{"openapi":"3.1.0","info":{"title":"Agentic API","version":"1.0.0","description":"Registry, reported telemetry, scoped authorization, human review and tamper-evident evidence for AI agents. The pilot executes through a simulated procurement executor only. Every response carries request_id. Valid business decisions, including deny, return 200."},"servers":[{"url":"/api/v1"}],"components":{"securitySchemes":{"session":{"type":"apiKey","in":"cookie","name":"agentic_session","description":"Console session. Mutations also need the x-agentic-csrf header."},"agentKey":{"type":"http","scheme":"bearer","description":"Agent key, agk_<public id>_<secret>"},"executorKey":{"type":"http","scheme":"bearer","description":"Executor credential, exk_<public id>_<secret>"}},"schemas":{"Error":{"type":"object","required":["request_id","error"],"properties":{"request_id":{"type":"string"},"error":{"type":"object","required":["code","message","retryable","details"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"retryable":{"type":"boolean"},"details":{"type":"object","additionalProperties":true}}}}},"Action":{"type":"object","properties":{"type":{"type":"string","maxLength":64,"pattern":"^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*){1,3}$"},"resource":{"type":"object","properties":{"namespace":{"type":"string","pattern":"^[a-z][a-z0-9_]{0,31}$"},"id":{"type":"string","minLength":1,"maxLength":256}},"required":["namespace","id"],"additionalProperties":false},"parameters":{"default":{},"type":"object","propertyNames":{"type":"string","maxLength":64},"additionalProperties":{}}},"required":["type","resource"],"additionalProperties":false},"AuthorizeRequest":{"type":"object","properties":{"agent_id":{"type":"string"},"run_id":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9._:-]+$"},"action":{"type":"object","properties":{"type":{"type":"string","maxLength":64,"pattern":"^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*){1,3}$"},"resource":{"type":"object","properties":{"namespace":{"type":"string","pattern":"^[a-z][a-z0-9_]{0,31}$"},"id":{"type":"string","minLength":1,"maxLength":256}},"required":["namespace","id"],"additionalProperties":false},"parameters":{"default":{},"type":"object","propertyNames":{"type":"string","maxLength":64},"additionalProperties":{}}},"required":["type","resource"],"additionalProperties":false},"replaces_authorization_id":{"type":"string"}},"required":["run_id","action"],"additionalProperties":false},"PolicyContent":{"type":"object","properties":{"schema_version":{"type":"number","const":1},"allow":{"minItems":1,"maxItems":50,"type":"array","items":{"type":"object","properties":{"action":{"type":"string","maxLength":64,"pattern":"^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*){1,3}$"},"resource":{"type":"string","maxLength":200}},"required":["action","resource"],"additionalProperties":false}},"deny":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"action":{"type":"string","maxLength":64,"pattern":"^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*){1,3}$"},"resource":{"type":"string","maxLength":200}},"required":["action","resource"],"additionalProperties":false}},"approval":{"type":"object","properties":{"threshold_minor":{"type":"string","pattern":"^(0|[1-9][0-9]{0,17})$"},"reviewer_group":{"type":"string","pattern":"^[a-z][a-z0-9_]{1,62}$"},"ttl_seconds":{"type":"integer","minimum":300,"maximum":259200}},"required":["threshold_minor","reviewer_group","ttl_seconds"],"additionalProperties":false},"limits":{"type":"object","properties":{"per_action_max_minor":{"type":"string","pattern":"^(0|[1-9][0-9]{0,17})$"},"currency":{"type":"string","const":"USD"}},"required":["per_action_max_minor","currency"],"additionalProperties":false}},"required":["schema_version","allow","deny","approval","limits"],"additionalProperties":false},"Restrictions":{"type":"object","properties":{"allow":{"maxItems":50,"type":"array","items":{"type":"object","properties":{"action":{"type":"string","maxLength":64,"pattern":"^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*){1,3}$"},"resource":{"type":"string","maxLength":200}},"required":["action","resource"],"additionalProperties":false}},"approval_threshold_minor":{"type":"string","pattern":"^(0|[1-9][0-9]{0,17})$"},"per_action_max_minor":{"type":"string","pattern":"^(0|[1-9][0-9]{0,17})$"}},"additionalProperties":false},"ReasonCode":{"type":"string","enum":["WITHIN_POLICY","AMOUNT_REQUIRES_APPROVAL","AGENT_INACTIVE","AGENT_SUSPENDED","AGENT_RETIRED","ORGANIZATION_STOPPED","KEY_EXPIRED","ENVIRONMENT_MISMATCH","SCOPE_MISSING","NO_ACTIVE_POLICY","ACTION_NOT_ALLOWED","CAPABILITY_NOT_DECLARED","AGENT_RESTRICTION","EXPLICIT_DENY","UNSUPPORTED_CURRENCY","AMOUNT_EXCEEDS_ACTION_MAX","BUDGET_NOT_CONFIGURED","BUDGET_EXCEEDED","NO_ELIGIBLE_REVIEWER","POLICY_CHANGED","CANCELLED_BY_AGENT","CANCELLED_BY_HUMAN","REJECTED_BY_REVIEWER","EXPIRED"]},"Decision":{"type":"object","required":["request_id","id","revision","decision","state","reason_codes","action_hash","policy_epoch"],"properties":{"request_id":{"type":"string"},"id":{"type":"string"},"revision":{"type":"integer","minimum":1},"decision":{"type":"string","enum":["allow","approval_required","deny"]},"state":{"type":"string","enum":["pending_approval","allowed","denied","cancelled","expired"]},"reason_codes":{"type":"array","items":{"$ref":"#/components/schemas/ReasonCode"}},"primary_reason":{"$ref":"#/components/schemas/ReasonCode"},"policy_version":{"type":["integer","null"]},"policy_epoch":{"type":"integer"},"action_hash":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"approval_id":{"type":["string","null"]},"reservation_set_id":{"type":["string","null"]},"mode":{"type":"string","enum":["simulation","advisory","verified_adapter"]},"expires_at":{"type":["string","null"],"format":"date-time"},"permit":{"type":["object","null"],"properties":{"secret":{"type":"string"},"audience":{"type":"string"},"expires_at":{"type":"string","format":"date-time"}}}}}}},"paths":{"/agents":{"post":{"summary":"Create an inactive agent","security":[{"session":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["name","purpose","owner_id","department_id","environment"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":2,"maxLength":80},"purpose":{"type":"string","minLength":1,"maxLength":500},"owner_id":{"type":"string"},"department_id":{"type":"string"},"environment":{"type":"string","enum":["sandbox","production"]},"capabilities":{"type":"array","maxItems":20,"items":{"type":"object","required":["action","resource"],"properties":{"action":{"type":"string"},"resource":{"type":"string"}}}},"tags":{"type":"array","maxItems":10,"items":{"type":"string"}},"framework":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"}}},"agent_version":{"type":"string"},"monthly_ceiling_minor":{"type":"string"},"restrictions":{"$ref":"#/components/schemas/Restrictions"}}}}}},"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"get":{"summary":"Agent directory","security":[{"session":[]}],"parameters":[{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"cursor","in":"query","schema":{"type":"string"},"description":"Opaque, bound to tenant, filters and ordering"}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/agents/{id}":{"get":{"summary":"Agent detail","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"patch":{"summary":"Edit mutable metadata","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["expected_revision"],"properties":{"expected_revision":{"type":"integer","minimum":1}},"additionalProperties":true}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/agents/{id}/transitions":{"post":{"summary":"Activate, suspend, resume or retire","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["action","expected_revision"],"additionalProperties":false,"properties":{"action":{"type":"string","enum":["activate","suspend","resume","retire"]},"reason":{"type":"string","minLength":3,"maxLength":500},"expected_revision":{"type":"integer","minimum":1}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/agents/{id}/keys":{"post":{"summary":"Issue a scoped key, the secret is returned once","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["scopes"],"additionalProperties":false,"properties":{"scopes":{"type":"array","minItems":1,"maxItems":20,"items":{"type":"string"}},"expires_in_days":{"type":"integer","minimum":1,"maximum":90,"default":90},"rotate_from_key_id":{"type":"string"},"overlap_hours":{"type":"integer","minimum":0,"maximum":24,"default":0}}}}}},"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/agent-keys/{id}/revoke":{"post":{"summary":"Revoke a key immediately","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["reason"],"additionalProperties":false,"properties":{"reason":{"type":"string","minLength":3,"maxLength":500}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/agents/{id}/onboarding-test":{"post":{"summary":"Nonexecutable policy fixture and health check","security":[{"agentKey":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/heartbeats":{"post":{"summary":"Report agent version and health","security":[{"agentKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"agent_id":{"type":"string"},"agent_version":{"type":"string","maxLength":40},"status":{"type":"string","enum":["ok","degraded"]},"framework":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"}}}}}}}},"responses":{"202":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/events/batch":{"post":{"summary":"Ingest 1 to 100 typed events, results are per event","security":[{"agentKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["events"],"additionalProperties":false,"properties":{"events":{"type":"array","minItems":1,"maxItems":100,"items":{"type":"object","required":["event_id","type","occurred_at"],"properties":{"event_id":{"type":"string"},"run_id":{"type":"string"},"type":{"type":"string","enum":["run.started","run.completed","run.failed","tool.called","model.called","decision.requested","log"]},"occurred_at":{"type":"string","format":"date-time"},"correlation_id":{"type":"string"},"attributes":{"type":"object"}}}}}}}}},"responses":{"202":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/activity":{"get":{"summary":"Reported event feed","security":[{"session":[]}],"parameters":[{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"cursor","in":"query","schema":{"type":"string"},"description":"Opaque, bound to tenant, filters and ordering"}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/runs/{id}":{"get":{"summary":"Run detail","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/authorizations":{"post":{"summary":"Evaluate an action and persist the decision","security":[{"agentKey":[]}],"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string","minLength":1,"maxLength":200}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthorizeRequest"}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Decision"}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"get":{"summary":"Decision feed","security":[{"session":[]}],"parameters":[{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"cursor","in":"query","schema":{"type":"string"},"description":"Opaque, bound to tenant, filters and ordering"}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/authorizations/{id}":{"get":{"summary":"Current state, original decision and review context, never a permit secret","security":[{"agentKey":[]},{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/authorizations/{id}/permits":{"post":{"summary":"Issue a 60 second single-use permit after fresh checks","security":[{"agentKey":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string","minLength":1,"maxLength":200}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["expected_revision","audience"],"additionalProperties":false,"properties":{"expected_revision":{"type":"integer","minimum":1},"audience":{"type":"string","minLength":1,"maxLength":64}}}}}},"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/authorizations/{id}/cancel":{"post":{"summary":"Cancel before consumption","security":[{"agentKey":[]},{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"reason":{"type":"string","minLength":3,"maxLength":500},"expected_revision":{"type":"integer","minimum":1}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/permits/consume":{"post":{"summary":"Consume a permit and create the execution intent","security":[{"executorKey":[]}],"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string","minLength":1,"maxLength":200}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["permit","action_hash","audience"],"additionalProperties":false,"properties":{"permit":{"type":"string"},"action_hash":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"audience":{"type":"string"}}}}}},"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/executions/{id}/complete":{"post":{"summary":"Report the final result with evidence and the actual amount","security":[{"executorKey":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string","minLength":1,"maxLength":200}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["status"],"additionalProperties":false,"properties":{"status":{"type":"string","enum":["succeeded","failed"]},"actual_amount_minor":{"type":"string"},"currency":{"type":"string"},"evidence":{"type":"object","required":["source","reference"],"properties":{"source":{"type":"string"},"reference":{"type":"string"}}},"failure_reason":{"type":"string"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/executions/{id}/reconcile":{"post":{"summary":"Resolve an unknown execution from the downstream record","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/simulator/execute":{"post":{"summary":"Simulated procurement executor, hashes the action it executes","security":[{"executorKey":[]}],"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string","minLength":1,"maxLength":200}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["permit","run_id","action"],"additionalProperties":false,"properties":{"permit":{"type":"string"},"run_id":{"type":"string"},"action":{"$ref":"#/components/schemas/Action"},"fault":{"type":"string","enum":["none","timeout_before_purchase","timeout_after_purchase"]}}}}}},"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/approvals":{"get":{"summary":"Review inbox","security":[{"session":[]}],"parameters":[{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"cursor","in":"query","schema":{"type":"string"},"description":"Opaque, bound to tenant, filters and ordering"}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/approvals/{id}":{"get":{"summary":"Approval with the exact action under review","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/approvals/{id}/review":{"post":{"summary":"Approve or reject, first committer wins","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"Idempotency-Key","in":"header","required":true,"schema":{"type":"string","minLength":1,"maxLength":200}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["expected_revision","decision","reason"],"additionalProperties":false,"properties":{"expected_revision":{"type":"integer","minimum":1},"decision":{"type":"string","enum":["approve","reject"]},"reason":{"type":"string","minLength":10,"maxLength":1000}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/policies":{"get":{"summary":"Version history and the effective rules","security":[{"session":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/policies/{id}":{"get":{"summary":"One immutable policy version","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/policies/preview":{"post":{"summary":"Evaluate a draft against an action with no side effects","security":[{"session":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["environment","agent_id","action"],"additionalProperties":false,"properties":{"environment":{"type":"string","enum":["sandbox","production"]},"content":{"$ref":"#/components/schemas/PolicyContent"},"agent_id":{"type":"string"},"run_id":{"type":"string"},"action":{"$ref":"#/components/schemas/Action"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/policies/publish":{"post":{"summary":"Publish an immutable version and advance the policy epoch","security":[{"session":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["environment","content","expected_revision","note"],"additionalProperties":false,"properties":{"environment":{"type":"string","enum":["sandbox","production"]},"content":{"$ref":"#/components/schemas/PolicyContent"},"expected_revision":{"type":"integer","minimum":0},"note":{"type":"string","minLength":3,"maxLength":500},"rollback_of_version":{"type":"integer","minimum":1}}}}}},"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/budgets":{"get":{"summary":"Ceilings, committed, reserved and available by scope","security":[{"session":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"post":{"summary":"Set a monthly ceiling","security":[{"session":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["scope_type","ceiling_minor","reason"],"additionalProperties":false,"properties":{"scope_type":{"type":"string","enum":["organization","agent"]},"scope_id":{"type":"string"},"ceiling_minor":{"type":"string"},"reason":{"type":"string","minLength":3,"maxLength":500},"expected_revision":{"type":["integer","null"]}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/ledger":{"get":{"summary":"Append-only ledger entries","security":[{"session":[]}],"parameters":[{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"cursor","in":"query","schema":{"type":"string"},"description":"Opaque, bound to tenant, filters and ordering"}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/audit-events":{"get":{"summary":"Hash-chained evidence","security":[{"session":[]}],"parameters":[{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":100,"default":50}},{"name":"cursor","in":"query","schema":{"type":"string"},"description":"Opaque, bound to tenant, filters and ordering"}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/audit-exports":{"post":{"summary":"Queue an export job","security":[{"session":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["from","to"],"additionalProperties":false,"properties":{"from":{"type":"string","format":"date-time"},"to":{"type":"string","format":"date-time"},"event_category":{"type":"string"},"environment":{"type":"string","enum":["sandbox","production"]}}}}}},"responses":{"202":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/audit-exports/{id}":{"get":{"summary":"Job status and a short-lived download link","security":[{"session":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/organization/stop":{"post":{"summary":"Turn the organization execution stop on or off","security":[{"session":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["enabled","reason","expected_revision"],"additionalProperties":false,"properties":{"enabled":{"type":"boolean"},"reason":{"type":"string","minLength":3,"maxLength":500},"expected_revision":{"type":"integer","minimum":1}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"description":"Authenticated but missing role or scope","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Absent or inaccessible","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"409":{"description":"Revision, state or idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"description":"Invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Throttled, see Retry-After","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Dependency unavailable, never treat as allow","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/health":{"get":{"summary":"Liveness","security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"required":["request_id"],"properties":{"request_id":{"type":"string"}}}}}}}}}}}