAnnexes
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/annexes/struct/byProjectId/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get All Annexes Struct For Project'
operationId: iso_27001_getAllAnnexesStructForProject
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/clauses/byProjectId/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get Clauses By Project Id'
operationId: iso_27001_getClausesByProjectId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'ISO 27001'
summary: 'Delete Management System Clauses'
operationId: iso_27001_deleteManagementSystemClauses
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/annexes/byProjectId/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get Annexes By Project Id'
operationId: iso_27001_getAnnexesByProjectId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'ISO 27001'
summary: 'Delete Reference Controls'
operationId: iso_27001_deleteReferenceControls
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/subClauses/byClauseId/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get Sub Clauses By Clause Id'
operationId: iso_27001_getSubClausesByClauseId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/annexControls/byAnnexId/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get Annex Controls By Annex Id'
operationId: getAnnexControlsByAnnexId
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/subClause/byId/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get Sub Clause By Id'
operationId: iso_27001_getSubClauseById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/annexControl/byId/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get Annex Control By Id'
operationId: getAnnexControlById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/clauses/progress/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get Project Clauses Progress'
operationId: iso_27001_getProjectClausesProgress
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/annexes/progress/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get Project Annxes Progress'
operationId: iso_27001_getProjectAnnxesProgress
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/iso-27001/all/clauses/progress:
get:
tags:
- 'ISO 27001'
summary: 'Get All Projects Clauses Progress'
operationId: iso_27001_getAllProjectsClausesProgress
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/iso-27001/all/annexes/progress:
get:
tags:
- 'ISO 27001'
summary: 'Get All Projects Annxes Progress'
operationId: iso_27001_getAllProjectsAnnxesProgress
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/clauses/assignments/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get Project Clauses Assignments'
operationId: iso_27001_getProjectClausesAssignments
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/annexes/assignments/{id}':
get:
tags:
- 'ISO 27001'
summary: 'Get Project Annexes Assignments'
operationId: iso_27001_getProjectAnnexesAssignments
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/saveClauses/{id}':
patch:
tags:
- 'ISO 27001'
summary: 'Save Clauses'
operationId: iso_27001_saveClauses
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/iso-27001/saveAnnexes/{id}':
patch:
tags:
- 'ISO 27001'
summary: 'Save Annexes'
operationId: iso_27001_saveAnnexes
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/training:
get:
tags:
- Training
summary: 'Get All Training Registar'
operationId: getAllTrainingRegistar
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Training
summary: 'Create New Training Registar'
operationId: createNewTrainingRegistar
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/training/training-id/{id}':
get:
tags:
- Training
summary: 'Get Training Registar By Id'
operationId: getTrainingRegistarById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/training/{id}':
patch:
tags:
- Training
summary: 'Update Training Registar By Id'
operationId: updateTrainingRegistarById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Training
summary: 'Delete Training Registar By Id'
operationId: deleteTrainingRegistarById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/aiTrustCentre/overview:
get:
tags:
- 'AI Trust Centre'
summary: 'Get A I Trust Centre Overview'
operationId: getAITrustCentreOverview
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
tags:
- 'AI Trust Centre'
summary: 'Update A I Trust Overview'
operationId: updateAITrustOverview
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/aiTrustCentre/resources:
get:
tags:
- 'AI Trust Centre'
summary: 'Get A I Trust Centre Resources'
operationId: getAITrustCentreResources
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'AI Trust Centre'
summary: 'Create A I Trust Resource'
operationId: createAITrustResource
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/aiTrustCentre/subprocessors:
get:
tags:
- 'AI Trust Centre'
summary: 'Get A I Trust Centre Subprocessors'
operationId: getAITrustCentreSubprocessors
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'AI Trust Centre'
summary: 'Create A I Trust Subprocessor'
operationId: createAITrustSubprocessor
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/aiTrustCentre/{hash}':
get:
tags:
- 'AI Trust Centre'
summary: 'Get A I Trust Centre Public Page'
operationId: getAITrustCentrePublicPage
parameters:
-
name: hash
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
'500':
description: 'Internal server error'
'/aiTrustCentre/{hash}/logo':
get:
tags:
- 'AI Trust Centre'
summary: 'Get Company Logo'
operationId: getCompanyLogo
parameters:
-
name: hash
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
'500':
description: 'Internal server error'
'/aiTrustCentre/{hash}/resources/{id}':
get:
tags:
- 'AI Trust Centre'
summary: 'Get A I Trust Centre Public Resource'
operationId: getAITrustCentrePublicResource
parameters:
-
name: hash
in: path
required: true
schema:
type: string
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'500':
description: 'Internal server error'
/aiTrustCentre/logo:
post:
tags:
- 'AI Trust Centre'
summary: 'Upload company logo'
operationId: uploadCompanyLogo
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'AI Trust Centre'
summary: 'Delete Company Logo'
operationId: deleteCompanyLogo
security:
-
bearerAuth: []
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/aiTrustCentre/resources/{id}':
put:
tags:
- 'AI Trust Centre'
summary: 'Update A I Trust Resource'
operationId: updateAITrustResource
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'AI Trust Centre'
summary: 'Delete A I Trust Resource'
operationId: deleteAITrustResource
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/aiTrustCentre/subprocessors/{id}':
put:
tags:
- 'AI Trust Centre'
summary: 'Update A I Trust Subprocessor'
operationId: updateAITrustSubprocessor
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'AI Trust Centre'
summary: 'Delete A I Trust Subprocessor'
operationId: deleteAITrustSubprocessor
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/logger/events:
get:
tags:
- System
summary: 'Get Events'
operationId: getEvents
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/logger/logs:
get:
tags:
- System
summary: 'Get Logs'
description: 'Returns the last 500 lines of the caller''s organization server log for today. Admin only (requires the logs.admin permission; built-in roles: Admin).'
operationId: getLogs
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden: caller does not hold the logs.admin permission'
'500':
description: 'Internal server error'
/modelInventory:
get:
tags:
- 'Model Inventory'
summary: 'Get all model inventories'
description: "Returns every model inventory record belonging to the caller's organization, ordered by created_at DESC, id ASC. Each record includes its associated project and framework IDs.\n"
operationId: getAllModelInventories
security:
-
bearerAuth: []
responses:
'200':
description: 'List of model inventories (may be empty)'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/ModelInventoryResponse'}}
'401':
description: 'Missing or invalid JWT'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
post:
tags:
- 'Model Inventory'
summary: 'Create a new model inventory'
description: "Creates a model inventory record, links it to the supplied project and framework IDs, records a change-history entry, fires any \"model_added\" automations, and notifies the approver (if set).\n"
operationId: createNewModelInventory
security:
-
bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ModelInventoryCreateRequest'
responses:
'201':
description: 'Model inventory created'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Created}
data: {$ref: '#/components/schemas/ModelInventoryResponse'}
'401':
description: 'Missing or invalid JWT'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
/modelInventory/evaluations:
get:
tags:
- 'Model Inventory'
summary: 'Get All Model Evaluations'
operationId: getAllModelEvaluations
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/modelInventory/{id}/evaluations':
get:
tags:
- 'Model Inventory'
summary: 'Get Model Evaluations'
operationId: getModelEvaluations
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/modelInventory/{id}':
get:
tags:
- 'Model Inventory'
summary: 'Get a model inventory by ID'
description: "Returns a single model inventory record with its associated project and framework IDs. Returns 204 if the record does not exist.\n"
operationId: getModelInventoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
description: 'Model inventory ID'
schema:
type: integer
responses:
'200':
description: 'Model inventory found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/ModelInventoryResponse'}
'204':
description: 'No model inventory found for the given ID'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'No Content'}
data: {nullable: true}
'401':
description: 'Missing or invalid JWT'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
patch:
tags:
- 'Model Inventory'
summary: 'Update a model inventory by ID'
description: "Partially updates a model inventory record. All body fields are optional; only provided fields are changed. Project and framework associations can be replaced or cleared. Fires \"model_updated\" automations and notifies a new approver if changed.\n"
operationId: updateModelInventoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
description: 'Model inventory ID'
schema:
type: integer
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ModelInventoryUpdateRequest'
responses:
'200':
description: 'Model inventory updated'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/ModelInventoryResponse'}
'401':
description: 'Missing or invalid JWT'
'404':
description: 'Model inventory not found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Not Found'}
data: {type: string, example: 'Model inventory not found'}
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
delete:
tags:
- 'Model Inventory'
summary: 'Delete a model inventory by ID'
description: "Deletes a model inventory record and its project/framework associations. Optionally deletes linked model risks when deleteRisks=true. Records deletion in change history and fires \"model_deleted\" automations.\n"
operationId: deleteModelInventoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
description: 'Model inventory ID'
schema:
type: integer
-
name: deleteRisks
in: query
required: false
description: "When \"true\", also deletes associated rows from the model_risks table.\n"
schema:
type: string
enum:
- 'true'
- 'false'
default: 'false'
responses:
'200':
description: 'Model inventory deleted'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: string, example: 'Model inventory deleted successfully'}
'401':
description: 'Missing or invalid JWT'
'404':
description: 'Model inventory not found'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: 'Not Found'}
data: {type: string, example: 'Model inventory not found'}
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'/modelInventory/by-projectId/{projectId}':
get:
tags:
- 'Model Inventory'
summary: 'Get model inventories by project ID'
description: "Returns all model inventories associated with a project (via the model_inventories_projects_frameworks join table where framework_id IS NULL). Non-numeric project IDs return an empty array.\n"
operationId: getModelByProjectId
security:
-
bearerAuth: []
parameters:
-
name: projectId
in: path
required: true
description: 'Project ID (integer). Non-numeric values return an empty array.'
schema:
type: integer
responses:
'200':
description: 'List of model inventories for the project (may be empty)'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/ModelInventoryResponse'}}
'401':
description: 'Missing or invalid JWT'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
'/modelInventory/by-frameworkId/{frameworkId}':
get:
tags:
- 'Model Inventory'
summary: 'Get model inventories by framework ID'
description: "Returns all model inventories associated with a framework (via the model_inventories_projects_frameworks join table where framework_id matches).\n"
operationId: getModelByFrameworkId
security:
-
bearerAuth: []
parameters:
-
name: frameworkId
in: path
required: true
description: 'Framework ID'
schema:
type: integer
responses:
'200':
description: 'List of model inventories for the framework (may be empty)'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/ModelInventoryResponse'}}
'401':
description: 'Missing or invalid JWT'
'500':
description: 'Internal server error'
content:
application/json:
schema:
$ref: '#/components/schemas/ServerError'
/modelInventoryHistory/timeseries:
get:
tags:
- 'Model Inventory'
summary: 'Get Timeseries'
operationId: getTimeseries
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/modelInventoryHistory/current-counts:
get:
tags:
- 'Model Inventory'
summary: 'Get Current Counts'
operationId: getCurrentCounts
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/modelInventoryHistory/snapshot:
post:
tags:
- 'Model Inventory'
summary: 'Create Snapshot'
operationId: createSnapshot
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/extensions:
get:
summary: 'List extensions'
responses:
'200':
description: 'List of extensions'
'401':
description: 'Not authenticated'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: listExtensions
security:
-
bearerAuth: []
description: 'Lists every built-in extension in the catalog with its config field definitions, whether it is enabled for the caller''s organization, and its configuration with secret fields removed. Available to any authenticated user.'
parameters:
-
name: category
in: query
required: false
description: 'Filter by category: communication, ml_ops, data_management, version_control, monitoring, security or analytics'
schema:
type: string
'/extensions/{key}':
get:
summary: 'Get extension'
responses:
'200':
description: 'Extension detail'
'400':
description: 'Invalid extension key format'
'401':
description: 'Not authenticated'
'404':
description: 'Extension not found'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getExtension
security:
-
bearerAuth: []
description: 'Returns one extension: catalog metadata, config field definitions, per-organization enabled state and redacted configuration. Available to any authenticated user.'
parameters:
-
name: key
in: path
required: true
description: 'Extension key: slack, mlflow, azure-ai-foundry, model-lifecycle, risk-import, jira-assets or dataset-bulk-upload'
schema:
type: string
'/extensions/{key}/enable':
post:
summary: 'Enable extension'
responses:
'200':
description: 'Extension enabled'
'400':
description: 'Invalid key or configuration'
'401':
description: 'Not authenticated'
'403':
description: 'Admin role required'
'404':
description: 'Extension not found'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: enableExtension
security:
-
bearerAuth: []
description: 'Enables the extension for the caller''s organization. Optional body { configuration } is validated against the extension''s config fields; secret fields are encrypted at rest. Admin only. Requires role: Admin'
parameters:
-
name: key
in: path
required: true
description: 'Extension key: slack, mlflow, azure-ai-foundry, model-lifecycle, risk-import, jira-assets or dataset-bulk-upload'
schema:
type: string
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
configuration:
type: object
'/extensions/{key}/disable':
post:
summary: 'Disable extension'
responses:
'200':
description: 'Extension disabled'
'400':
description: 'Invalid extension key format'
'401':
description: 'Not authenticated'
'403':
description: 'Admin role required'
'404':
description: 'Extension not found'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: disableExtension
security:
-
bearerAuth: []
description: 'Disables the extension for the caller''s organization. Configuration and data are kept, so enabling it again restores the previous setup. Admin only. Requires role: Admin'
parameters:
-
name: key
in: path
required: true
description: 'Extension key: slack, mlflow, azure-ai-foundry, model-lifecycle, risk-import, jira-assets or dataset-bulk-upload'
schema:
type: string
'/extensions/{key}/configuration':
patch:
summary: 'Update extension configuration'
responses:
'200':
description: 'Configuration updated'
'400':
description: 'Invalid key or configuration'
'401':
description: 'Not authenticated'
'403':
description: 'Admin role required'
'404':
description: 'Extension not found'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: updateExtensionConfiguration
security:
-
bearerAuth: []
description: 'Updates the stored configuration. Body { configuration }. Secret fields left out of the body keep their existing encrypted value. Admin only. Requires role: Admin'
parameters:
-
name: key
in: path
required: true
description: 'Extension key: slack, mlflow, azure-ai-foundry, model-lifecycle, risk-import, jira-assets or dataset-bulk-upload'
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- configuration
properties:
configuration:
type: object
'/extensions/{key}/test-connection':
post:
summary: 'Test extension connection'
responses:
'200':
description: 'Connection test result'
'400':
description: 'Invalid extension key format'
'401':
description: 'Not authenticated'
'403':
description: 'Admin role required'
'404':
description: 'Extension not found'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: testExtensionConnection
security:
-
bearerAuth: []
description: 'Checks that the extension can reach its remote service. The submitted { configuration } is overlaid on the stored configuration. Supported for mlflow, azure-ai-foundry and jira-assets; other keys return 200 with success false. Returns { success, message, testedAt }. Admin only. Requires role: Admin'
parameters:
-
name: key
in: path
required: true
description: 'Extension key: slack, mlflow, azure-ai-foundry, model-lifecycle, risk-import, jira-assets or dataset-bulk-upload'
schema:
type: string
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
configuration:
type: object
'/extensions/{key}/runs':
post:
summary: 'Post Run Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: postRunCtrl
security:
-
bearerAuth: []
get:
summary: 'Get Runs Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getRunsCtrl
security:
-
bearerAuth: []
'/extensions/{key}/runs/status':
get:
summary: 'Get Run Status Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getRunStatusCtrl
security:
-
bearerAuth: []
'/extensions/{key}/schedule':
patch:
summary: 'Patch Schedule Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: patchScheduleCtrl
security:
-
bearerAuth: []
/extensions/dataset-bulk-upload/upload:
post:
summary: 'Upload Dataset File'
responses:
'200':
description: Success
'400':
description: 'No file or invalid metadata JSON'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'413':
description: 'File too large'
'415':
description: 'Unsupported file type'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: uploadDatasetFile
security:
-
bearerAuth: []
description: 'Uploads one CSV, XLS or XLSX file (multipart field file, max 30 MB) with an optional metadata JSON string and creates a dataset record; the bulk upload screen calls it once per file. Requires the dataset-bulk-upload extension to be enabled for the organization (403 otherwise). Requires role: Admin or Editor'
requestBody:
required: true
content:
multipart/form-data:
schema:
type: object
required:
- file
properties:
file:
type: string
metadata:
type: string
/extensions/risk-import/template:
get:
summary: 'Download Excel Template'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: downloadExcelTemplate
security:
-
bearerAuth: []
description: 'Requires the risk-import extension to be enabled for the organization (403 otherwise). Requires role: Admin or Editor'
/extensions/risk-import/import:
post:
summary: 'Bulk Import Risks'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: bulkImportRisks
security:
-
bearerAuth: []
description: 'Requires the risk-import extension to be enabled for the organization (403 otherwise). Requires role: Admin or Editor'
/extensions/slack/oauth/workspaces:
get:
summary: 'Get All Slack Webhooks'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getAllSlackWebhooks
security:
-
bearerAuth: []
description: 'Requires the slack extension to be enabled for the organization (403 otherwise).'
post:
summary: 'Create New Slack Webhook'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: createNewSlackWebhook
security:
-
bearerAuth: []
description: 'Requires the slack extension to be enabled for the organization (403 otherwise).'
'/extensions/slack/oauth/workspaces/{id}':
get:
summary: 'Get Slack Webhook By Id'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getSlackWebhookById
security:
-
bearerAuth: []
description: 'Requires the slack extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
patch:
summary: 'Update Slack Webhook By Id'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: updateSlackWebhookById
security:
-
bearerAuth: []
description: 'Requires the slack extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
delete:
summary: 'Delete Slack Webhook By Id'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: deleteSlackWebhookById
security:
-
bearerAuth: []
description: 'Requires the slack extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
'/extensions/slack/oauth/workspaces/{id}/send':
post:
summary: 'Send Slack Message'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: sendSlackMessage
security:
-
bearerAuth: []
description: 'Requires the slack extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
/extensions/mlflow/models:
get:
summary: 'List Models'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: listModels
security:
-
bearerAuth: []
description: 'Requires the mlflow extension to be enabled for the organization (403 otherwise).'
/extensions/mlflow/sync:
post:
summary: 'Sync From Mlflow'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: syncFromMlflow
security:
-
bearerAuth: []
description: 'Requires the mlflow extension to be enabled for the organization (403 otherwise).'
'/extensions/mlflow/models/{modelId}':
get:
summary: 'Get Model By Id'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getModelById
security:
-
bearerAuth: []
description: 'Requires the mlflow extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: modelId
in: path
required: true
description: 'The modelId'
schema:
type: string
/extensions/azure-ai-foundry/models:
get:
summary: 'List Deployments'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: listDeployments
security:
-
bearerAuth: []
description: 'Requires the azure-ai-foundry extension to be enabled for the organization (403 otherwise).'
/extensions/azure-ai-foundry/sync:
post:
summary: 'Sync From Azure'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: syncFromAzure
security:
-
bearerAuth: []
description: 'Requires the azure-ai-foundry extension to be enabled for the organization (403 otherwise).'
'/extensions/azure-ai-foundry/models/{deploymentId}':
get:
summary: 'Get Deployment By Id'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getDeploymentById
security:
-
bearerAuth: []
description: 'Requires the azure-ai-foundry extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: deploymentId
in: path
required: true
description: 'The deploymentId'
schema:
type: string
/extensions/azure-ai-foundry/discover:
get:
summary: 'Discover Ai Agents'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: discoverAiAgents
security:
-
bearerAuth: []
description: 'Requires the azure-ai-foundry extension to be enabled for the organization (403 otherwise).'
/extensions/jira-assets/config:
get:
summary: 'Get Config'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getConfig
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
post:
summary: 'Post Config'
responses:
'200':
description: Success
'400':
description: 'Validation error (missing connection field, or sync_interval_hours outside 1-168)'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: postConfig
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization and the extension.admin permission (Admin); 403 otherwise.'
/extensions/jira-assets/config/sync:
patch:
summary: 'Patch Sync Settings'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
sync_enabled:
type: boolean
sync_interval_hours:
type: integer
minimum: 1
maximum: 168
responses:
'200':
description: 'Updated sync settings ({ sync_enabled, sync_interval_hours })'
'400':
description: 'Validation error (no field given, non-boolean sync_enabled, or sync_interval_hours outside 1-168)'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'404':
description: 'No Jira connection saved yet'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: patchSyncSettings
security:
-
bearerAuth: []
description: 'Updates only the automatic-sync settings; connection fields are left untouched. Requires the jira-assets extension to be enabled for the organization and the extension.admin permission (Admin); 403 otherwise.'
/extensions/jira-assets/config/selection:
patch:
summary: 'Patch Selection'
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
selected_schema_id:
type: string
nullable: true
selected_object_type_id:
type: string
nullable: true
responses:
'200':
description: 'Updated selection ({ selected_schema_id, selected_object_type_id })'
'400':
description: 'Validation error (no field given, or an id that is not a Jira id)'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'404':
description: 'No Jira connection saved yet'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: patchSelection
security:
-
bearerAuth: []
description: 'Updates only the selected schema and/or object type; a field left out is kept, null clears it. Requires the jira-assets extension to be enabled for the organization and the extension.admin permission (Admin); 403 otherwise.'
/extensions/jira-assets/vw-attributes:
get:
summary: 'Get Vw Attributes'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getVwAttributes
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
/extensions/jira-assets/schemas:
get:
summary: 'Get Schemas'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getSchemas
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
'/extensions/jira-assets/schemas/{schemaId}/object-types':
get:
summary: 'Get Object Types'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getObjectTypes
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: schemaId
in: path
required: true
description: 'The schemaId'
schema:
type: string
'/extensions/jira-assets/object-types/{objectTypeId}/attributes':
get:
summary: 'Get Attributes'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getAttributes
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: objectTypeId
in: path
required: true
description: 'The objectTypeId'
schema:
type: string
'/extensions/jira-assets/object-types/{objectTypeId}/objects':
get:
summary: 'Get Objects'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'404':
description: 'Jira Assets is not configured'
'500':
description: 'Internal server error'
'502':
description: 'Jira or network failure (reason in error)'
tags:
- Extensions
operationId: getObjects
security:
-
bearerAuth: []
description: 'One page (up to 1000 objects) for the import picker, as { objects, hasMore, nextStartAt }; pass nextStartAt as startAt to load more. Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: objectTypeId
in: path
required: true
description: 'The objectTypeId'
schema:
type: string
-
name: startAt
in: query
required: false
description: 'Offset of the first object (default 0)'
schema:
type: integer
minimum: 0
/extensions/jira-assets/import:
post:
summary: 'Post Import'
responses:
'200':
description: Success
'400':
description: 'object_ids is empty or names more than 100 objects'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'404':
description: 'Jira Assets is not configured'
'409':
description: 'A sync or import is already running, or this import was interrupted part-way ({ message, code: import_interrupted, imported, skipped })'
'500':
description: 'Internal server error'
'502':
description: 'Jira or network failure (reason in error)'
tags:
- Extensions
operationId: postImport
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization and the extension.admin permission (Admin); 403 otherwise.'
/extensions/jira-assets/sync:
post:
summary: 'Post Sync'
responses:
'202':
description: 'Sync job queued ({ jobId, previousRunId }); the worker claims the run at pickup. Poll GET /extensions/jira-assets/sync/status until nothing is queued or running and latest_run is newer than previousRunId'
'400':
description: 'No object type selected'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'404':
description: 'Jira Assets is not configured'
'409':
description: 'A run is live, or a sync job for this organization is already waiting'
'500':
description: 'Internal server error'
'503':
description: 'Background jobs are unavailable (the queue did not answer within 5 seconds)'
tags:
- Extensions
operationId: postSync
security:
-
bearerAuth: []
description: 'Starts a manual sync in the background. Requires the jira-assets extension to be enabled for the organization and the extension.admin permission (Admin); 403 otherwise.'
/extensions/jira-assets/sync/status:
get:
summary: 'Get Sync Status Ctrl'
responses:
'200':
description: 'Last-sync fields, running, latest_run (with is_live), and queued (a sync job waiting in the queue; null if the queue did not answer)'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getSyncStatusCtrl
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
/extensions/jira-assets/sync/history:
get:
summary: 'Get Sync History Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getSyncHistoryCtrl
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
/extensions/jira-assets/use-cases:
get:
summary: 'List Use Cases Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: listUseCasesCtrl
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
/extensions/jira-assets/use-cases/remove-missing:
post:
summary: 'Remove Missing Ctrl'
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- use_case_ids
properties:
use_case_ids:
type: array
minItems: 1
maxItems: 25000
items: {type: integer, minimum: 1}
responses:
'200':
description: 'Removed the listed use cases still flagged as missing in Jira ({ removed, links_removed, unlinked, skipped, skipped_items }). removed counts use cases (projects) deleted and links_removed the links that went with them; unlinked counts links whose project is not in this organization (only the link was deleted); skipped_items lists [{ id, reason }] with reason no_longer_missing, not_found, changed, has_live_links or other_links_not_selected (a use case is removed only when all its missing links are in the request)'
'400':
description: 'use_case_ids is not a list of 1 to 1000 use case ids (up to 25,000 when they all belong to one use case), or covers more than 100 use cases'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'409':
description: 'A Jira Assets sync or import is running, or the removal was interrupted, nothing removed ({ message, code: removal_interrupted })'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: removeMissingCtrl
security:
-
bearerAuth: []
description: 'Deletes the listed use cases (projects and their data) that are still flagged as missing in Jira. Syncs never delete. Requires the jira-assets extension to be enabled for the organization and the extension.admin permission (Admin); 403 otherwise.'
'/extensions/jira-assets/use-cases/{id}':
get:
summary: 'Get Use Case Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getUseCaseCtrl
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
delete:
summary: 'Delete Use Case Ctrl'
responses:
'200':
description: 'Deleted ({ success, unlinked, links_removed }); the project goes with all its links (links_removed); unlinked is true when only the link was deleted because its project is not in this organization'
'400':
description: 'Invalid use case id'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'404':
description: 'No Jira Assets use case with that project id'
'409':
description: 'A Jira Assets sync, import or removal is running, or the deletion was interrupted, nothing removed ({ message, code: removal_interrupted })'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: deleteUseCaseCtrl
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization and the extension.admin permission (Admin); 403 otherwise.'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
'/extensions/jira-assets/projects/{projectId}/custom-frameworks-progress':
get:
summary: 'Get Custom Frameworks Progress Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getCustomFrameworksProgressCtrl
security:
-
bearerAuth: []
description: 'Requires the jira-assets extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: projectId
in: path
required: true
description: 'The projectId'
schema:
type: integer
/extensions/jira-incidents/links:
get:
summary: 'Get Jira links for incidents'
description: 'Jira issue links for the given incident ids (incident_ids=1,2, at most 500). Open to any member; returns an empty list when the extension is disabled.'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Extensions/Jira Incidents'
operationId: getLinksCtrl
security:
-
bearerAuth: []
/extensions/jira-incidents/config:
get:
summary: 'Get Jira incidents settings'
description: 'Connection, mappings and readiness. Never returns the API token. Admin only.'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Extensions/Jira Incidents'
operationId: getConfigCtrl
security:
-
bearerAuth: []
put:
summary: 'Save Jira incidents settings'
description: 'Partial update of the connection, mappings and import defaults; checks the credentials with Jira. Admin only.'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Extensions/Jira Incidents'
operationId: putConfigCtrl
security:
-
bearerAuth: []
/extensions/jira-incidents/jira/projects:
get:
summary: 'List Jira projects'
description: 'Projects the saved service account can browse. Admin only.'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Extensions/Jira Incidents'
operationId: getProjectsCtrl
security:
-
bearerAuth: []
/extensions/jira-incidents/jira/issue-types:
get:
summary: 'List Jira issue types'
description: 'Issue types of a Jira project (project=). Admin only.'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Extensions/Jira Incidents'
operationId: getIssueTypesCtrl
security:
-
bearerAuth: []
/extensions/jira-incidents/jira/statuses:
get:
summary: 'List Jira statuses'
description: 'Statuses for a project and issue type, with the default status mappings both ways. Admin only.'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Extensions/Jira Incidents'
operationId: getStatusesCtrl
security:
-
bearerAuth: []
/extensions/jira-incidents/jira/priorities:
get:
summary: 'List Jira priorities'
description: 'Jira priorities with the default priority-to-severity mapping. Admin only.'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Extensions/Jira Incidents'
operationId: getPrioritiesCtrl
security:
-
bearerAuth: []
/extensions/jira-incidents/jira/labels:
get:
summary: 'Search Jira labels'
description: 'Labels matching query, for the import filter. Admin only.'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Extensions/Jira Incidents'
operationId: getLabelsCtrl
security:
-
bearerAuth: []
/extensions/jira-incidents/events:
get:
summary: 'List Jira incidents sync activity'
description: 'Most recent sync events, newest first (limit 1-200, default 50). Admin only.'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Extensions/Jira Incidents'
operationId: getEventsCtrl
security:
-
bearerAuth: []
/extensions/model-lifecycle/config:
get:
summary: 'List Config'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: listConfig
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
/extensions/model-lifecycle/phases:
post:
summary: 'Create Phase Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: createPhaseCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
/extensions/model-lifecycle/phases/reorder:
put:
summary: 'Reorder Phases Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: reorderPhasesCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
'/extensions/model-lifecycle/phases/{id}':
put:
summary: 'Update Phase Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: updatePhaseCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
delete:
summary: 'Delete Phase Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: deletePhaseCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
'/extensions/model-lifecycle/phases/{phaseId}/items':
post:
summary: 'Create Item Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: createItemCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: phaseId
in: path
required: true
description: 'The phaseId'
schema:
type: integer
'/extensions/model-lifecycle/phases/{phaseId}/items/reorder':
put:
summary: 'Reorder Items Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: reorderItemsCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: phaseId
in: path
required: true
description: 'The phaseId'
schema:
type: integer
'/extensions/model-lifecycle/items/{id}':
put:
summary: 'Update Item Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: updateItemCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
delete:
summary: 'Delete Item Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: deleteItemCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
'/extensions/model-lifecycle/models/{id}/lifecycle':
get:
summary: 'Get Lifecycle Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getLifecycleCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
'/extensions/model-lifecycle/models/{id}/lifecycle/progress':
get:
summary: 'Get Progress Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: getProgressCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
'/extensions/model-lifecycle/models/{id}/lifecycle/items/{itemId}':
put:
summary: 'Upsert Value Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: upsertValueCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
-
name: itemId
in: path
required: true
description: 'The itemId'
schema:
type: integer
'/extensions/model-lifecycle/models/{id}/lifecycle/items/{itemId}/files':
post:
summary: 'Attach File Ctrl'
responses:
'201':
description: 'File linked to the item'
'400':
description: 'fileId (body) or a path id is not a positive integer up to 2147483647'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'404':
description: 'File not found in this organization'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: attachFileCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
-
name: itemId
in: path
required: true
description: 'The itemId'
schema:
type: integer
'/extensions/model-lifecycle/models/{id}/lifecycle/items/{itemId}/files/{fileId}':
delete:
summary: 'Detach File Ctrl'
responses:
'200':
description: 'Link removed. The file itself is kept and stays in the File Manager.'
'400':
description: 'id, itemId or fileId is not a positive integer up to 2147483647'
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'404':
description: 'The lifecycle item has no link to this file'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: detachFileCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
-
name: itemId
in: path
required: true
description: 'The itemId'
schema:
type: integer
-
name: fileId
in: path
required: true
description: 'The fileId'
schema:
type: integer
'/extensions/model-lifecycle/models/{id}/lifecycle/items/{itemId}/people':
post:
summary: 'Add Person Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: addPersonCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
-
name: itemId
in: path
required: true
description: 'The itemId'
schema:
type: integer
'/extensions/model-lifecycle/models/{id}/lifecycle/items/{itemId}/people/{userId}':
delete:
summary: 'Remove Person Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: removePersonCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
-
name: itemId
in: path
required: true
description: 'The itemId'
schema:
type: integer
-
name: userId
in: path
required: true
description: 'The userId'
schema:
type: integer
'/extensions/model-lifecycle/models/{id}/lifecycle/items/{itemId}/approvals':
post:
summary: 'Add Approver Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: addApproverCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
-
name: itemId
in: path
required: true
description: 'The itemId'
schema:
type: integer
'/extensions/model-lifecycle/models/{id}/lifecycle/items/{itemId}/approvals/{userId}':
put:
summary: 'Update Approval Status Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: updateApprovalStatusCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
-
name: itemId
in: path
required: true
description: 'The itemId'
schema:
type: integer
-
name: userId
in: path
required: true
description: 'The userId'
schema:
type: integer
delete:
summary: 'Remove Approver Ctrl'
responses:
'200':
description: Success
'403':
description: 'Extension not enabled for this organization, or role not allowed'
'500':
description: 'Internal server error'
tags:
- Extensions
operationId: removeApproverCtrl
security:
-
bearerAuth: []
description: 'Requires the model-lifecycle extension to be enabled for the organization (403 otherwise).'
parameters:
-
name: id
in: path
required: true
description: 'The id'
schema:
type: integer
-
name: itemId
in: path
required: true
description: 'The itemId'
schema:
type: integer
-
name: userId
in: path
required: true
description: 'The userId'
schema:
type: integer
'/model-inventory-change-history/{id}':
get:
tags:
- 'Change History'
summary: 'Get Model Inventory Change History By Id'
operationId: getModelInventoryChangeHistoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/mrm/tiering:
get:
summary: 'Get Fleet Tiering'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getFleetTiering
security:
-
bearerAuth: []
'/mrm/models/{modelId}/tier':
put:
summary: 'Assign Model Tier'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: assignModelTier
security:
-
bearerAuth: []
/mrm/validations:
get:
summary: 'Get Validations'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getValidations
security:
-
bearerAuth: []
'/mrm/models/{modelId}/validations':
post:
summary: 'Create Validation'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: createValidation
security:
-
bearerAuth: []
'/mrm/validations/{id}':
patch:
summary: 'Update Validation'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: updateValidation
security:
-
bearerAuth: []
'/mrm/validations/{id}/signoff':
post:
summary: 'Signoff Validation'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: signoffValidation
security:
-
bearerAuth: []
/mrm/findings:
get:
summary: 'Get Findings'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getFindings
security:
-
bearerAuth: []
'/mrm/validations/{validationId}/findings':
post:
summary: 'Create Finding'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: createFinding
security:
-
bearerAuth: []
'/mrm/findings/{id}':
patch:
summary: 'Update Finding'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: updateFinding
security:
-
bearerAuth: []
'/mrm/models/{modelId}/roles':
get:
summary: 'Get Model Roles'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getModelRoles
security:
-
bearerAuth: []
put:
summary: 'Set Model Roles'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: setModelRoles
security:
-
bearerAuth: []
/mrm/ingestion-tokens:
get:
summary: 'Get Ingestion Tokens'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getIngestionTokens
security:
-
bearerAuth: []
post:
summary: 'Create Ingestion Token'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: createIngestionToken
security:
-
bearerAuth: []
'/mrm/ingestion-tokens/{id}/rotate':
post:
summary: 'Rotate Ingestion Token'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: rotateIngestionToken
security:
-
bearerAuth: []
'/mrm/ingestion-tokens/{id}/revoke':
post:
summary: 'Revoke Ingestion Token'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: revokeIngestionToken
security:
-
bearerAuth: []
/mrm/thresholds:
get:
summary: 'Get Thresholds'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getThresholds
security:
-
bearerAuth: []
'/mrm/models/{modelId}/thresholds':
post:
summary: 'Create Threshold'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: createThreshold
security:
-
bearerAuth: []
'/mrm/thresholds/{id}':
patch:
summary: 'Update Threshold'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: updateThreshold
security:
-
bearerAuth: []
delete:
summary: 'Delete Threshold'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: deleteThreshold
security:
-
bearerAuth: []
/mrm/metric-keys:
get:
summary: 'Get Metric Keys'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getMetricKeys
security:
-
bearerAuth: []
post:
summary: 'Create Metric Key'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: createMetricKey
security:
-
bearerAuth: []
'/mrm/models/{modelId}/monitoring':
get:
summary: 'Get Model Monitoring'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getModelMonitoring
security:
-
bearerAuth: []
'/mrm/models/{modelId}/monitoring/trend':
get:
summary: 'Get Metric Trend'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getMetricTrend
security:
-
bearerAuth: []
'/mrm/models/{modelId}/monitoring/breaches':
get:
summary: 'Get Breach History'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getBreachHistory
security:
-
bearerAuth: []
'/mrm/models/{modelId}/request-revalidation':
post:
summary: 'Request Revalidation'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: requestRevalidation
security:
-
bearerAuth: []
'/mrm/models/{modelId}/revalidation-events':
get:
summary: 'Get Revalidation Events'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getRevalidationEvents
security:
-
bearerAuth: []
/mrm/revalidation/sweep:
post:
summary: 'Run Revalidation Sweep For Org'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: runRevalidationSweepForOrg
security:
-
bearerAuth: []
/mrm/attestation/summary:
get:
summary: 'Get Attestation Summary Handler'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getAttestationSummaryHandler
security:
-
bearerAuth: []
/mrm/attestation/report:
get:
summary: 'Generate Attestation Report Handler'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: generateAttestationReportHandler
security:
-
bearerAuth: []
/mrm/settings:
get:
summary: 'Get Mrm Settings Handler'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: getMrmSettingsHandler
security:
-
bearerAuth: []
put:
summary: 'Update Mrm Settings Handler'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: updateMrmSettingsHandler
security:
-
bearerAuth: []
'/mrm/models/{externalModelKey}/metrics':
post:
summary: 'Ingest Metrics'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Mrm
operationId: ingestMetrics
/datasets:
get:
tags:
- Datasets
summary: 'Get All Datasets'
operationId: getAllDatasets
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Datasets
summary: 'Create New Dataset'
operationId: createNewDataset
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/datasets/{id}':
get:
tags:
- Datasets
summary: 'Get Dataset By Id'
operationId: getDatasetById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- Datasets
summary: 'Update Dataset By Id'
operationId: updateDatasetById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Datasets
summary: 'Delete Dataset By Id'
operationId: deleteDatasetById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/datasets/by-model/{modelId}':
get:
tags:
- Datasets
summary: 'Get Datasets By Model Id'
operationId: getDatasetsByModelId
security:
-
bearerAuth: []
parameters:
-
name: modelId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/datasets/by-project/{projectId}':
get:
tags:
- Datasets
summary: 'Get Datasets By Project Id'
operationId: getDatasetsByProjectId
security:
-
bearerAuth: []
parameters:
-
name: projectId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/datasets/{id}/history':
get:
tags:
- Datasets
summary: 'Get Dataset History'
operationId: getDatasetHistory
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/riskHistory/timeseries:
get:
tags:
- 'Risk History'
summary: 'Get Timeseries'
operationId: riskHistory_getTimeseries
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/riskHistory/current-counts:
get:
tags:
- 'Risk History'
summary: 'Get Current Counts'
operationId: riskHistory_getCurrentCounts
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/riskHistory/snapshot:
post:
tags:
- 'Risk History'
summary: 'Create Snapshot'
operationId: riskHistory_createSnapshot
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/modelRisks:
get:
tags:
- 'Model Risks'
summary: 'Get All Model Risks'
operationId: getAllModelRisks
security:
-
bearerAuth: []
parameters:
-
name: filter
in: query
required: false
schema:
type: string
enum:
- active
- deleted
- all
default: active
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {type: array, items: {$ref: '#/components/schemas/ModelRiskResponse'}}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'Model Risks'
summary: 'Create New Model Risk'
operationId: createNewModelRisk
security:
-
bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ModelRiskInput'
responses:
'201':
description: 'Created successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/ModelRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/modelRisks/{id}':
get:
tags:
- 'Model Risks'
summary: 'Get Model Risk By Id'
operationId: getModelRiskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/ModelRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
tags:
- 'Model Risks'
summary: 'Update Model Risk By Id'
operationId: updateModelRiskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ModelRiskInput'
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/ModelRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- 'Model Risks'
summary: 'Update Model Risk By Id'
operationId: modelRisks_updateModelRiskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/ModelRiskInput'
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
message: {type: string}
data: {$ref: '#/components/schemas/ModelRiskResponse'}
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Model Risks'
summary: 'Delete Model Risk By Id'
operationId: deleteModelRiskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/reporting/templates:
get:
summary: 'List Templates'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Templates
operationId: listTemplates
security:
-
bearerAuth: []
post:
summary: 'Create Template'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Templates
operationId: createTemplate
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/reporting/templates/{id}':
get:
summary: 'Get Template'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Templates
operationId: getTemplate
security:
-
bearerAuth: []
patch:
summary: 'Update Template'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Templates
operationId: updateTemplate
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
delete:
summary: 'Archive Template'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Templates
operationId: archiveTemplate
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/reporting/templates/{id}/run':
post:
summary: 'Run Template Now'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Templates
operationId: runTemplateNow
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
/reporting/scheduled-reports:
get:
summary: 'List Scheduled Reports'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Reporting/Scheduled Reports'
operationId: listScheduledReports
security:
-
bearerAuth: []
post:
summary: 'Create Scheduled Report'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Reporting/Scheduled Reports'
operationId: createScheduledReport
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/reporting/scheduled-reports/{id}':
patch:
summary: 'Update Scheduled Report'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Reporting/Scheduled Reports'
operationId: updateScheduledReport
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
delete:
summary: 'Delete Scheduled Report'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Reporting/Scheduled Reports'
operationId: deleteScheduledReport
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/reporting/scheduled-reports/{id}/pause':
post:
summary: 'Pause Scheduled Report'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Reporting/Scheduled Reports'
operationId: pauseScheduledReport
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/reporting/scheduled-reports/{id}/resume':
post:
summary: 'Resume Scheduled Report'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Reporting/Scheduled Reports'
operationId: resumeScheduledReport
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/reporting/scheduled-reports/{id}/run-now':
post:
summary: 'Run Scheduled Report Now'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Reporting/Scheduled Reports'
operationId: runScheduledReportNow
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
/reporting/runs:
get:
summary: 'List Runs'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Runs
operationId: listRuns
security:
-
bearerAuth: []
'/reporting/runs/{id}':
get:
summary: 'Get Run'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Runs
operationId: getRun
security:
-
bearerAuth: []
delete:
summary: 'Delete Run'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Runs
operationId: deleteRun
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/reporting/runs/{id}/download':
get:
summary: 'Download Run'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Runs
operationId: downloadRun
security:
-
bearerAuth: []
'/reporting/runs/{id}/analyses':
get:
summary: 'Get Run Analyses'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Runs
operationId: getRunAnalyses
security:
-
bearerAuth: []
'/reporting/runs/{id}/archive':
patch:
summary: 'Archive Run'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Runs
operationId: archiveRun
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/reporting/runs/{id}/restore':
patch:
summary: 'Restore Run'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting/Runs
operationId: restoreRun
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
/reporting/generate-report:
post:
tags:
- Reporting
summary: 'Generate Reports'
operationId: generateReports
security:
-
bearerAuth: []
description: 'Requires role: Admin'
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
get:
tags:
- Reporting
summary: 'Get All Generated Reports'
operationId: getAllGeneratedReports
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/reporting/v2/generate-report:
post:
tags:
- Reporting
summary: 'Generate Reports V2'
operationId: generateReportsV2
security:
-
bearerAuth: []
description: 'Requires role: Admin'
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/reporting/sections:
get:
summary: 'List Sections'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Reporting
operationId: listSections
security:
-
bearerAuth: []
'/reporting/{id}':
delete:
tags:
- Reporting
summary: 'Delete Generated Report By Id'
description: 'Admin only. Deletes a generated report file; any other file id answers 404.'
operationId: deleteGeneratedReportById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'400':
description: 'id is not a positive integer up to 2147483647'
'401':
description: Unauthorized
'403':
description: 'Role not allowed to delete reports'
'404':
description: 'No generated report with this id in the organization'
'500':
description: 'Internal server error'
/dashboard:
get:
tags:
- Dashboard
summary: 'Get Dashboard Data'
operationId: getDashboardData
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/tiers/features/{id}':
get:
tags:
- Subscriptions
summary: 'Get Tiers Features'
operationId: getTiersFeatures
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/subscriptions:
get:
tags:
- Subscriptions
summary: 'Get Subscription Controller'
operationId: getSubscriptionController
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Subscriptions
summary: 'Create Subscription Controller'
operationId: createSubscriptionController
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/subscriptions/{id}':
put:
tags:
- Subscriptions
summary: 'Update Subscription Controller'
operationId: updateSubscriptionController
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/tasks:
get:
tags:
- Tasks
summary: 'Get All Tasks'
operationId: getAllTasks
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Tasks
summary: 'Create Task'
operationId: createTask
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/tasks/{id}':
get:
tags:
- Tasks
summary: 'Get Task By Id'
operationId: getTaskById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
tags:
- Tasks
summary: 'Update Task'
operationId: updateTask
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Tasks
summary: 'Delete Task'
operationId: deleteTask
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/tasks/{id}/entities':
get:
tags:
- Tasks
summary: 'Get Task Entity Links'
operationId: getTaskEntityLinks
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Tasks
summary: 'Add Task Entity Link'
operationId: addTaskEntityLink
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/tasks/bulk:
patch:
summary: 'Bulk Update Tasks'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Tasks
operationId: bulkUpdateTasks
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/tasks/{id}/restore':
put:
tags:
- Tasks
summary: 'Restore Task'
operationId: restoreTask
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/tasks/{id}/hard':
delete:
tags:
- Tasks
summary: 'Hard Delete Task'
operationId: hardDeleteTask
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/tasks/{id}/entities/{linkId}':
delete:
tags:
- Tasks
summary: 'Remove Task Entity Link'
operationId: removeTaskEntityLink
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
-
name: linkId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/deadlines/summary:
get:
summary: 'Get Deadlines Summary'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Deadlines
operationId: getDeadlinesSummary
security:
-
bearerAuth: []
/policies/import/docx:
post:
tags:
- Policies
summary: 'Import DOCX and convert to HTML'
description: "Uploads a .docx file (max 10 MB) and converts it to HTML suitable for the policy content editor. Returns the converted HTML and any conversion warnings.\n"
operationId: PolicyController.importDocx
security:
-
bearerAuth: []
requestBody:
required: true
content:
multipart/form-data:
schema:
type: object
required:
- file
properties:
file:
type: string
format: binary
description: 'A .docx file (max 10 MB).'
responses:
'200':
description: 'DOCX converted to HTML successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: object, properties: {html: {type: string, description: 'The converted HTML content'}, warnings: {type: array, items: {type: string}, description: 'Conversion warnings (e.g., unsupported formatting)'}}}
'400':
description: 'Bad request — no file uploaded or invalid file type'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
$ref: '#/components/responses/InternalServerError'
/policies/bulk:
patch:
summary: Unknown
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Policies
operationId: PolicyController.bulkUpdatePolicies
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
/policies:
get:
tags:
- Policies
summary: 'Get all policies'
description: 'Returns all policies for the authenticated user''s organization, including assigned reviewer IDs.'
operationId: PolicyController.getAllPolicies
security:
-
bearerAuth: []
responses:
'200':
description: 'List of policies retrieved successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {$ref: '#/components/schemas/PolicyWithReviewers'}}
'500':
$ref: '#/components/responses/InternalServerError'
post:
tags:
- Policies
summary: 'Create a new policy'
description: 'Creates a new policy. The author_id and last_updated_by are set from the JWT token automatically.'
operationId: PolicyController.createPolicy
security:
-
bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyCreateRequest'
responses:
'201':
description: 'Policy created successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Created}
data: {$ref: '#/components/schemas/PolicyWithReviewers'}
'500':
$ref: '#/components/responses/InternalServerError'
'503':
description: 'Service unavailable — policy creation failed'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
/policies/tags:
get:
tags:
- Policies
summary: 'Get available policy tags'
description: 'Returns the static list of allowed policy tags.'
operationId: PolicyController.getPolicyTags
security:
-
bearerAuth: []
responses:
'200':
description: 'List of available tags'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {type: array, items: {type: string, enum: ['AI ethics', Fairness, Transparency, Explainability, 'Bias mitigation', Privacy, 'Data governance', 'Model risk', Accountability, Security, LLM, 'Human oversight', 'EU AI Act', 'ISO 42001', 'NIST RMF', 'Red teaming', Audit, Monitoring, 'Vendor management']}}
'500':
$ref: '#/components/responses/InternalServerError'
'/policies/{id}/export/pdf':
get:
tags:
- Policies
summary: 'Export policy as PDF'
description: 'Generates and downloads the policy as a PDF file.'
operationId: PolicyController.exportPolicyPDF
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/PolicyId'
responses:
'200':
description: 'PDF file stream'
content:
application/pdf:
schema:
type: string
format: binary
headers:
Content-Disposition:
schema:
type: string
example: 'attachment; filename="AI_Ethics_Policy.pdf"'
Content-Length:
schema:
type: integer
'400':
description: 'Invalid policy ID'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'/policies/{id}/export/docx':
get:
tags:
- Policies
summary: 'Export policy as DOCX'
description: 'Generates and downloads the policy as a DOCX file.'
operationId: PolicyController.exportPolicyDOCX
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/PolicyId'
responses:
'200':
description: 'DOCX file stream'
content:
application/vnd.openxmlformats-officedocument.wordprocessingml.document:
schema:
type: string
format: binary
headers:
Content-Disposition:
schema:
type: string
example: 'attachment; filename="AI_Ethics_Policy.docx"'
Content-Length:
schema:
type: integer
'400':
description: 'Invalid policy ID'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'/policies/{id}':
get:
tags:
- Policies
summary: 'Get policy by ID'
description: 'Returns a single policy by its ID, including assigned reviewer IDs.'
operationId: PolicyController.getPolicyById
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/PolicyId'
responses:
'200':
description: 'Policy retrieved successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/PolicyWithReviewers'}
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
put:
tags:
- Policies
summary: 'Update a policy'
description: "Updates an existing policy. Only provided fields are updated. The last_updated_by and last_updated_at are set automatically from the JWT token. If assigned_reviewer_ids is provided, the reviewer list is fully replaced.\n"
operationId: PolicyController.updatePolicy
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/PolicyId'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyUpdateRequest'
responses:
'202':
description: 'Policy updated successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {$ref: '#/components/schemas/PolicyWithReviewers'}
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
delete:
tags:
- Policies
summary: 'Delete a policy by ID'
description: 'Permanently deletes a policy and its associated reviewer mappings (via CASCADE).'
operationId: PolicyController.deletePolicyById
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/PolicyId'
responses:
'202':
description: 'Policy deleted successfully'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: Accepted}
data: {type: boolean, example: true}
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'/policies/{id}/review/request':
post:
tags:
- Policies
summary: 'Request review for a policy'
description: "Sets the policy review status to pending_review and sends in-app notifications to each specified reviewer.\n"
operationId: PolicyController.requestReview
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/PolicyId'
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- reviewer_ids
properties:
reviewer_ids:
type: array
items: {type: integer}
description: 'List of user IDs to request review from'
example: [2, 5, 8]
message:
type: string
description: 'Optional message to include in the review request notification'
example: 'Please review the updated data governance section.'
responses:
'200':
description: 'Review requested successfully; returns the updated policy'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/PolicyWithReviewers'}
'400':
description: 'Invalid policy ID or missing reviewer_ids'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'/policies/{id}/review/approve':
put:
tags:
- Policies
summary: 'Approve a policy review'
description: "Sets the policy review status to approved and sends an in-app notification to the policy author.\n"
operationId: PolicyController.approveReview
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/PolicyId'
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
comment:
type: string
description: 'Optional approval comment'
example: 'Looks good, approved.'
responses:
'200':
description: 'Policy review approved; returns the updated policy'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/PolicyWithReviewers'}
'400':
description: 'Invalid policy ID'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'/policies/{id}/review/reject':
put:
tags:
- Policies
summary: 'Reject a policy review (request changes)'
description: "Sets the policy review status to changes_requested and sends an in-app notification to the policy author. A comment is required.\n"
operationId: PolicyController.rejectReview
security:
-
bearerAuth: []
parameters:
-
$ref: '#/components/parameters/PolicyId'
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- comment
properties:
comment:
type: string
description: 'Reason for requesting changes (required)'
example: 'Section 3 needs more detail on bias mitigation procedures.'
responses:
'200':
description: 'Policy review rejected; returns the updated policy'
content:
application/json:
schema:
type: object
properties:
message: {type: string, example: OK}
data: {$ref: '#/components/schemas/PolicyWithReviewers'}
'400':
description: 'Invalid policy ID or missing comment'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'/policies/folders/{folderId}/policies':
get:
tags:
- Policies
summary: 'Get Policies In Folder'
operationId: getPoliciesInFolder
security:
-
bearerAuth: []
parameters:
-
name: folderId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/policies/{id}/folders':
get:
tags:
- Policies
summary: 'Get Policy Folders'
operationId: getPolicyFolders
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- Policies
summary: 'Update Policy Folders'
operationId: updatePolicyFolders
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/slackWebhooks:
get:
tags:
- Integrations
summary: 'Get All Slack Webhooks'
operationId: slackWebhooks_getAllSlackWebhooks
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Integrations
summary: 'Create New Slack Webhook'
operationId: slackWebhooks_createNewSlackWebhook
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/slackWebhooks/{id}':
get:
tags:
- Integrations
summary: 'Get Slack Webhook By Id'
operationId: slackWebhooks_getSlackWebhookById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- Integrations
summary: 'Update Slack Webhook By Id'
operationId: slackWebhooks_updateSlackWebhookById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Integrations
summary: 'Delete Slack Webhook By Id'
operationId: slackWebhooks_deleteSlackWebhookById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/slackWebhooks/{id}/send':
post:
tags:
- Integrations
summary: 'Send Slack Message'
operationId: slackWebhooks_sendSlackMessage
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/tokens:
get:
tags:
- Authentication
summary: 'Get Api Tokens'
operationId: getApiTokens
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Authentication
summary: 'Create Api Token'
operationId: createApiToken
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/tokens/{id}/revoke':
post:
summary: 'Revoke Api Token'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Authentication
operationId: revokeApiToken
security:
-
bearerAuth: []
'/tokens/{id}':
delete:
tags:
- Authentication
summary: 'Delete Api Token'
operationId: deleteApiToken
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shares/token/{token}':
get:
tags:
- 'Share Links'
summary: 'Get Share Link By Token'
operationId: getShareLinkByToken
parameters:
-
name: token
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
'500':
description: 'Internal server error'
'/shares/view/{token}':
get:
tags:
- 'Share Links'
summary: 'Get Shared Data By Token'
operationId: getSharedDataByToken
parameters:
-
name: token
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
'500':
description: 'Internal server error'
/shares:
post:
tags:
- 'Share Links'
summary: 'Create Share Link'
operationId: createShareLink
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shares/{resourceType}/{resourceId}':
get:
tags:
- 'Share Links'
summary: 'Get Share Links For Resource'
operationId: getShareLinksForResource
security:
-
bearerAuth: []
parameters:
-
name: resourceType
in: path
required: true
schema:
type: string
-
name: resourceId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shares/{id}':
patch:
tags:
- 'Share Links'
summary: 'Update Share Link'
operationId: updateShareLink
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Share Links'
summary: 'Delete Share Link'
operationId: deleteShareLink
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/file-manager:
post:
tags:
- Files
summary: 'Upload File'
operationId: uploadFile
security:
-
bearerAuth: []
description: 'Requires role: Admin or Reviewer or Editor'
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
get:
tags:
- Files
summary: 'List Files'
operationId: listFiles
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/file-manager/search:
get:
tags:
- Files
summary: 'Search Files'
operationId: searchFiles
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/file-manager/with-metadata:
get:
tags:
- Files
summary: 'List Files With Metadata'
operationId: listFilesWithMetadata
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/file-manager/org-settings:
get:
summary: 'Get File Org Settings Handler'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Files
operationId: getFileOrgSettingsHandler
security:
-
bearerAuth: []
put:
summary: 'Update File Org Settings Handler'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Files
operationId: updateFileOrgSettingsHandler
security:
-
bearerAuth: []
'/file-manager/{id}':
get:
tags:
- Files
summary: 'Download File'
operationId: downloadFile
security:
-
bearerAuth: []
description: 'Requires role: Admin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
delete:
tags:
- Files
summary: 'Remove File'
operationId: removeFile
security:
-
bearerAuth: []
description: 'Requires role: Admin or Reviewer or Editor'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/file-manager/{id}/metadata':
get:
tags:
- Files
summary: 'Get File Metadata'
operationId: getFileMetadata
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- Files
summary: 'Update Metadata'
operationId: updateMetadata
security:
-
bearerAuth: []
description: 'Requires role: Admin or Reviewer or Editor'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/file-manager/{id}/versions':
get:
tags:
- Files
summary: 'Get File Version History'
operationId: getFileVersionHistory
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/file-manager/{id}/preview':
get:
tags:
- Files
summary: 'Preview File'
operationId: previewFile
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/automations:
get:
tags:
- Automations
summary: 'Get All Automations'
operationId: getAllAutomations
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Automations
summary: 'Create Automation'
operationId: createAutomation
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/automations/triggers:
get:
tags:
- Automations
summary: 'Get All Automation Triggers'
operationId: getAllAutomationTriggers
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/automations/actions/by-triggerId/{triggerId}':
get:
tags:
- Automations
summary: 'Get All Automation Actions By Trigger Id'
operationId: getAllAutomationActionsByTriggerId
security:
-
bearerAuth: []
parameters:
-
name: triggerId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/automations/{id}/history':
get:
tags:
- Automations
summary: 'Get Automation History'
operationId: getAutomationHistory
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/automations/{id}/stats':
get:
tags:
- Automations
summary: 'Get Automation Stats'
operationId: getAutomationStats
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/automations/{id}':
get:
tags:
- Automations
summary: 'Get Automation By Id'
operationId: getAutomationById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
tags:
- Automations
summary: 'Update Automation'
operationId: updateAutomation
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Automations
summary: 'Delete Automation By Id'
operationId: deleteAutomationById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/user-preferences/{userId}':
get:
tags:
- Users
summary: 'Get Preferences By User'
operationId: getPreferencesByUser
security:
-
bearerAuth: []
parameters:
-
name: userId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- Users
summary: 'Update User Preferences'
operationId: updateUserPreferences
security:
-
bearerAuth: []
parameters:
-
name: userId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/user-preferences:
post:
tags:
- Users
summary: 'Create User Preferences'
operationId: createUserPreferences
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/llm-keys:
get:
tags:
- 'LLM Keys'
summary: 'Get L L M Keys'
description: 'Callers without the llmKeys.admin permission get custom_headers as null and, for Custom providers, only the origin (scheme and host) of the URL. The API key itself is never returned.'
operationId: getLLMKeys
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'LLM Keys'
summary: 'Create L L M Key'
operationId: createLLMKey
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - requires the llmKeys.admin permission (Admin by default)'
'500':
description: 'Internal server error'
/llm-keys/status:
get:
tags:
- 'LLM Keys'
summary: 'Get L L M Key Status'
operationId: getLLMKeyStatus
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/llm-keys/{name}':
get:
tags:
- 'LLM Keys'
summary: 'Get L L M Key'
description: 'Callers without the llmKeys.admin permission get custom_headers as null and, for Custom providers, only the origin (scheme and host) of the URL. The API key itself is never returned.'
operationId: getLLMKey
security:
-
bearerAuth: []
parameters:
-
name: name
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/llm-keys/{id}':
patch:
tags:
- 'LLM Keys'
summary: 'Update L L M Key'
operationId: updateLLMKey
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - requires the llmKeys.admin permission (Admin by default)'
'500':
description: 'Internal server error'
delete:
tags:
- 'LLM Keys'
summary: 'Delete L L M Key'
operationId: deleteLLMKey
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - requires the llmKeys.admin permission (Admin by default)'
'500':
description: 'Internal server error'
/nist-ai-rmf/functions:
get:
tags:
- 'NIST AI RMF'
summary: 'Get All N I S T A I R M Ffunctions'
operationId: getAllNISTAIRMFfunctions
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/nist-ai-rmf/functions/{id}':
get:
tags:
- 'NIST AI RMF'
summary: 'Get N I S T A I R M Ffunction By Id'
operationId: getNISTAIRMFfunctionById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/nist-ai-rmf/categories/{title}':
get:
tags:
- 'NIST AI RMF'
summary: 'Get All N I S T A I R M F Categories Byfunction Id'
operationId: getAllNISTAIRMFCategoriesByfunctionId
security:
-
bearerAuth: []
parameters:
-
name: title
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/nist-ai-rmf/subcategories/byId/{id}':
get:
tags:
- 'NIST AI RMF'
summary: 'Get N I S T A I R M F Subcategory By Id'
operationId: getNISTAIRMFSubcategoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/nist-ai-rmf/subcategories/{id}/risks':
get:
tags:
- 'NIST AI RMF'
summary: 'Get N I S T A I R M F Subcategory Risks'
operationId: getNISTAIRMFSubcategoryRisks
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/nist-ai-rmf/subcategories/{categoryId}/{title}':
get:
tags:
- 'NIST AI RMF'
summary: 'Get All N I S T A I R M F Subcategories Bycategory Id Andtitle'
operationId: getAllNISTAIRMFSubcategoriesBycategoryIdAndtitle
security:
-
bearerAuth: []
parameters:
-
name: categoryId
in: path
required: true
schema:
type: integer
-
name: title
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/nist-ai-rmf/subcategories/{id}':
patch:
tags:
- 'NIST AI RMF'
summary: 'Update N I S T A I R M F Subcategory By Id'
operationId: updateNISTAIRMFSubcategoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/nist-ai-rmf/subcategories/{id}/status':
patch:
tags:
- 'NIST AI RMF'
summary: 'Update N I S T A I R M F Subcategory Status'
operationId: updateNISTAIRMFSubcategoryStatus
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/nist-ai-rmf/progress:
get:
tags:
- 'NIST AI RMF'
summary: 'Get N I S T A I R M F Progress'
operationId: getNISTAIRMFProgress
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/nist-ai-rmf/progress-by-function:
get:
tags:
- 'NIST AI RMF'
summary: 'Get N I S T A I R M F Progress By Function'
operationId: getNISTAIRMFProgressByFunction
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/nist-ai-rmf/assignments:
get:
tags:
- 'NIST AI RMF'
summary: 'Get N I S T A I R M F Assignments'
operationId: getNISTAIRMFAssignments
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/nist-ai-rmf/assignments-by-function:
get:
tags:
- 'NIST AI RMF'
summary: 'Get N I S T A I R M F Assignments By Function'
operationId: getNISTAIRMFAssignmentsByFunction
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/nist-ai-rmf/status-breakdown:
get:
tags:
- 'NIST AI RMF'
summary: 'Get N I S T A I R M F Status Breakdown'
operationId: getNISTAIRMFStatusBreakdown
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/nist-ai-rmf/overview:
get:
tags:
- 'NIST AI RMF'
summary: 'Get N I S T A I R M F Overview'
operationId: getNISTAIRMFOverview
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/evidenceHub/freshness-sweep:
post:
summary: 'Run Freshness Sweep'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Evidence
operationId: runFreshnessSweep
security:
-
bearerAuth: []
description: 'Requires role: Admin'
/evidenceHub:
get:
tags:
- Evidence
summary: 'Get All Evidences'
operationId: getAllEvidences
security:
-
bearerAuth: []
parameters:
-
name: includeArchived
in: query
required: false
description: 'Include archived (soft-archived expired) records. Default false.'
schema:
type: boolean
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Evidence
summary: 'Create New Evidence'
operationId: createNewEvidence
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/evidenceHub/{id}':
get:
tags:
- Evidence
summary: 'Get Evidence By Id'
operationId: getEvidenceById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- Evidence
summary: 'Update Evidence By Id'
operationId: updateEvidenceById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Evidence
summary: 'Delete Evidence By Id'
operationId: deleteEvidenceById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/evidence-ai/analyze/{fileId}':
post:
summary: 'Analyze File'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Evidence AI'
operationId: analyzeFile
security:
-
bearerAuth: []
'/evidence-ai/analysis/{fileId}':
get:
summary: 'Get Analysis'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Evidence AI'
operationId: getAnalysis
security:
-
bearerAuth: []
/evidence-ai/quality-scores:
get:
summary: 'Get Quality Scores'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Evidence AI'
operationId: getQualityScores
security:
-
bearerAuth: []
/evidence-ai/gaps:
get:
summary: 'Get Gaps'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Evidence AI'
operationId: getGaps
security:
-
bearerAuth: []
'/evidence-ai/suggestions/{fileId}':
get:
summary: 'Get Suggestions'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Evidence AI'
operationId: getSuggestions
security:
-
bearerAuth: []
'/evidence-ai/suggestions/{fileId}/apply':
post:
summary: 'Apply Suggestions'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Evidence AI'
operationId: applySuggestions
security:
-
bearerAuth: []
/readiness/calculate:
post:
summary: 'Calculate All'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Readiness
operationId: calculateAll
security:
-
bearerAuth: []
'/readiness/calculate/{frameworkType}':
post:
summary: 'Calculate For Framework'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Readiness
operationId: calculateForFramework
security:
-
bearerAuth: []
/readiness/scores:
get:
summary: 'Get Scores'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Readiness
operationId: getScores
security:
-
bearerAuth: []
'/readiness/scores/{frameworkType}':
get:
summary: 'Get Scores By Framework'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Readiness
operationId: getScoresByFramework
security:
-
bearerAuth: []
'/readiness/controls/{frameworkType}':
get:
summary: 'Get Control Scores'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Readiness
operationId: getControlScores
security:
-
bearerAuth: []
/readiness/weakest:
get:
summary: 'Get Weakest'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Readiness
operationId: getWeakest
security:
-
bearerAuth: []
/readiness/recommendations:
get:
summary: 'Get Recommendations'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Readiness
operationId: getRecommendations
security:
-
bearerAuth: []
/readiness/history:
get:
summary: 'Get History'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Readiness
operationId: getHistory
security:
-
bearerAuth: []
/ai-content/stats:
get:
summary: 'Get Stats'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Content'
operationId: getStats
security:
-
bearerAuth: []
/ai-content/unreviewed:
get:
summary: 'Get Unreviewed'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Content'
operationId: getUnreviewed
security:
-
bearerAuth: []
'/ai-content/{entityType}/{entityId}':
get:
summary: 'Get Badges'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Content'
operationId: getBadges
security:
-
bearerAuth: []
'/ai-content/{id}/review':
patch:
summary: 'Review Content'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Content'
operationId: reviewContent
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/ai-confirmation/approve/{id}':
post:
summary: 'Approve Confirmation'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Confirmation'
operationId: approveConfirmation
security:
-
bearerAuth: []
description: 'Requires role: Admin'
'/ai-confirmation/reject/{id}':
post:
summary: 'Reject Confirmation'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Confirmation'
operationId: rejectConfirmation
security:
-
bearerAuth: []
description: 'Requires role: Admin'
/ai-confirmation/pending:
get:
summary: 'Get Pending Confirmations'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Confirmation'
operationId: getPendingConfirmations
security:
-
bearerAuth: []
/ai-approvals/stats:
get:
summary: 'Get Approval Stats Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Approvals'
operationId: getApprovalStatsCtrl
security:
-
bearerAuth: []
/ai-approvals:
get:
summary: 'List Approvals Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Approvals'
operationId: listApprovalsCtrl
security:
-
bearerAuth: []
'/ai-approvals/{id}':
get:
summary: 'Get Approval Detail Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Approvals'
operationId: getApprovalDetailCtrl
security:
-
bearerAuth: []
'/ai-approvals/{id}/approve':
post:
summary: 'Approve Approval Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Approvals'
operationId: approveApprovalCtrl
security:
-
bearerAuth: []
description: 'Requires role: Admin'
'/ai-approvals/{id}/reject':
post:
summary: 'Reject Approval Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Approvals'
operationId: rejectApprovalCtrl
security:
-
bearerAuth: []
description: 'Requires role: Admin'
/ai-approval-rules/test:
post:
summary: 'Test Rule Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Approval Rules'
operationId: testRuleCtrl
security:
-
bearerAuth: []
/ai-approval-rules:
get:
summary: 'List Rules Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Approval Rules'
operationId: listRulesCtrl
security:
-
bearerAuth: []
post:
summary: 'Create Rule Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Approval Rules'
operationId: createRuleCtrl
security:
-
bearerAuth: []
'/ai-approval-rules/{id}':
put:
summary: 'Update Rule Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Approval Rules'
operationId: updateRuleCtrl
security:
-
bearerAuth: []
delete:
summary: 'Delete Rule Ctrl'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Approval Rules'
operationId: deleteRuleCtrl
security:
-
bearerAuth: []
/ai-apps:
get:
summary: 'Get All Ai Apps'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: getAllAiApps
security:
-
bearerAuth: []
post:
summary: 'Create Ai App'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: createAiApp
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
/ai-apps/policy-suggestions:
get:
summary: 'Get Policy Suggestions'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: getPolicySuggestions
security:
-
bearerAuth: []
'/ai-apps/{id}':
get:
summary: 'Get Ai App By Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: getAiAppById
security:
-
bearerAuth: []
patch:
summary: 'Update Ai App By Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: updateAiAppById
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
delete:
summary: 'Delete Ai App By Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: deleteAiAppById
security:
-
bearerAuth: []
description: 'Requires role: Admin'
'/ai-apps/{id}/models':
post:
summary: 'Link Models To Ai App'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: linkModelsToAiApp
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/ai-apps/{id}/policies':
post:
summary: 'Set Policies For Ai App'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: setPoliciesForAiApp
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/ai-apps/{id}/data-exposure':
post:
summary: 'Set Data Exposure For Ai App'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: setDataExposureForAiApp
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/ai-apps/from-shadow-ai/{shadowAiToolId}':
post:
summary: 'Promote From Shadow Ai'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: promoteFromShadowAi
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/ai-apps/{id}/status':
patch:
summary: 'Update Ai App Status'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Apps'
operationId: updateAiAppStatus
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
/ai-audit/analytics:
get:
summary: 'Get Analytics'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Audit'
operationId: getAnalytics
security:
-
bearerAuth: []
/ai-audit/export:
get:
summary: 'Export Audit Log'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Audit'
operationId: exportAuditLog
security:
-
bearerAuth: []
description: 'Requires role: Admin'
'/ai-audit/log/{actionId}':
get:
summary: 'Get Action Audit Trail'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Audit'
operationId: getActionAuditTrail
security:
-
bearerAuth: []
/ai-audit/log:
get:
summary: 'Get Audit Log'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Audit'
operationId: getAuditLog
security:
-
bearerAuth: []
/observability/metrics:
get:
summary: 'Get Metrics'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Observability
operationId: getMetrics
security:
-
bearerAuth: []
/observability/traces:
get:
summary: 'Get Traces'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Observability
operationId: getTraces
security:
-
bearerAuth: []
'/observability/traces/{id}':
get:
summary: 'Get Trace Detail'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Observability
operationId: getTraceDetail
security:
-
bearerAuth: []
/observability/costs:
get:
summary: 'Get Costs'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Observability
operationId: getCosts
security:
-
bearerAuth: []
/observability/performance:
get:
summary: 'Get Performance'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Observability
operationId: getPerformance
security:
-
bearerAuth: []
/advisor:
post:
tags:
- 'AI Advisor'
summary: 'Run Advisor'
operationId: runAdvisor
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/advisor/stream:
post:
tags:
- 'AI Advisor'
summary: 'Stream Advisor'
operationId: streamAdvisor
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/advisor/chat:
post:
tags:
- 'AI Advisor'
summary: 'Stream Advisor V2'
operationId: streamAdvisorV2
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/advisor/conversations/{domain}':
get:
tags:
- 'AI Advisor'
summary: 'List conversations for a domain'
description: 'Returns all conversations the current user has in the given advisor domain, most recent first. Lightweight summaries only — no message bodies.'
operationId: listConversations
security:
-
bearerAuth: []
parameters:
-
name: domain
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'AI Advisor'
summary: 'Create a new empty conversation'
description: 'Creates a fresh empty conversation in the given domain. Title is derived automatically when the first user message is saved.'
operationId: createConversation
security:
-
bearerAuth: []
parameters:
-
name: domain
in: path
required: true
schema:
type: string
responses:
'201':
description: 'Conversation created'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/advisor/conversations/{domain}/{id}':
get:
tags:
- 'AI Advisor'
summary: 'Get a single conversation'
description: 'Returns the full conversation including its messages array.'
operationId: getConversationById
security:
-
bearerAuth: []
parameters:
-
name: domain
in: path
required: true
schema:
type: string
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'404':
description: 'Conversation not found'
'500':
description: 'Internal server error'
put:
tags:
- 'AI Advisor'
summary: 'Update conversation messages'
description: 'Replaces the messages array of an existing conversation. Bumps last_message_at and auto-derives the title on first save.'
operationId: updateConversation
security:
-
bearerAuth: []
parameters:
-
name: domain
in: path
required: true
schema:
type: string
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
properties:
messages:
type: array
items: {type: object}
responses:
'200':
description: 'Updated successfully'
'401':
description: Unauthorized
'404':
description: 'Conversation not found'
'500':
description: 'Internal server error'
delete:
tags:
- 'AI Advisor'
summary: 'Delete a conversation'
operationId: deleteConversation
security:
-
bearerAuth: []
parameters:
-
name: domain
in: path
required: true
schema:
type: string
-
name: id
in: path
required: true
schema:
type: integer
responses:
'204':
description: Deleted
'401':
description: Unauthorized
'404':
description: 'Conversation not found'
'500':
description: 'Internal server error'
/advisor/memory:
get:
summary: 'Get Memory Summary'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Advisor'
operationId: getMemorySummary
security:
-
bearerAuth: []
delete:
summary: 'Delete My Memory'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Advisor'
operationId: deleteMyMemory
security:
-
bearerAuth: []
'/advisor/memory/admin/agent/{agentName}':
get:
summary: 'Admin List Agent Messages'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Advisor'
operationId: adminListAgentMessages
security:
-
bearerAuth: []
delete:
summary: 'Admin Clear Agent Memory'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Advisor'
operationId: adminClearAgentMemory
security:
-
bearerAuth: []
/policy-linked:
get:
tags:
- Policies
summary: 'Get All Linked Objects'
operationId: getAllLinkedObjects
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/policy-linked/{policyId}/linked-objects':
get:
tags:
- Policies
summary: 'Get Linked Objects For Policy'
operationId: getLinkedObjects
security:
-
bearerAuth: []
parameters:
-
name: policyId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Policies
summary: 'Create Linked Object For Policy'
operationId: createLinkedObject
security:
-
bearerAuth: []
parameters:
-
name: policyId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Policies
summary: 'Delete Linked Object For Policy'
operationId: deleteLinkedObject
security:
-
bearerAuth: []
parameters:
-
name: policyId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/policy-linked/risk/{riskId}/unlink-all':
delete:
tags:
- Policies
summary: 'Unlink Risk From All Policies'
operationId: deleteRiskFromAllPolicies
security:
-
bearerAuth: []
parameters:
-
name: riskId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/policy-linked/evidence/{evidenceId}/unlink-all':
delete:
tags:
- Policies
summary: 'Unlink Evidence From All Policies'
operationId: deleteEvidenceFromAllPolicies
security:
-
bearerAuth: []
parameters:
-
name: evidenceId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/ai-incident-managements:
get:
tags:
- Incidents
summary: 'Get All Incidents'
operationId: getAllIncidents
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Incidents
summary: 'Create New Incident'
operationId: createNewIncident
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-incident-managements/{id}':
get:
tags:
- Incidents
summary: 'Get Incident By Id'
operationId: getIncidentById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- Incidents
summary: 'Update Incident By Id'
operationId: updateIncidentById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Incidents
summary: 'Delete Incident By Id'
operationId: deleteIncidentById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-incident-managements/{id}/archive':
patch:
tags:
- Incidents
summary: 'Archive Incident By Id'
operationId: archiveIncidentById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ce-marking/{projectId}':
get:
tags:
- 'CE Marking'
summary: 'Get C E Marking'
operationId: getCEMarking
security:
-
bearerAuth: []
parameters:
-
name: projectId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
tags:
- 'CE Marking'
summary: 'Update C E Marking'
operationId: updateCEMarking
security:
-
bearerAuth: []
parameters:
-
name: projectId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/search:
get:
tags:
- Search
summary: Search
operationId: search
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/deepeval/playground/chat:
post:
summary: Provider
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'LLM Evals'
operationId: provider
security:
-
bearerAuth: []
/evaluation-llm-keys:
get:
tags:
- 'LLM Evals'
summary: 'Get All Evaluation LLM Keys'
operationId: evalKeysRetired
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'LLM Evals'
summary: 'Add Evaluation LLM Key'
operationId: evaluation_llm_keys_evalKeysRetired
security:
-
bearerAuth: []
description: 'Requires role: Admin'
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- provider
- apiKey
properties:
provider:
type: string
enum: [openai, anthropic, google, xai, mistral, huggingface]
apiKey:
type: string
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/evaluation-llm-keys/verify:
post:
tags:
- 'LLM Evals'
summary: 'Verify Evaluation LLM Key'
operationId: evaluation_llm_keys_evalKeysRetired
security:
-
bearerAuth: []
description: 'Requires role: Admin'
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- provider
- apiKey
properties:
provider:
type: string
enum: [openai, anthropic, google, xai, mistral, huggingface, openrouter]
apiKey:
type: string
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/evaluation-llm-keys/{provider}':
delete:
tags:
- 'LLM Evals'
summary: 'Delete Evaluation LLM Key'
operationId: evaluation_llm_keys_evalKeysRetired
security:
-
bearerAuth: []
description: 'Requires role: Admin'
parameters:
-
name: provider
in: path
required: true
schema:
type: string
enum:
- openai
- anthropic
- google
- xai
- mistral
- huggingface
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/evaluation-llm-keys/internal/decrypted:
get:
summary: 'Eval Keys Retired'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'LLM Evals'
operationId: evaluation_llm_keys_evalKeysRetired
/notes:
post:
tags:
- Notes
summary: 'Create Note'
operationId: createNote
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
get:
tags:
- Notes
summary: 'Get Notes'
operationId: getNotes
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/notes/{id}':
put:
tags:
- Notes
summary: 'Update Note'
operationId: updateNote
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Notes
summary: 'Delete Note'
operationId: deleteNote
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/entity-graph/annotations:
post:
tags:
- 'Entity Graph'
summary: 'Save Annotation'
operationId: saveAnnotation
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
get:
tags:
- 'Entity Graph'
summary: 'Get Annotations'
operationId: getAnnotations
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/entity-graph/annotations/{entityType}/{entityId}':
get:
tags:
- 'Entity Graph'
summary: 'Get Annotation By Entity'
operationId: getAnnotationByEntity
security:
-
bearerAuth: []
parameters:
-
name: entityType
in: path
required: true
schema:
type: string
-
name: entityId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/entity-graph/annotations/{id}':
delete:
tags:
- 'Entity Graph'
summary: 'Delete Annotation'
operationId: deleteAnnotation
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/entity-graph/annotations/entity/{entityType}/{entityId}':
delete:
tags:
- 'Entity Graph'
summary: 'Delete Annotation By Entity'
operationId: deleteAnnotationByEntity
security:
-
bearerAuth: []
parameters:
-
name: entityType
in: path
required: true
schema:
type: string
-
name: entityId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/entity-graph/views:
post:
tags:
- 'Entity Graph'
summary: 'Create View'
operationId: createView
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
get:
tags:
- 'Entity Graph'
summary: 'Get Views'
operationId: getViews
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/entity-graph/views/{id}':
get:
tags:
- 'Entity Graph'
summary: 'Get View By Id'
operationId: getViewById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
tags:
- 'Entity Graph'
summary: 'Update View'
operationId: updateView
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Entity Graph'
summary: 'Delete View'
operationId: deleteView
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/entity-graph/gap-rules/defaults:
get:
tags:
- 'Entity Graph'
summary: 'Get Default Gap Rules'
operationId: getDefaultGapRules
responses:
'200':
description: Success
'500':
description: 'Internal server error'
/entity-graph/gap-rules:
post:
tags:
- 'Entity Graph'
summary: 'Save Gap Rules'
operationId: saveGapRules
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
get:
tags:
- 'Entity Graph'
summary: 'Get Gap Rules'
operationId: getGapRules
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Entity Graph'
summary: 'Reset Gap Rules'
operationId: resetGapRules
security:
-
bearerAuth: []
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/vendor-risk-change-history/{id}':
get:
tags:
- 'Change History'
summary: 'Get Vendor Risk Change History By Id'
operationId: getVendorRiskChangeHistoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/policy-change-history/{id}':
get:
tags:
- 'Change History'
summary: 'Get Policy Change History By Id'
operationId: getPolicyChangeHistoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/incident-change-history/{incidentId}':
get:
tags:
- 'Change History'
summary: 'Get Incident History'
operationId: getIncidentHistory
security:
-
bearerAuth: []
parameters:
-
name: incidentId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/use-case-change-history/{useCaseId}':
get:
tags:
- 'Change History'
summary: 'Get Use Case History'
operationId: getUseCaseHistory
security:
-
bearerAuth: []
parameters:
-
name: useCaseId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/risk-change-history/{projectRiskId}':
get:
tags:
- 'Change History'
summary: 'Get Project Risk Change History By Risk Id'
operationId: getProjectRiskChangeHistoryByRiskId
security:
-
bearerAuth: []
parameters:
-
name: projectRiskId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/file-change-history/{id}':
get:
tags:
- 'Change History'
summary: 'Get File Change History By Id'
operationId: getFileChangeHistoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/task-change-history/{id}':
get:
tags:
- 'Change History'
summary: 'Get Task Change History By Id'
operationId: getTaskChangeHistoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/training-change-history/{id}':
get:
tags:
- 'Change History'
summary: 'Get Training Change History By Id'
operationId: getTrainingChangeHistoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/model-risk-change-history/{id}':
get:
tags:
- 'Change History'
summary: 'Get Model Risk Change History By Id'
operationId: getModelRiskChangeHistoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/dataset-change-history/{id}':
get:
tags:
- 'Change History'
summary: 'Get Dataset Change History By Id'
operationId: getDatasetChangeHistoryById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/approval-workflows:
get:
tags:
- 'Approval Workflows'
summary: 'Get All Approval Workflows'
operationId: getAllApprovalWorkflows
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'Approval Workflows'
summary: 'Create Approval Workflow'
operationId: createApprovalWorkflow
security:
-
bearerAuth: []
description: 'Requires role: Admin'
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/approval-workflows/{id}':
get:
tags:
- 'Approval Workflows'
summary: 'Get Approval Workflow By Id'
operationId: getApprovalWorkflowById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
tags:
- 'Approval Workflows'
summary: 'Update Approval Workflow'
operationId: updateApprovalWorkflow
security:
-
bearerAuth: []
description: 'Requires role: Admin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
delete:
tags:
- 'Approval Workflows'
summary: 'Delete Approval Workflow'
operationId: deleteApprovalWorkflow
security:
-
bearerAuth: []
description: 'Requires role: Admin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/approval-requests:
post:
tags:
- 'Approval Workflows'
summary: 'Create Approval Request'
operationId: createApprovalRequest
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/approval-requests/my-requests:
get:
tags:
- 'Approval Workflows'
summary: 'Get My Approval Requests'
operationId: getMyApprovalRequests
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/approval-requests/pending-approvals:
get:
tags:
- 'Approval Workflows'
summary: 'Get Pending Approvals'
operationId: getPendingApprovals
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/approval-requests/all:
get:
tags:
- 'Approval Workflows'
summary: 'Get All Approval Requests'
operationId: getAllApprovalRequests
security:
-
bearerAuth: []
description: 'Requires role: Admin'
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/approval-requests/{id}':
get:
tags:
- 'Approval Workflows'
summary: 'Get Approval Request By Id'
operationId: getApprovalRequestById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/approval-requests/{id}/approve':
post:
tags:
- 'Approval Workflows'
summary: 'Approve Request'
operationId: approveRequest
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/approval-requests/{id}/reject':
post:
tags:
- 'Approval Workflows'
summary: 'Reject Request'
operationId: rejectRequest
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/approval-requests/{id}/withdraw':
post:
tags:
- 'Approval Workflows'
summary: 'Withdraw approval request'
operationId: withdrawRequest
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/ai-detection/scans:
post:
tags:
- 'AI Detection'
summary: 'Start Scan Controller'
operationId: startScanController
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
get:
tags:
- 'AI Detection'
summary: 'Get Scans Controller'
operationId: getScansController
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/ai-detection/scans/active:
get:
tags:
- 'AI Detection'
summary: 'Get Active Scan Controller'
operationId: getActiveScanController
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}':
get:
tags:
- 'AI Detection'
summary: 'Get Scan Controller'
operationId: getScanController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'AI Detection'
summary: 'Delete Scan Controller'
operationId: deleteScanController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/status':
get:
tags:
- 'AI Detection'
summary: 'Get Scan Status Controller'
operationId: getScanStatusController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/findings':
get:
tags:
- 'AI Detection'
summary: 'Get Scan Findings Controller'
operationId: getScanFindingsController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/security-findings':
get:
tags:
- 'AI Detection'
summary: 'Get Security Findings Controller'
operationId: getSecurityFindingsController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/security-summary':
get:
tags:
- 'AI Detection'
summary: 'Get Security Summary Controller'
operationId: getSecuritySummaryController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/cancel':
post:
tags:
- 'AI Detection'
summary: 'Cancel Scan Controller'
operationId: cancelScanController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/findings/{findingId}/governance':
patch:
tags:
- 'AI Detection'
summary: 'Update Governance Status Controller'
operationId: updateGovernanceStatusController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
-
name: findingId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/governance-summary':
get:
tags:
- 'AI Detection'
summary: 'Get Governance Summary Controller'
operationId: getGovernanceSummaryController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/ai-detection/stats:
get:
tags:
- 'AI Detection'
summary: 'Get A I Detection Stats Controller'
operationId: getAIDetectionStatsController
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/export/ai-bom':
get:
tags:
- 'AI Detection'
summary: 'Export A I B O M Controller'
operationId: exportAIBOMController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/dependency-graph':
get:
tags:
- 'AI Detection'
summary: 'Get Dependency Graph Controller'
operationId: getDependencyGraphController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/compliance':
get:
tags:
- 'AI Detection'
summary: 'Get Compliance Mapping Controller'
operationId: getComplianceMappingController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/risk-score':
get:
tags:
- 'AI Detection'
summary: 'Get Risk Score Controller'
operationId: getRiskScoreController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/scans/{scanId}/risk-score/recalculate':
post:
tags:
- 'AI Detection'
summary: 'Recalculate Risk Score Controller'
operationId: recalculateRiskScoreController
security:
-
bearerAuth: []
parameters:
-
name: scanId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/ai-detection/risk-scoring/config:
get:
tags:
- 'AI Detection'
summary: 'Get Risk Scoring Config Controller'
operationId: getRiskScoringConfigController
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- 'AI Detection'
summary: 'Update Risk Scoring Config Controller'
operationId: updateRiskScoringConfigController
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/ai-detection/suppressions:
post:
summary: 'Create Suppression Controller'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Detection'
operationId: createSuppressionController
security:
-
bearerAuth: []
get:
summary: 'List Suppressions Controller'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Detection'
operationId: listSuppressionsController
security:
-
bearerAuth: []
'/ai-detection/suppressions/{id}':
delete:
summary: 'Delete Suppression Controller'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Detection'
operationId: deleteSuppressionController
security:
-
bearerAuth: []
/ai-detection/repositories:
get:
tags:
- 'AI Detection'
summary: 'List Repositories'
operationId: listRepositories
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'AI Detection'
summary: 'Create Repository'
operationId: createRepository
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/repositories/{id}':
get:
tags:
- 'AI Detection'
summary: 'Get Repository'
operationId: getRepository
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- 'AI Detection'
summary: 'Update Repository'
operationId: updateRepository
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'AI Detection'
summary: 'Delete Repository'
operationId: deleteRepository
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/repositories/{id}/scan':
post:
tags:
- 'AI Detection'
summary: 'Trigger Repository Scan'
operationId: triggerRepositoryScan
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/repositories/{id}/webhook-secret':
post:
tags:
- 'AI Detection'
summary: 'Generate Webhook Secret Controller'
operationId: generateWebhookSecretController
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/ai-detection/repositories/{id}/scans':
get:
tags:
- 'AI Detection'
summary: 'Get Repository Scans'
operationId: getRepositoryScans
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/integrations/github/token:
get:
tags:
- Integrations
summary: 'Get Git Hub Token Status Controller'
operationId: getGitHubTokenStatusController
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Integrations
summary: 'Save Git Hub Token Controller'
operationId: saveGitHubTokenController
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Integrations
summary: 'Delete Git Hub Token Controller'
operationId: deleteGitHubTokenController
security:
-
bearerAuth: []
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/integrations/github/token/test:
post:
tags:
- Integrations
summary: 'Test Git Hub Token Controller'
operationId: testGitHubTokenController
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/notifications/stream:
get:
tags:
- Notifications
summary: 'Stream Notifications'
operationId: streamNotifications
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/notifications:
get:
tags:
- Notifications
summary: 'Get Notifications'
operationId: getNotifications
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/notifications/summary:
get:
tags:
- Notifications
summary: 'Get Notification Summary'
operationId: getNotificationSummary
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/notifications/unread-count:
get:
tags:
- Notifications
summary: 'Get Unread Count'
operationId: getUnreadCount
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/notifications/read-all:
patch:
tags:
- Notifications
summary: 'Mark All As Read'
operationId: markAllAsRead
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/notifications/{id}/read':
patch:
tags:
- Notifications
summary: 'Mark As Read'
operationId: markAsRead
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/notifications/{id}':
delete:
tags:
- Notifications
summary: 'Delete Notification'
operationId: deleteNotification
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/config/{projectId}':
get:
tags:
- 'Post-Market Monitoring'
summary: 'Get Config By Project Id'
operationId: getConfigByProjectId
security:
-
bearerAuth: []
parameters:
-
name: projectId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/pmm/config:
post:
tags:
- 'Post-Market Monitoring'
summary: 'Create Config'
operationId: createConfig
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/config/{configId}':
put:
tags:
- 'Post-Market Monitoring'
summary: 'Update Config'
operationId: updateConfig
security:
-
bearerAuth: []
parameters:
-
name: configId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Post-Market Monitoring'
summary: 'Delete Config'
operationId: deleteConfig
security:
-
bearerAuth: []
parameters:
-
name: configId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/config/{configId}/questions':
get:
tags:
- 'Post-Market Monitoring'
summary: 'Get Questions'
operationId: getQuestions
security:
-
bearerAuth: []
parameters:
-
name: configId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'Post-Market Monitoring'
summary: 'Add Question'
operationId: addQuestion
security:
-
bearerAuth: []
parameters:
-
name: configId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/pmm/org/questions:
get:
tags:
- 'Post-Market Monitoring'
summary: 'Get Questions'
operationId: pmm_getQuestions
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/questions/{questionId}':
put:
tags:
- 'Post-Market Monitoring'
summary: 'Update Question'
operationId: updateQuestion
security:
-
bearerAuth: []
parameters:
-
name: questionId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Post-Market Monitoring'
summary: 'Delete Question'
operationId: deleteQuestion
security:
-
bearerAuth: []
parameters:
-
name: questionId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/pmm/questions/reorder:
post:
tags:
- 'Post-Market Monitoring'
summary: 'Reorder Questions'
operationId: reorderQuestions
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/active-cycle/{projectId}':
get:
tags:
- 'Post-Market Monitoring'
summary: 'Get Active Cycle'
operationId: getActiveCycle
security:
-
bearerAuth: []
parameters:
-
name: projectId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/cycles/{cycleId}':
get:
tags:
- 'Post-Market Monitoring'
summary: 'Get Cycle By Id'
operationId: getCycleById
security:
-
bearerAuth: []
parameters:
-
name: cycleId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/cycles/{cycleId}/responses':
get:
tags:
- 'Post-Market Monitoring'
summary: 'Get Responses'
operationId: getResponses
security:
-
bearerAuth: []
parameters:
-
name: cycleId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'Post-Market Monitoring'
summary: 'Save Responses'
operationId: saveResponses
security:
-
bearerAuth: []
parameters:
-
name: cycleId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/cycles/{cycleId}/submit':
post:
tags:
- 'Post-Market Monitoring'
summary: 'Submit Cycle'
operationId: submitCycle
security:
-
bearerAuth: []
parameters:
-
name: cycleId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/cycles/{cycleId}/flag':
post:
tags:
- 'Post-Market Monitoring'
summary: 'Flag Concern'
operationId: flagConcern
security:
-
bearerAuth: []
parameters:
-
name: cycleId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/pmm/reports:
get:
tags:
- 'Post-Market Monitoring'
summary: 'Get Reports'
operationId: getReports
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/reports/{reportId}/download':
get:
tags:
- 'Post-Market Monitoring'
summary: 'Download Report'
operationId: downloadReport
security:
-
bearerAuth: []
parameters:
-
name: reportId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/cycles/{cycleId}/reassign':
post:
tags:
- 'Post-Market Monitoring'
summary: 'Reassign Stakeholder'
operationId: reassignStakeholder
security:
-
bearerAuth: []
parameters:
-
name: cycleId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/pmm/projects/{projectId}/start-cycle':
post:
tags:
- 'Post-Market Monitoring'
summary: 'Start New Cycle'
operationId: startNewCycle
security:
-
bearerAuth: []
parameters:
-
name: projectId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/compliance/score:
get:
tags:
- Compliance
summary: 'Get Compliance Score'
operationId: getComplianceScore
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/compliance/score/{organizationId}':
get:
tags:
- Compliance
summary: 'Get Compliance Score By Organization'
operationId: getComplianceScoreByOrganization
security:
-
bearerAuth: []
parameters:
-
name: organizationId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/compliance/details/{organizationId}':
get:
tags:
- Compliance
summary: 'Get Compliance Details'
operationId: getComplianceDetails
security:
-
bearerAuth: []
parameters:
-
name: organizationId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/virtual-folders:
get:
tags:
- Files
summary: 'Get All Folders'
operationId: getAllFolders
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Files
summary: 'Create Folder'
operationId: createFolder
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/virtual-folders/tree:
get:
tags:
- Files
summary: 'Get Folder Tree'
operationId: getFolderTree
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/virtual-folders/uncategorized:
get:
tags:
- Files
summary: 'Get Uncategorized Files'
operationId: getUncategorizedFiles
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/virtual-folders/{id}':
get:
tags:
- Files
summary: 'Get Folder By Id'
operationId: getFolderById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- Files
summary: 'Update Folder'
operationId: updateFolder
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- Files
summary: 'Delete Folder'
operationId: deleteFolder
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/virtual-folders/{id}/path':
get:
tags:
- Files
summary: 'Get Folder Path'
operationId: getFolderPath
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/virtual-folders/{id}/files':
get:
tags:
- Files
summary: 'Get Files In Folder'
operationId: getFilesInFolder
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Files
summary: 'Assign Files To Folder'
operationId: assignFilesToFolder
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/virtual-folders/{id}/files/{fileId}':
delete:
tags:
- Files
summary: 'Remove File From Folder'
operationId: removeFileFromFolder
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
-
name: fileId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/files/tree:
get:
tags:
- Files
summary: 'Get Folder Tree'
operationId: files_getFolderTree
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/files/uncategorized:
get:
tags:
- Files
summary: 'Get Uncategorized Files'
operationId: files_getUncategorizedFiles
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/files/{id}/path':
get:
tags:
- Files
summary: 'Get Folder Path'
operationId: files_getFolderPath
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/files/{id}/files':
get:
tags:
- Files
summary: 'Get Files In Folder'
operationId: files_getFilesInFolder
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- Files
summary: 'Assign Files To Folder'
operationId: files_assignFilesToFolder
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/files/{id}/files/{fileId}':
delete:
tags:
- Files
summary: 'Remove File From Folder'
operationId: files_removeFileFromFolder
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
-
name: fileId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/api-keys:
post:
tags:
- 'Shadow AI'
summary: 'Create Api Key'
operationId: createApiKey
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
get:
tags:
- 'Shadow AI'
summary: 'List Api Keys'
operationId: listApiKeys
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shadow-ai/api-keys/{id}':
delete:
tags:
- 'Shadow AI'
summary: 'Revoke Api Key'
operationId: revokeApiKey
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shadow-ai/api-keys/{id}/permanent':
delete:
tags:
- 'Shadow AI'
summary: 'Delete Api Key'
operationId: deleteApiKey
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/insights/summary:
get:
tags:
- 'Shadow AI'
summary: 'Get Insights Summary'
operationId: getInsightsSummary
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/insights/tools-by-events:
get:
tags:
- 'Shadow AI'
summary: 'Get Tools By Events'
operationId: getToolsByEvents
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/insights/tools-by-users:
get:
tags:
- 'Shadow AI'
summary: 'Get Tools By Users'
operationId: getToolsByUsers
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/insights/users-by-department:
get:
tags:
- 'Shadow AI'
summary: 'Get Users By Department'
operationId: getUsersByDepartment
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/insights/trend:
get:
tags:
- 'Shadow AI'
summary: 'Get Trend'
operationId: getTrend
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/users:
get:
tags:
- 'Shadow AI'
summary: 'Get Users'
operationId: getUsers
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shadow-ai/users/{email}/activity':
get:
tags:
- 'Shadow AI'
summary: 'Get User Detail'
operationId: getUserDetail
security:
-
bearerAuth: []
parameters:
-
name: email
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/departments:
get:
tags:
- 'Shadow AI'
summary: 'Get Department Activity'
operationId: getDepartmentActivity
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/tools:
get:
tags:
- 'Shadow AI'
summary: 'Get Tools'
operationId: getTools
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shadow-ai/tools/{id}':
get:
tags:
- 'Shadow AI'
summary: 'Get Tool By Id'
operationId: getToolById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shadow-ai/tools/{id}/status':
patch:
tags:
- 'Shadow AI'
summary: 'Update Tool Status'
operationId: updateToolStatus
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shadow-ai/tools/{id}/start-governance':
post:
tags:
- 'Shadow AI'
summary: 'Start Governance'
operationId: startGovernance
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/rules:
get:
tags:
- 'Shadow AI'
summary: 'Get Rules'
operationId: getRules
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'Shadow AI'
summary: 'Create Rule'
operationId: createRule
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shadow-ai/rules/{id}':
patch:
tags:
- 'Shadow AI'
summary: 'Update Rule'
operationId: updateRule
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Shadow AI'
summary: 'Delete Rule'
operationId: deleteRule
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/rules/alert-history:
get:
tags:
- 'Shadow AI'
summary: 'Get Alert History'
operationId: getAlertHistory
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/config/syslog:
get:
tags:
- 'Shadow AI'
summary: 'Get Syslog Configs'
operationId: getSyslogConfigs
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'Shadow AI'
summary: 'Create Syslog Config'
operationId: createSyslogConfig
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/shadow-ai/config/syslog/{id}':
patch:
tags:
- 'Shadow AI'
summary: 'Update Syslog Config'
operationId: updateSyslogConfig
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Shadow AI'
summary: 'Delete Syslog Config'
operationId: deleteSyslogConfig
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/shadow-ai/settings:
get:
tags:
- 'Shadow AI'
summary: 'Get Settings'
operationId: getSettings
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- 'Shadow AI'
summary: 'Update Settings'
operationId: updateSettings
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/v1/shadow-ai/events:
post:
tags:
- 'Shadow AI'
summary: 'Ingest Events'
operationId: ingestEvents
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'500':
description: 'Internal server error'
/agent-primitives:
get:
tags:
- 'Agent Discovery'
summary: 'Get All Agent Primitives'
operationId: getAllAgentPrimitives
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'Agent Discovery'
summary: 'Create Agent Primitive'
operationId: createAgentPrimitive
security:
-
bearerAuth: []
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- display_name
- primitive_type
properties:
display_name:
type: string
primitive_type:
type: string
owner_ids:
type: array
items: {type: integer, minimum: 1}
maxItems: 50
description: 'User ids of the owners, all users of your organization, primary first. At most 50.'
owner_id:
type: string
nullable: true
description: 'Legacy single owner. See the operation description.'
permissions:
type: array
items: {}
permission_categories:
type: array
items: {type: string}
metadata:
type: object
responses:
'201':
description: 'Created successfully. The agent includes owner_ids.'
'400':
description: 'Missing display_name or primitive_type, an invalid owner id, an owner who is not a user of your organization, owner_id that is not a user id when sent with owner_ids, a text owner_id longer than 255 characters, or more than 50 owners'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
description: 'Adds a manual agent. Owners: send owner_ids, the user ids of the owners, primary first. The legacy owner_id is still accepted. Sent alone, a user id makes that user the only owner, and any other text is stored as is as a free-text owner (owner_ids stays empty). Sent with owner_ids, owner_id must be a user id; it becomes the primary owner and is moved to the front. An agent can have at most 50 owners. Requires role: Admin'
/agent-primitives/stats:
get:
tags:
- 'Agent Discovery'
summary: 'Get Agent Stats'
operationId: getAgentStats
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/agent-primitives/sync/logs:
get:
tags:
- 'Agent Discovery'
summary: 'Get Sync Logs'
operationId: getSyncLogs
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/agent-primitives/sync/status:
get:
tags:
- 'Agent Discovery'
summary: 'Get Sync Status'
operationId: getSyncStatus
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/agent-primitives/{id}':
get:
tags:
- 'Agent Discovery'
summary: 'Get Agent Primitive By Id'
operationId: getAgentPrimitiveById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- 'Agent Discovery'
summary: 'Update Agent Primitive'
operationId: updateAgentPrimitive
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
display_name:
type: string
primitive_type:
type: string
owner_ids:
type: array
items: {type: integer, minimum: 1}
maxItems: 50
description: 'User ids of the owners, all users of your organization, primary first. At most 50.'
owner_id:
type: string
nullable: true
description: 'Legacy single owner. See the operation description.'
metadata:
type: object
responses:
'200':
description: 'Success. The agent includes owner_ids.'
'400':
description: 'No fields to update, an invalid owner id, a newly added owner who is not a user of your organization, owner_id that is not a user id when sent with owner_ids, a text owner_id longer than 255 characters, or more than 50 owners'
'401':
description: Unauthorized
'403':
description: 'Only manually-added agents can be edited'
'404':
description: 'Agent primitive not found'
'500':
description: 'Internal server error'
description: 'Edits a manual agent. Owners change only when owner_ids or owner_id is sent, so an edit of other fields leaves them as they are. owner_ids replaces the full owner set, primary first. owner_id sent alone (legacy): a user id becomes the primary owner, replacing the previous primary and keeping the other owners; null or an empty string removes only the primary owner, and the next owner becomes primary (or none is left); any other text replaces all owners with that one free-text owner. Sent with owner_ids, owner_id must be a user id; it becomes the primary owner and is moved to the front. An agent can have at most 50 owners. Requires role: Admin'
delete:
tags:
- 'Agent Discovery'
summary: 'Delete Agent Primitive By Id'
operationId: deleteAgentPrimitiveById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
description: 'Requires role: Admin'
/agent-primitives/sync:
post:
tags:
- 'Agent Discovery'
summary: 'Trigger Sync'
operationId: triggerSync
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
description: 'Requires role: Admin'
'/agent-primitives/{id}/review':
patch:
tags:
- 'Agent Discovery'
summary: 'Review Agent Primitive'
operationId: reviewAgentPrimitive
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
description: 'Requires role: Admin'
'/agent-primitives/{id}/link-model':
patch:
tags:
- 'Agent Discovery'
summary: 'Link Model To Agent'
operationId: linkModelToAgent
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
description: 'Requires role: Admin'
'/agent-primitives/{id}/unlink-model':
patch:
tags:
- 'Agent Discovery'
summary: 'Unlink Model From Agent'
operationId: unlinkModelFromAgent
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
description: 'Requires role: Admin'
'/agent-primitives/{id}/link-use-case':
patch:
summary: 'Link Use Case To Agent'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Agent Discovery'
operationId: linkUseCaseToAgent
security:
-
bearerAuth: []
'/agent-primitives/{id}/unlink-use-case':
patch:
summary: 'Unlink Use Case From Agent'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Agent Discovery'
operationId: unlinkUseCaseFromAgent
security:
-
bearerAuth: []
'/agent-primitives/{id}/audit-logs':
get:
tags:
- 'Agent Discovery'
summary: 'Get Agent Audit Logs'
operationId: getAgentAuditLogs
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/intake/forms:
get:
tags:
- 'Intake Forms'
summary: 'Get All Intake Forms'
operationId: getAllIntakeForms
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- 'Intake Forms'
summary: 'Create Intake Form'
description: 'The optional routing block turns on review routing for the form. Form responses carry the saved routing block.'
operationId: createIntakeForm
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
properties:
routing:
type: object
nullable: true
description: 'Review routing settings. Omit to leave unchanged, null to clear.'
required: [enabled]
properties: {enabled: {type: boolean}, seniorReviewerIds: {type: array, items: {type: integer}, description: 'User ids who can edit intake forms. At least one is required when enabled.'}, standardReviewerIds: {type: array, items: {type: integer}, description: 'User ids who can edit intake forms. At least one is required when enabled.'}, threshold: {type: integer, minimum: 1, maximum: 99, default: 50}, closeCallMargin: {type: integer, minimum: 0, maximum: 25, default: 10}, secondReviewRate: {type: integer, minimum: 0, maximum: 100, default: 10, description: 'Percent of standard-lane approvals by non-senior reviewers picked for a second review'}}
responses:
'201':
description: 'Created successfully'
'400':
description: 'Invalid routing settings, or a reviewer who cannot review intake submissions'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/intake/forms/{id}':
get:
tags:
- 'Intake Forms'
summary: 'Get Intake Form By Id'
operationId: getIntakeFormById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- 'Intake Forms'
summary: 'Update Intake Form'
description: 'Saving a routing block routes the form''s pending submissions again. Form responses carry the saved routing block.'
operationId: updateIntakeForm
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
properties:
routing:
type: object
nullable: true
description: 'Review routing settings. Omit to leave unchanged, null to clear. Same fields as on create: enabled (required), seniorReviewerIds, standardReviewerIds, threshold (1 to 99, default 50), closeCallMargin (0 to 25, default 10), secondReviewRate (0 to 100, default 10).'
responses:
'200':
description: Success
'400':
description: 'Invalid routing settings, or a reviewer who cannot review intake submissions'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
delete:
tags:
- 'Intake Forms'
summary: 'Delete Intake Form'
operationId: deleteIntakeForm
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/intake/forms/{id}/archive':
post:
tags:
- 'Intake Forms'
summary: 'Archive Intake Form'
operationId: archiveIntakeForm
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/intake/forms/{id}/preview':
get:
tags:
- 'Intake Forms'
summary: 'Preview Form'
operationId: previewForm
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/intake/routing/eligible-reviewers:
get:
summary: 'Get Eligible Reviewers'
description: 'Users of the organization whose role can edit intake forms, as id, name, surname and email. Used to fill the reviewer pickers in the routing settings.'
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: Forbidden
'500':
description: 'Internal server error'
tags:
- 'Intake Forms'
operationId: getEligibleReviewers
security:
-
bearerAuth: []
/intake/forms/suggested-questions:
post:
tags:
- 'Intake Forms'
summary: 'Get L L M Suggested Questions'
operationId: getLLMSuggestedQuestions
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/intake/forms/field-guidance:
post:
tags:
- 'Intake Forms'
summary: 'Get Field Guidance'
operationId: getFieldGuidance
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/intake/oversight:
get:
summary: 'Get Intake Oversight'
description: 'Routing and review figures for the last 4, 8 or 12 weeks (weeks start Monday, UTC): totals by lane, weekly buckets, median hours to decision, redlines, second reviews, per-reviewer decisions, band kept, suggested risks accepted and up to 20 needs-attention rows. An empty period returns zero counts and null medians.'
parameters:
-
name: weeks
in: query
required: false
schema:
type: integer
enum:
- 4
- 8
- 12
default: 8
-
name: formId
in: query
required: false
description: 'Limit the figures to one form of the organization'
schema:
type: integer
responses:
'200':
description: Success
'400':
description: 'weeks is not 4, 8 or 12, or formId is invalid'
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: 'Form not found in this organization'
'500':
description: 'Internal server error'
tags:
- 'Intake Forms'
operationId: getIntakeOversight
security:
-
bearerAuth: []
/intake/submissions:
get:
tags:
- 'Intake Forms'
summary: 'Get Pending Submissions'
description: 'Each row also carries routing (lane, reason, score, threshold, closeCallMargin, routedAt, and escalation or secondReview when set), routingEnabled and laneReviewerIds (user ids who can decide the stored lane).'
operationId: getPendingSubmissions
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/intake/submissions/stats:
get:
tags:
- 'Intake Forms'
summary: 'Get Submission Stats'
operationId: getSubmissionStats
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/intake/submissions/by-entity/{entityType}/{entityId}':
get:
tags:
- 'Intake Forms'
summary: 'Get Submission By Entity'
operationId: getSubmissionByEntity
security:
-
bearerAuth: []
parameters:
-
name: entityType
in: path
required: true
schema:
type: string
-
name: entityId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/intake/submissions/{id}':
get:
tags:
- 'Intake Forms'
summary: 'Get Submission By Id'
operationId: getSubmissionById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/intake/submissions/{id}/preview':
get:
tags:
- 'Intake Forms'
summary: 'Get Submission Preview'
description: 'Also returns routing, routingEnabled, canDecide, decideBlockedReason, laneReviewers (id and name of the users who can decide) and isSeniorReviewer for the caller.'
operationId: getSubmissionPreview
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/intake/submissions/{id}/risk-override':
patch:
tags:
- 'Intake Forms'
summary: 'Override Submission Risk'
operationId: overrideSubmissionRisk
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'400':
description: 'Invalid band, or a band below the rule minimum (AI-scored submissions)'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/intake/submissions/{id}/assessment/retry':
post:
tags:
- 'Intake Forms'
summary: 'Retry Failed Or Stalled Assessment Stages'
description: 'Queues the scoring and/or suggested-risk stages that failed or have been pending for over 10 minutes. Finished stages are never re-run. Pending submissions only.'
operationId: retrySubmissionAssessment
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'202':
description: 'Queued; body lists the stages'
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: 'Submission not found'
'409':
description: 'Submission not pending, or nothing to retry'
'500':
description: 'Internal server error'
'/intake/submissions/{id}/suggested-risks/accept-all':
post:
tags:
- 'Intake Forms'
summary: 'Accept All Suggested Risks'
description: 'Moves every suggested risk still in "suggested" to "accepted". Dismissed ones stay dismissed; ones without a mitigation plan are skipped. Returns { accepted, skipped }.'
operationId: acceptAllSuggestedRisks
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: 'Submission not found'
'409':
description: 'Submission not pending'
'500':
description: 'Internal server error'
'/intake/submissions/{id}/suggested-risks/{suggestionId}':
patch:
tags:
- 'Intake Forms'
summary: 'Update A Suggested Risk'
description: 'Edits, accepts, dismisses or restores one suggested risk on a pending submission. Accepting requires a mitigation plan.'
operationId: updateSuggestedRisk
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
-
name: suggestionId
in: path
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
state:
type: string
enum: [suggested, accepted, dismissed]
name:
type: string
maxLength: 200
description:
type: string
maxLength: 1000
likelihood:
type: string
enum: [Rare, Unlikely, Possible, Likely, 'Almost Certain']
severity:
type: string
enum: [Negligible, Minor, Moderate, Major, Catastrophic]
mitigationPlan:
type: string
maxLength: 1000
implementationStrategy:
type: string
maxLength: 1000
deadline:
type: string
format: date
nullable: true
modelRiskCategory:
type: string
enum: [Performance, 'Bias & Fairness', Security, 'Data Quality', Compliance]
modelRiskLevel:
type: string
enum: [Low, Medium, High, Critical]
responses:
'200':
description: 'The updated suggestion'
'400':
description: 'Invalid field, nothing to update, or accepting without a mitigation plan'
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: 'Submission or suggestion not found'
'409':
description: 'Submission not pending'
'500':
description: 'Internal server error'
'/intake/forms/{id}/submissions':
get:
tags:
- 'Intake Forms'
summary: 'Get Form Submissions'
operationId: getFormSubmissions
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/intake/submissions/{id}/approve':
post:
tags:
- 'Intake Forms'
summary: 'Approve Submission'
description: 'With routing on, only a reviewer of the lane the approval would make true, or an Admin, can approve (403 otherwise). A standard-lane approval by a non-senior reviewer may be picked for a second review.'
operationId: approveSubmission
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Routing is on and the caller may not decide this lane'
'500':
description: 'Internal server error'
'/intake/submissions/{id}/reject':
post:
tags:
- 'Intake Forms'
summary: 'Reject Submission'
description: 'With routing on, only a reviewer of the stored lane, or an Admin, can reject (403 otherwise).'
operationId: rejectSubmission
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Routing is on and the caller may not decide this lane'
'500':
description: 'Internal server error'
'/intake/submissions/{id}/escalate':
post:
summary: 'Send Submission To Senior Review'
description: 'Moves a pending standard-lane submission to the senior lane with reason escalated. Re-routing leaves it there. Allowed for an Admin or a reviewer listed on the form. Returns the new routing.'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- reason
properties:
reason:
type: string
minLength: 1
maxLength: 1000
responses:
'200':
description: Success
'400':
description: 'Invalid id, or the reason is missing or longer than 1000 characters'
'401':
description: Unauthorized
'403':
description: 'Caller is not an Admin or a reviewer of the form'
'404':
description: 'Submission or form not found'
'409':
description: 'Not pending, routing is off, not in the standard lane, or the submission changed'
'500':
description: 'Internal server error'
tags:
- 'Intake Forms'
operationId: escalateSubmission
security:
-
bearerAuth: []
'/intake/submissions/{id}/second-review':
post:
summary: 'Record Second Review'
description: 'Closes an open second review as agreed or missed. Allowed for a senior reviewer of the form or an Admin, never for the person who approved the submission. Does not change the approval or the entity it created. Returns the new routing.'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- outcome
properties:
outcome:
type: string
enum: [agreed, missed]
note:
type: string
maxLength: 2000
description: 'Required when the outcome is missed'
responses:
'200':
description: Success
'400':
description: 'Invalid id or outcome, a missed outcome without a note, or a note over 2000 characters'
'401':
description: Unauthorized
'403':
description: 'Caller is not a senior reviewer of the form or an Admin, or approved the submission'
'404':
description: 'Submission not found'
'409':
description: 'The second review is not open, or it changed'
'500':
description: 'Internal server error'
tags:
- 'Intake Forms'
operationId: recordSecondReview
security:
-
bearerAuth: []
'/intake/submissions/{id}/second-review/resolve':
post:
summary: 'Resolve Missed Second Review'
description: 'Closes a missed second review once the follow-up is done. Same caller rules as recording a second review. Returns the new routing.'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- note
properties:
note:
type: string
minLength: 1
maxLength: 2000
responses:
'200':
description: Success
'400':
description: 'Invalid id, or the note is missing or longer than 2000 characters'
'401':
description: Unauthorized
'403':
description: 'Caller is not a senior reviewer of the form or an Admin, or approved the submission'
'404':
description: 'Submission not found'
'409':
description: 'The review is not missed, is already resolved, or changed'
'500':
description: 'Internal server error'
tags:
- 'Intake Forms'
operationId: resolveSecondReviewMiss
security:
-
bearerAuth: []
/intake/public/captcha:
get:
tags:
- 'Intake Forms'
summary: 'Get Captcha'
operationId: getCaptcha
responses:
'200':
description: Success
'500':
description: 'Internal server error'
'/intake/public/by-id/{publicId}':
get:
tags:
- 'Intake Forms'
summary: 'Get Public Form By Public Id'
operationId: getPublicFormByPublicId
parameters:
-
name: publicId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'500':
description: 'Internal server error'
post:
tags:
- 'Intake Forms'
summary: 'Submit Public Form By Public Id'
operationId: submitPublicFormByPublicId
parameters:
-
name: publicId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'500':
description: 'Internal server error'
'/intake/public/{tenantSlug}/{formSlug}':
get:
tags:
- 'Intake Forms'
summary: 'Get Public Form'
operationId: getPublicForm
parameters:
-
name: tenantSlug
in: path
required: true
schema:
type: string
-
name: formSlug
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
'500':
description: 'Internal server error'
post:
tags:
- 'Intake Forms'
summary: 'Submit Public Form'
operationId: submitPublicForm
parameters:
-
name: tenantSlug
in: path
required: true
schema:
type: string
-
name: formSlug
in: path
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'500':
description: 'Internal server error'
/version:
get:
tags:
- System
summary: 'Get application version'
operationId: version_anonymous
responses:
'200':
description: Success
'500':
description: 'Internal server error'
/audit-ledger:
get:
tags:
- Audit
summary: 'Get Audit Ledger'
operationId: getAuditLedger
security:
-
bearerAuth: []
description: 'Requires role: Admin or SuperAdmin'
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/audit-ledger/verify:
get:
tags:
- Audit
summary: 'Verify Audit Ledger'
operationId: verifyAuditLedger
security:
-
bearerAuth: []
description: 'Requires role: Admin'
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/audit-ledger/export:
get:
summary: 'Export Audit Ledger as CSV'
description: 'Streams the organization audit ledger as a CSV attachment (UTF-8 with BOM, oldest entry first, batches of 1000). Requires role: Admin'
parameters:
-
name: entity_type
in: query
required: false
schema:
type: string
description: 'Only entries for this entity type'
-
name: entry_type
in: query
required: false
schema:
type: string
enum:
- event_log
- change_history
description: 'Only entries of this kind'
responses:
'200':
description: 'CSV file attachment (audit-ledger-YYYY-MM-DD.csv)'
content:
text/csv:
schema:
type: string
'400':
description: 'Invalid entry_type'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
tags:
- Audit
operationId: exportAuditLedger
security:
-
bearerAuth: []
/feature-settings:
get:
tags:
- Settings
summary: 'Get Feature Settings'
operationId: getFeatureSettings
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
patch:
tags:
- Settings
summary: 'Update Feature Settings'
operationId: updateFeatureSettings
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/data-retention:
get:
summary: 'List data retention settings'
description: 'Returns how long each kind of record is kept for the organization (audit records, AI gateway logs, Agent Control logs, model risk management metrics, evidence files, Shadow AI data, server logs), the latest cleanup per type, and the point the audit ledger has been pruned through. Admin only.'
responses:
'200':
description: Success
'403':
description: 'Admin access required'
'500':
description: 'Internal server error'
tags:
- 'Data Retention'
operationId: getDataRetention
security:
-
bearerAuth: []
/data-retention/audit-records/preview:
get:
summary: 'Preview audit record cleanup'
description: 'Returns how many audit records would be deleted now if the given retention period (months: 12, 24, 36, 60, 84 or 120) were applied. Read-only. Admin only.'
responses:
'200':
description: Success
'400':
description: 'Invalid retention period'
'403':
description: 'Admin access required'
'500':
description: 'Internal server error'
tags:
- 'Data Retention'
operationId: previewAuditRetention
security:
-
bearerAuth: []
/data-retention/audit-records:
put:
summary: 'Set audit record retention'
description: 'Sets how long audit records are kept. Body: { months: 12 | 24 | 36 | 60 | 84 | 120 | null }, where null keeps records indefinitely. The change is recorded in the audit ledger. Admin only.'
responses:
'200':
description: Success
'400':
description: 'Invalid retention period'
'403':
description: 'Admin access required'
'500':
description: 'Internal server error'
tags:
- 'Data Retention'
operationId: updateAuditRetention
security:
-
bearerAuth: []
'/fria/{friaId}/rights':
put:
tags:
- FRIA
summary: 'Update Fria Rights'
operationId: updateFriaRights
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/fria/{friaId}/risk-items':
get:
tags:
- FRIA
summary: 'Get Risk Items'
operationId: getRiskItems
security:
-
bearerAuth: []
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- FRIA
summary: 'Add Risk Item'
operationId: addRiskItem
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/fria/{friaId}/risk-items/{itemId}':
patch:
tags:
- FRIA
summary: 'Update Risk Item'
operationId: updateRiskItem
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
-
name: itemId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
delete:
tags:
- FRIA
summary: 'Delete Risk Item'
operationId: deleteRiskItem
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
-
name: itemId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/fria/{friaId}/models':
get:
tags:
- FRIA
summary: 'Get Model Links'
operationId: getModelLinks
security:
-
bearerAuth: []
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/fria/{friaId}/models/{modelId}':
post:
tags:
- FRIA
summary: 'Link Model'
operationId: linkModel
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
-
name: modelId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
delete:
tags:
- FRIA
summary: 'Unlink Model'
operationId: unlinkModel
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
-
name: modelId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/fria/{friaId}/evidence':
get:
tags:
- FRIA
summary: 'Get Fria Evidence'
operationId: getFriaEvidence
security:
-
bearerAuth: []
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
post:
tags:
- FRIA
summary: 'Link Fria Evidence'
operationId: linkFriaEvidence
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/fria/{friaId}/evidence/{linkId}':
delete:
tags:
- FRIA
summary: 'Unlink Fria Evidence'
operationId: unlinkFriaEvidence
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
-
name: linkId
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/fria/{friaId}/submit':
post:
tags:
- FRIA
summary: 'Submit Fria'
operationId: submitFria
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/fria/{friaId}/versions':
get:
tags:
- FRIA
summary: 'Get Versions'
operationId: getVersions
security:
-
bearerAuth: []
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/fria/{friaId}/versions/{version}':
get:
tags:
- FRIA
summary: 'Get Version'
operationId: getVersion
security:
-
bearerAuth: []
parameters:
-
name: friaId
in: path
required: true
schema:
type: integer
-
name: version
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/fria/{projectId}':
get:
tags:
- FRIA
summary: 'Get Fria'
operationId: getFria
security:
-
bearerAuth: []
parameters:
-
name: projectId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
tags:
- FRIA
summary: 'Update Fria'
operationId: updateFria
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
parameters:
-
name: projectId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/governance-os/mappings:
get:
summary: 'Get All Mappings'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getAllMappings
security:
-
bearerAuth: []
post:
summary: 'Create Mapping'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: createMapping
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/governance-os/mappings/between/{sourceId}/{targetId}':
get:
summary: 'Get Mappings Between'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getMappingsBetween
security:
-
bearerAuth: []
'/governance-os/mappings/control/{controlType}/{controlId}':
get:
summary: 'Get Mappings For Control'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getMappingsForControl
security:
-
bearerAuth: []
'/governance-os/mappings/{id}':
put:
summary: 'Update Mapping'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: updateMapping
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
delete:
summary: 'Delete Mapping'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: deleteMapping
security:
-
bearerAuth: []
description: 'Requires role: Admin'
/governance-os/mappings/bulk:
post:
summary: 'Create Bulk Mappings'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: createBulkMappings
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
/governance-os/scenarios:
get:
summary: 'Get All Scenarios'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getAllScenarios
security:
-
bearerAuth: []
post:
summary: 'Create Scenario'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: createScenario
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/governance-os/scenarios/{id}':
get:
summary: 'Get Scenario By Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getScenarioById
security:
-
bearerAuth: []
put:
summary: 'Update Scenario'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: updateScenario
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
delete:
summary: 'Delete Scenario'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: deleteScenario
security:
-
bearerAuth: []
description: 'Requires role: Admin'
'/governance-os/scenarios/{id}/activate':
post:
summary: 'Activate Scenario'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: activateScenario
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
/governance-os/scenarios/simulate:
post:
summary: 'Simulate Scenario'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: simulateScenario
security:
-
bearerAuth: []
/governance-os/activations:
get:
summary: 'Get Activation History'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getActivationHistory
security:
-
bearerAuth: []
'/governance-os/activations/{id}/deactivate':
post:
summary: 'Deactivate Scenario'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: deactivateScenario
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/governance-os/activations/{id}/progress':
get:
summary: 'Get Scenario Progress'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getScenarioProgress
security:
-
bearerAuth: []
/governance-os/recommend:
post:
summary: 'Get Recommendations'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: governance_os_getRecommendations
security:
-
bearerAuth: []
'/governance-os/coverage/{projectId}':
get:
summary: 'Get Coverage'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getCoverage
security:
-
bearerAuth: []
'/governance-os/coverage/{projectId}/refresh':
post:
summary: 'Refresh Coverage'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: refreshCoverage
security:
-
bearerAuth: []
description: 'Requires role: Admin or Editor'
'/governance-os/unified-view/{projectId}':
get:
summary: 'Get Unified View'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getUnifiedView
security:
-
bearerAuth: []
/governance-os/eligibility:
get:
summary: 'Get Eligibility'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getEligibility
security:
-
bearerAuth: []
/governance-os/preferences:
get:
summary: 'Get Preferences'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: getPreferences
security:
-
bearerAuth: []
put:
summary: 'Update Preferences'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Governance OS'
operationId: updatePreferences
security:
-
bearerAuth: []
description: 'Requires role: Admin'
/risk-benchmarks:
get:
tags:
- 'Risk Benchmarks'
summary: 'Get All Benchmarks'
operationId: getAllBenchmarks
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/risk-benchmarks/filters:
get:
tags:
- 'Risk Benchmarks'
summary: 'Get Benchmark Filters'
operationId: getBenchmarkFilters
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/risk-benchmarks/{id}':
get:
tags:
- 'Risk Benchmarks'
summary: 'Get Benchmark By Id'
operationId: getBenchmarkById
security:
-
bearerAuth: []
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/quantitative-risks/portfolio/org:
get:
tags:
- 'Quantitative Risks'
summary: 'Get Org Portfolio'
operationId: getOrgPortfolio
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/quantitative-risks/portfolio/project/{projectId}':
get:
tags:
- 'Quantitative Risks'
summary: 'Get Project Portfolio'
operationId: getProjectPortfolio
security:
-
bearerAuth: []
parameters:
-
name: projectId
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/quantitative-risks/portfolio/trend:
get:
tags:
- 'Quantitative Risks'
summary: 'Get Portfolio Trend Handler'
operationId: getPortfolioTrendHandler
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
'/quantitative-risks/{riskId}/apply-benchmark/{benchmarkId}':
post:
tags:
- 'Quantitative Risks'
summary: 'Apply Benchmark'
operationId: applyBenchmark
security:
-
bearerAuth: []
parameters:
-
name: riskId
in: path
required: true
schema:
type: integer
-
name: benchmarkId
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/quantitative-risks/assessment-mode:
get:
tags:
- 'Quantitative Risks'
summary: 'Get Risk Assessment Mode'
operationId: getRiskAssessmentMode
security:
-
bearerAuth: []
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
put:
tags:
- 'Quantitative Risks'
summary: 'Update Risk Assessment Mode'
operationId: updateRiskAssessmentMode
security:
-
bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'500':
description: 'Internal server error'
/ai-gateway/guardrails/settings:
put:
summary: 'Update Guardrail Settings'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'AI Gateway'
operationId: updateGuardrailSettings
security:
-
bearerAuth: []
'/custom-fields/definitions/by-id/{id}':
get:
summary: 'Get Custom Field Definition By Id'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Custom Fields'
operationId: getCustomFieldDefinitionById
security:
-
bearerAuth: []
'/custom-fields/definitions/by-id/{id}/usage':
get:
summary: 'Get Custom Field Usage'
responses:
'200':
description: 'Answer counts. total is the number of saved answers; by_option maps each option to its count: the option id for scored select, the option text for select and multiselect (a multiselect record counts once per option it holds); empty for other types.'
content:
application/json:
schema:
type: object
properties:
total: {type: integer}
by_option: {type: object, additionalProperties: {type: integer}}
'404':
description: 'Definition not found'
'500':
description: 'Internal server error'
tags:
- 'Custom Fields'
operationId: getCustomFieldUsage
security:
-
bearerAuth: []
description: 'Requires role: Admin'
'/custom-fields/definitions/{entityType}':
get:
summary: 'List Custom Field Definitions'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Custom Fields'
operationId: listCustomFieldDefinitions
security:
-
bearerAuth: []
/custom-fields/definitions:
post:
summary: 'Create Custom Field Definition'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Custom Fields'
operationId: createCustomFieldDefinition
security:
-
bearerAuth: []
description: 'Requires role: Admin. field_type is one of text, number, date, boolean, select, multiselect, user, scored_select. For scored_select, options is an array of { id, label, score }; omit id for new options (the server assigns it).'
'/custom-fields/definitions/{id}':
patch:
summary: 'Update Custom Field Definition'
requestBody:
content:
application/json:
schema:
type: object
properties:
label:
type: string
required:
type: boolean
options:
type: array
description: 'For scored_select, objects { id, label, score }; id omitted for new options.'
items: {}
option_moves:
type: object
description: 'select, multiselect and scored_select. Maps a removed option to the remaining option that should receive its answers: by id for scored_select, by option text for select and multiselect (so a renamed option maps old text to new text).'
additionalProperties: {type: string}
option_removals:
type: array
description: 'select, multiselect and scored_select. Removed options whose answers are deleted instead of moved (for multiselect, the option is dropped from each list; a list left empty is deleted). An option cannot be both moved and removed.'
items: {type: string}
responses:
'200':
description: Success
'409':
description: 'Removed options are still in use. data has code options_in_use, in_use [{ id, label, count }] and entity_type; retry with option_moves and/or option_removals.'
'500':
description: 'Internal server error'
tags:
- 'Custom Fields'
operationId: updateCustomFieldDefinition
security:
-
bearerAuth: []
description: 'Requires role: Admin'
delete:
summary: 'Delete Custom Field Definition'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Custom Fields'
operationId: deleteCustomFieldDefinition
security:
-
bearerAuth: []
description: 'Requires role: Admin'
'/custom-fields/values/{entityType}/{entityId}/missing-required':
get:
summary: 'Get Missing Required Custom Fields'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Custom Fields'
operationId: getMissingRequiredCustomFields
security:
-
bearerAuth: []
'/custom-fields/values/{entityType}/{entityId}':
get:
summary: 'Get Custom Field Values For Entity'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Custom Fields'
operationId: getCustomFieldValuesForEntity
security:
-
bearerAuth: []
/custom-fields/values:
put:
summary: 'Set Custom Field Value'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Custom Fields'
operationId: setCustomFieldValue
security:
-
bearerAuth: []
'/custom-fields/values/{definitionId}/{entityId}':
delete:
summary: 'Delete Custom Field Value'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Custom Fields'
operationId: deleteCustomFieldValue
security:
-
bearerAuth: []
/super-admin/organizations:
get:
tags:
- 'Super Admin'
summary: 'List Organizations'
operationId: listOrganizations
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
post:
tags:
- 'Super Admin'
summary: 'Create Org'
operationId: createOrg
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/super-admin/organizations-with-user:
post:
summary: 'Create Org With User'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: createOrgWithUser
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
'/super-admin/organizations/{id}':
delete:
tags:
- 'Super Admin'
summary: 'Delete Org'
operationId: deleteOrg
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
patch:
tags:
- 'Super Admin'
summary: 'Update Org'
operationId: updateOrg
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/super-admin/users/count:
get:
tags:
- 'Super Admin'
summary: 'Get User Count'
operationId: getUserCount
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/super-admin/users/exists:
get:
summary: 'Email Exists'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: emailExists
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
/super-admin/users:
get:
tags:
- 'Super Admin'
summary: 'List All Users'
operationId: listAllUsers
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/super-admin/organizations/{id}/users':
get:
tags:
- 'Super Admin'
summary: 'List Org Users'
operationId: listOrgUsers
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: Success
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
post:
summary: 'Create User In Org'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: createUserInOrg
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
'/super-admin/organizations/{id}/invitations':
get:
summary: 'List Org Invitations'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: listOrgInvitations
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
'/super-admin/organizations/{id}/invite':
post:
tags:
- 'Super Admin'
summary: 'Invite User To Org'
operationId: inviteUserToOrg
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
'/super-admin/users/{id}':
patch:
summary: 'Update User'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: updateUser
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
delete:
tags:
- 'Super Admin'
summary: 'Remove User'
operationId: removeUser
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
parameters:
-
name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: 'Deleted successfully'
'401':
description: Unauthorized
'403':
description: 'Forbidden - insufficient role'
'500':
description: 'Internal server error'
/super-admin/monitoring:
get:
summary: 'Get Monitoring'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: getMonitoring
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
put:
summary: 'Update Monitoring'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: updateMonitoring
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
/super-admin/monitoring/token:
post:
summary: 'Generate Monitoring Token'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: generateMonitoringToken
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
/super-admin/super-admins:
get:
summary: 'List Super Admins'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: listSuperAdmins
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
post:
summary: 'Grant Super Admin'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: grantSuperAdmin
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
'/super-admin/super-admins/{user_id}':
delete:
summary: 'Revoke Super Admin'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Super Admin'
operationId: revokeSuperAdmin
security:
-
bearerAuth: []
description: 'Requires role: Super Admin'
/mcp:
post:
summary: 'MCP JSON-RPC request'
responses:
'200':
description: 'JSON-RPC response'
'500':
description: 'Internal server error'
tags:
- Mcp
operationId: handleMcpRequest
security:
-
bearerAuth: []
description: 'Stateless MCP endpoint for the super admin tools. Send a JSON-RPC message in the body; the reply is plain JSON, not an SSE stream. Requires role: Super Admin'
get:
summary: 'Rejected (use POST)'
responses:
'405':
description: 'Method not allowed: this server has no event stream, use POST'
tags:
- Mcp
operationId: rejectMcpGet
security:
-
bearerAuth: []
description: 'Always returns 405. Requires role: Super Admin'
delete:
summary: 'Rejected (stateless server)'
responses:
'405':
description: 'Method not allowed: there is no session to end'
tags:
- Mcp
operationId: rejectMcpDelete
security:
-
bearerAuth: []
description: 'Always returns 405. Requires role: Super Admin'
/internal/ai-gateway/notify:
post:
tags:
- Internal
summary: 'AI Gateway notification callback'
operationId: internal_anonymous
requestBody:
content:
application/json:
schema:
type: object
responses:
'201':
description: 'Created successfully'
'500':
description: 'Internal server error'
/internal/observability-config:
get:
summary: Anonymous
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Internal
operationId: internal_anonymous
/telemetry:
post:
summary: Type
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- Telemetry
operationId: type
/ssoConfig/feature:
get:
summary: 'Get S S O Feature Status'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'SSO Config'
operationId: getSSOFeatureStatus
/ssoConfig/check-status:
get:
summary: 'Check S S O Status'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'SSO Config'
operationId: checkSSOStatus
/ssoConfig/orgs:
get:
summary: 'List S S O Orgs'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'SSO Config'
operationId: listSSOOrgs
/ssoConfig:
get:
summary: 'Get S S O Config'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'SSO Config'
operationId: getSSOConfig
security:
-
bearerAuth: []
description: 'Requires role: Admin'
put:
summary: 'Save S S O Config'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'SSO Config'
operationId: saveSSOConfig
security:
-
bearerAuth: []
description: 'Requires role: Admin'
/ssoConfig/enable:
put:
summary: 'Enable S S O'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'SSO Config'
operationId: enableSSO
security:
-
bearerAuth: []
description: 'Requires role: Admin'
/ssoConfig/disable:
put:
summary: 'Disable S S O'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'SSO Config'
operationId: disableSSO
security:
-
bearerAuth: []
description: 'Requires role: Admin'
/ai-trust-index/apps:
get:
summary: 'Get Apps'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Ai Trust Index'
operationId: getApps
security:
-
bearerAuth: []
'/ai-trust-index/apps/{slug}':
get:
summary: 'Get App'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Ai Trust Index'
operationId: getApp
security:
-
bearerAuth: []
/ai-trust-index/tracked:
get:
summary: 'Get Tracked'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Ai Trust Index'
operationId: getTracked
security:
-
bearerAuth: []
post:
summary: 'Track App'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Ai Trust Index'
operationId: trackApp
security:
-
bearerAuth: []
/ai-trust-index/tracked/bulk:
post:
summary: 'Track Apps Bulk'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Ai Trust Index'
operationId: trackAppsBulk
security:
-
bearerAuth: []
'/ai-trust-index/tracked/{slug}':
delete:
summary: 'Untrack App'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Ai Trust Index'
operationId: untrackApp
security:
-
bearerAuth: []
/ai-trust-index/settings:
get:
summary: 'Get Settings'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Ai Trust Index'
operationId: ai_trust_index_getSettings
security:
-
bearerAuth: []
put:
summary: 'Update Settings'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- 'Ai Trust Index'
operationId: ai_trust_index_updateSettings
security:
-
bearerAuth: []
/health/live:
get:
summary: 'Liveness probe'
description: 'Returns 200 while the process is serving HTTP. Checks no dependencies, so an outage elsewhere never fails liveness.'
responses:
'200':
description: Success
tags:
- System
operationId: healthCheck_live
/health/ready:
get:
summary: 'Readiness probe'
description: 'Checks PostgreSQL and Redis (2s timeout each). Returns 503 with status "degraded" when either fails.'
responses:
'200':
description: Success
'503':
description: 'A data store is unavailable'
tags:
- System
operationId: healthCheck_ready
/health:
get:
summary: 'Health Check'
responses:
'200':
description: Success
'500':
description: 'Internal server error'
tags:
- System
operationId: healthCheck