{
  "components": {
    "schemas": {
      "AuditRecord": {
        "properties": {
          "action": {
            "type": "string"
          },
          "actor": {
            "type": "string"
          },
          "actor_kind": {
            "type": "string"
          },
          "agent_id": {
            "type": "string"
          },
          "agent_name": {
            "type": "string"
          },
          "attrs": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          },
          "dst": {
            "type": "string"
          },
          "dst_host": {
            "type": "string"
          },
          "dst_ip": {
            "type": "string"
          },
          "dst_port": {
            "maximum": 65535,
            "minimum": 0,
            "type": "integer"
          },
          "enclave_id": {
            "type": "string"
          },
          "enclave_name": {
            "type": "string"
          },
          "event_time": {
            "format": "date-time",
            "type": "string"
          },
          "group_id": {
            "type": "string"
          },
          "identified": {
            "type": "boolean"
          },
          "namespace": {
            "type": "string"
          },
          "org_id": {
            "type": "string"
          },
          "outcome": {
            "type": "string"
          },
          "proto": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          },
          "resource": {
            "type": "string"
          },
          "scope": {
            "type": "string"
          },
          "security_id": {
            "type": "string"
          },
          "session_id": {
            "type": "string"
          },
          "source": {
            "type": "string"
          },
          "src": {
            "type": "string"
          },
          "src_ip": {
            "type": "string"
          },
          "trace_id": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "HealthView": {
        "properties": {
          "component": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "version": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "InspectionInspector": {
        "properties": {
          "name": {
            "type": "string"
          },
          "rules": {
            "items": {
              "$ref": "#/components/schemas/InspectionRule"
            },
            "type": "array"
          }
        },
        "type": "object"
      },
      "InspectionRule": {
        "properties": {
          "arg_gt": {
            "additionalProperties": {
              "format": "double",
              "type": "number"
            },
            "type": "object"
          },
          "summary": {
            "type": "string"
          },
          "tool": {
            "type": "string"
          },
          "verdict": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "LLMInspectionPolicy": {
        "properties": {
          "inspectors": {
            "items": {
              "$ref": "#/components/schemas/InspectionInspector"
            },
            "type": "array"
          }
        },
        "type": "object"
      },
      "ModelPolicy": {
        "properties": {
          "allow": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "deny": {
            "items": {
              "type": "string"
            },
            "type": "array"
          }
        },
        "type": "object"
      },
      "Problem": {
        "properties": {
          "detail": {
            "type": "string"
          },
          "instance": {
            "type": "string"
          },
          "status": {
            "type": "integer"
          },
          "title": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "RecordPage": {
        "properties": {
          "next_offset": {
            "type": "integer"
          },
          "records": {
            "items": {
              "$ref": "#/components/schemas/AuditRecord"
            },
            "type": "array"
          }
        },
        "type": "object"
      },
      "Rule": {
        "properties": {
          "cidr": {
            "type": "string"
          },
          "host": {
            "type": "string"
          },
          "port": {
            "type": "integer"
          },
          "reason": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "TokenError": {
        "properties": {
          "error": {
            "type": "string"
          },
          "error_description": {
            "type": "string"
          },
          "error_uri": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "TokenRequest": {
        "properties": {
          "assertion": {
            "type": "string"
          },
          "grant_type": {
            "type": "string"
          },
          "scope": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "TokenResponse": {
        "properties": {
          "access_token": {
            "type": "string"
          },
          "expires_in": {
            "type": "integer"
          },
          "id_token": {
            "type": "string"
          },
          "scope": {
            "type": "string"
          },
          "token_type": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "addressReq": {
        "properties": {
          "broker_url": {
            "type": "string"
          },
          "relay_url": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "agentView": {
        "properties": {
          "command": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "contained": {
            "type": "boolean"
          },
          "enclave_id": {
            "type": "string"
          },
          "group_id": {
            "type": "string"
          },
          "image": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "org_id": {
            "type": "string"
          },
          "uid": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "configValueReq": {
        "properties": {
          "locked": {
            "type": "boolean"
          },
          "secret": {
            "type": "boolean"
          },
          "value": {}
        },
        "type": "object"
      },
      "configValueView": {
        "properties": {
          "key": {
            "type": "string"
          },
          "locked": {
            "type": "boolean"
          },
          "published": {
            "type": "boolean"
          },
          "scope": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "containmentView": {
        "properties": {
          "agent": {
            "type": "string"
          },
          "contained": {
            "type": "boolean"
          },
          "enclave_id": {
            "type": "string"
          },
          "nudged": {
            "type": "boolean"
          },
          "org_id": {
            "type": "string"
          },
          "published": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "createAgentReq": {
        "properties": {
          "command": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "enclave_id": {
            "type": "string"
          },
          "group": {
            "type": "string"
          },
          "image": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "policy_packs": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "uid": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "createGrantReq": {
        "properties": {
          "agent": {
            "type": "string"
          },
          "capability": {
            "type": "string"
          },
          "group": {
            "type": "string"
          },
          "principal": {
            "type": "string"
          },
          "role": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "createGroupReq": {
        "properties": {
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "provider_group_ref": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "createOrgReq": {
        "properties": {
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "provider_org_ref": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "createRoleReq": {
        "properties": {
          "capabilities": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "name": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "createSelfServiceSAReq": {
        "properties": {
          "grants": {
            "items": {
              "$ref": "#/components/schemas/selfServiceGrantReq"
            },
            "type": "array"
          },
          "groups": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "name": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "createServiceAccountGrantReq": {
        "properties": {
          "agent": {
            "type": "string"
          },
          "capability": {
            "type": "string"
          },
          "group": {
            "type": "string"
          },
          "role": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "createServiceAccountReq": {
        "properties": {
          "name": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "definePackReq": {
        "properties": {
          "allow": {
            "items": {
              "$ref": "#/components/schemas/Rule"
            },
            "type": "array"
          },
          "deny": {
            "items": {
              "$ref": "#/components/schemas/Rule"
            },
            "type": "array"
          },
          "name": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "definePackView": {
        "properties": {
          "pack": {
            "type": "string"
          },
          "published": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "destinationPolicyReq": {
        "properties": {
          "allow": {
            "items": {
              "$ref": "#/components/schemas/Rule"
            },
            "type": "array"
          },
          "deny": {
            "items": {
              "$ref": "#/components/schemas/Rule"
            },
            "type": "array"
          },
          "locked": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "effectiveView": {
        "properties": {
          "capabilities": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "groups": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "org_id": {
            "type": "string"
          },
          "subject": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "enclaveView": {
        "properties": {
          "address_source": {
            "type": "string"
          },
          "address_updated_at": {
            "type": "string"
          },
          "broker_url": {
            "type": "string"
          },
          "enclave_id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "owning_org_id": {
            "type": "string"
          },
          "relay_url": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "erasureResultView": {
        "properties": {
          "key_shredded": {
            "type": "boolean"
          },
          "org_id": {
            "type": "string"
          },
          "rows_swept": {
            "format": "int64",
            "type": "integer"
          },
          "status": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "erasureView": {
        "properties": {
          "org_id": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "execPolicyReq": {
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "locked": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "execSessionView": {
        "properties": {
          "exec_port": {
            "type": "integer"
          },
          "expires_at": {
            "type": "string"
          },
          "relay_url": {
            "type": "string"
          },
          "session_id": {
            "type": "string"
          },
          "ticket": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "grantView": {
        "properties": {
          "agent_id": {
            "type": "string"
          },
          "capability": {
            "type": "string"
          },
          "group_id": {
            "type": "string"
          },
          "id": {
            "format": "int64",
            "type": "integer"
          },
          "org_id": {
            "type": "string"
          },
          "principal": {
            "type": "string"
          },
          "role": {
            "type": "string"
          },
          "scope_kind": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "groupView": {
        "properties": {
          "id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "org_id": {
            "type": "string"
          },
          "provider_group_ref": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "idpConnectorReq": {
        "properties": {
          "client_id": {
            "type": "string"
          },
          "client_secret": {
            "type": "string"
          },
          "groups_attribute": {
            "type": "string"
          },
          "issuer": {
            "type": "string"
          },
          "metadata_url": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "scopes": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "type": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "idpConnectorView": {
        "properties": {
          "groups_attribute": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "org_id": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "type": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "installPackView": {
        "properties": {
          "installed": {
            "type": "boolean"
          },
          "pack": {
            "type": "string"
          },
          "published": {
            "type": "boolean"
          },
          "scope": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "isoClassReq": {
        "properties": {
          "isolationClass": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "isoClassView": {
        "properties": {
          "isolationClass": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "llmPolicyReq": {
        "properties": {
          "credential_mode": {
            "nullable": true,
            "type": "string"
          },
          "inspection": {
            "$ref": "#/components/schemas/LLMInspectionPolicy"
          },
          "locked": {
            "type": "boolean"
          },
          "models": {
            "$ref": "#/components/schemas/ModelPolicy"
          },
          "providers": {
            "$ref": "#/components/schemas/ModelPolicy"
          },
          "upstream": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object"
          }
        },
        "type": "object"
      },
      "memberView": {
        "properties": {
          "email": {
            "type": "string"
          },
          "subject": {
            "type": "string"
          },
          "username": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "offboardUserView": {
        "properties": {
          "subject": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "openSSHReq": {
        "properties": {
          "operator_ssh_public_key": {
            "type": "string"
          },
          "operator_wireguard_public_key": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "openTunnelReq": {
        "properties": {
          "operator_public_key": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "orgView": {
        "properties": {
          "id": {
            "type": "string"
          },
          "kind": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "provider_org_ref": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "policyWriteView": {
        "properties": {
          "key": {
            "type": "string"
          },
          "locked": {
            "type": "boolean"
          },
          "published": {
            "type": "boolean"
          },
          "scope": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "putRoleReq": {
        "properties": {
          "capabilities": {
            "items": {
              "type": "string"
            },
            "type": "array"
          }
        },
        "type": "object"
      },
      "registerBrokerReq": {
        "properties": {
          "enclave_id": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "owning_org": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "registerBrokerView": {
        "properties": {
          "enclave_id": {
            "type": "string"
          },
          "key": {},
          "subject": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "roleView": {
        "properties": {
          "capabilities": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "name": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "selfServiceGrantReq": {
        "properties": {
          "agent": {
            "type": "string"
          },
          "capability": {
            "type": "string"
          },
          "group": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "serviceAccountCredentialView": {
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "credential": {},
          "id": {
            "type": "string"
          },
          "level": {
            "type": "string"
          },
          "org_id": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "serviceAccountGrantView": {
        "properties": {
          "agent_id": {
            "type": "string"
          },
          "capability": {
            "type": "string"
          },
          "group_id": {
            "type": "string"
          },
          "id": {
            "format": "int64",
            "type": "integer"
          },
          "org_id": {
            "type": "string"
          },
          "role": {
            "type": "string"
          },
          "scope_kind": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "serviceAccountKeyView": {
        "properties": {
          "credential": {},
          "id": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "serviceAccountView": {
        "properties": {
          "created_at": {
            "format": "date-time",
            "type": "string"
          },
          "id": {
            "type": "string"
          },
          "level": {
            "type": "string"
          },
          "org_id": {
            "type": "string"
          },
          "owner": {
            "type": "string"
          },
          "status": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "sshPolicyReq": {
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "locked": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "sshSessionView": {
        "properties": {
          "expires_at": {
            "type": "string"
          },
          "relay_url": {
            "type": "string"
          },
          "session_id": {
            "type": "string"
          },
          "ssh_certificate": {
            "type": "string"
          },
          "ssh_port": {
            "type": "integer"
          },
          "ticket": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "transferServiceAccountReq": {
        "properties": {
          "owner": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "tunnelPolicyReq": {
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "locked": {
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "tunnelPortsPolicyReq": {
        "properties": {
          "locked": {
            "type": "boolean"
          },
          "ports": {
            "items": {
              "type": "integer"
            },
            "type": "array"
          }
        },
        "type": "object"
      },
      "tunnelTicketView": {
        "properties": {
          "expires_at": {
            "type": "string"
          },
          "relay_url": {
            "type": "string"
          },
          "session_id": {
            "type": "string"
          },
          "ticket": {
            "type": "string"
          }
        },
        "type": "object"
      },
      "whoamiView": {
        "properties": {
          "capabilities": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "groups": {
            "items": {
              "type": "string"
            },
            "type": "array"
          },
          "kind": {
            "type": "string"
          },
          "org_id": {
            "type": "string"
          },
          "subject": {
            "type": "string"
          }
        },
        "type": "object"
      }
    },
    "securitySchemes": {
      "bearerAuth": {
        "bearerFormat": "JWT",
        "scheme": "bearer",
        "type": "http"
      }
    }
  },
  "info": {
    "description": "The controlplane's authenticated operator API: identity (orgs/groups/grants), governance + LLM policy, agent config, agent lifecycle, per-org erasure (crypto-shred), and the enclave registry, plus the shared audit read API. The operator authors desired state; the enclave converges. The controlplane never receives or stores sovereign data. Every /api/v1 route requires a JWT bearer from the deployment's identity issuer (whoami needs only a valid token; per-route capability requirements are given as `x-required-capability`). Capability targets are derived from the route path, never the request body. Errors are RFC 9457 problem documents. ONE exception: the unauthenticated POST /oauth/token token facade (outside /api/v1), where callers exchange a service-account assertion for a token without contacting the identity issuer directly - its responses, including verbatim issuer errors, are OAuth 2.0 error bodies (RFC 6749 §5.2), not problem documents. This document describes the full surface; in a running controlplane some route families are feature-gated and mounted only when their backing subsystem was wired at startup.",
    "title": "Daevix controlplane operator API",
    "version": "v1"
  },
  "openapi": "3.2.0",
  "paths": {
    "/api/v1/audit/events": {
      "get": {
        "parameters": [
          {
            "description": "Narrowing org filter, honored only for a cross-org (platform:audit:read) caller",
            "in": "query",
            "name": "org",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Restrict to one audit scope",
            "in": "query",
            "name": "scope",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Restrict to one agent id",
            "in": "query",
            "name": "agent_id",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Restrict to one action (e.g. inference.request)",
            "in": "query",
            "name": "action",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Restrict to one outcome (e.g. allow, deny)",
            "in": "query",
            "name": "outcome",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Restrict to one actor kind (human-operator, agent-operator, service)",
            "in": "query",
            "name": "actor_kind",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Network protocol; matches network_flow rows only",
            "in": "query",
            "name": "proto",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Destination host; matches network_flow rows only",
            "in": "query",
            "name": "dst_host",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Lower bound on event_time (RFC3339)",
            "in": "query",
            "name": "since",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Upper bound on event_time (RFC3339)",
            "in": "query",
            "name": "until",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Maximum rows to return",
            "in": "query",
            "name": "limit",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Row offset for pagination",
            "in": "query",
            "name": "offset",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecordPage"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "List audit records (unified view, filtered + paginated) for the caller's org"
      }
    },
    "/api/v1/audit/stream": {
      "get": {
        "parameters": [
          {
            "description": "Narrowing org filter, honored only for a cross-org (platform:audit:read) caller",
            "in": "query",
            "name": "org",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Restrict to one audit scope",
            "in": "query",
            "name": "scope",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Restrict to one agent id",
            "in": "query",
            "name": "agent_id",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Restrict to one action (e.g. inference.request)",
            "in": "query",
            "name": "action",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Restrict to one outcome (e.g. allow, deny)",
            "in": "query",
            "name": "outcome",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Restrict to one actor kind (human-operator, agent-operator, service)",
            "in": "query",
            "name": "actor_kind",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Network protocol; matches network_flow rows only",
            "in": "query",
            "name": "proto",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Destination host; matches network_flow rows only",
            "in": "query",
            "name": "dst_host",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Lower bound on event_time (RFC3339)",
            "in": "query",
            "name": "since",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Upper bound on event_time (RFC3339)",
            "in": "query",
            "name": "until",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Maximum rows to return",
            "in": "query",
            "name": "limit",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Row offset for pagination",
            "in": "query",
            "name": "offset",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "text/event-stream": {
                "itemSchema": {
                  "$ref": "#/components/schemas/AuditRecord"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Live Server-Sent-Events tail of audit records (same filters) for the caller's org"
      }
    },
    "/api/v1/config/{key}": {
      "delete": {
        "description": "Requires the `platform:config` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete a config value at platform scope",
        "x-required-capability": "platform:config"
      },
      "post": {
        "description": "Requires the `platform:config` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/configValueReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/configValueView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author a config value at platform scope",
        "x-required-capability": "platform:config"
      }
    },
    "/api/v1/enclaves": {
      "get": {
        "description": "Requires the `enclaves:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/enclaveView"
                  },
                  "type": "array"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "List the enclaves serving the caller's org and how to reach them",
        "x-required-capability": "enclaves:read"
      },
      "post": {
        "description": "Requires the `enclaves:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/registerBrokerReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/registerBrokerView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "summary": "Register an enclave: mint its broker identity + key (returned once)",
        "x-required-capability": "enclaves:manage"
      }
    },
    "/api/v1/enclaves/{enclave}": {
      "delete": {
        "description": "Requires the `enclaves:manage` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete an enclave from the registry",
        "x-required-capability": "enclaves:manage"
      }
    },
    "/api/v1/enclaves/{enclave}/address": {
      "put": {
        "description": "Requires the `enclaves:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/addressReq"
              }
            }
          }
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Set an enclave's client-reachable addresses (operator override)",
        "x-required-capability": "enclaves:manage"
      }
    },
    "/api/v1/enclaves/{enclave}/isolation-class": {
      "get": {
        "description": "Requires the `enclaves:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/isoClassView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Read an enclave's requested isolation class (empty = never authored)",
        "x-required-capability": "enclaves:read"
      },
      "put": {
        "description": "Requires the `enclaves:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/isoClassReq"
              }
            }
          }
        },
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Set an enclave's requested isolation class (plain \u003c vm \u003c node-cvm \u003c per-agent-tee)",
        "x-required-capability": "enclaves:manage"
      }
    },
    "/api/v1/grants": {
      "post": {
        "description": "Requires the `platform:operators` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/createGrantReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/grantView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Create a platform-operator grant",
        "x-required-capability": "platform:operators"
      }
    },
    "/api/v1/grants/{id}": {
      "delete": {
        "description": "Requires the `platform:operators` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete a platform grant",
        "x-required-capability": "platform:operators"
      }
    },
    "/api/v1/orgs": {
      "get": {
        "description": "Requires the `platform:orgs` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/orgView"
                  },
                  "type": "array"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "List organizations",
        "x-required-capability": "platform:orgs"
      },
      "post": {
        "description": "Requires the `platform:orgs` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/createOrgReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/orgView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Create an organization coordinate",
        "x-required-capability": "platform:orgs"
      }
    },
    "/api/v1/orgs/{org}": {
      "delete": {
        "description": "Requires the `platform:orgs` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete an organization coordinate",
        "x-required-capability": "platform:orgs"
      },
      "get": {
        "description": "Requires the `org:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/orgView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Get one organization",
        "x-required-capability": "org:read"
      }
    },
    "/api/v1/orgs/{org}/agents": {
      "get": {
        "description": "Requires the `agents:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/agentView"
                  },
                  "type": "array"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "List an org's agents",
        "x-required-capability": "agents:read"
      },
      "post": {
        "description": "Requires the `agents:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/createAgentReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/agentView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Create an operator-desired agent for an org",
        "x-required-capability": "agents:manage"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}": {
      "delete": {
        "description": "Requires the `agents:manage` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete (withdraw) an agent",
        "x-required-capability": "agents:manage"
      },
      "get": {
        "description": "Requires the `agents:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/agentView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Get one agent",
        "x-required-capability": "agents:read"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/config/{key}": {
      "delete": {
        "description": "Requires the `config:write` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete a config value at agent scope",
        "x-required-capability": "config:write"
      },
      "post": {
        "description": "Requires the `config:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/configValueReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/configValueView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author a config value at agent scope",
        "x-required-capability": "config:write"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/contain": {
      "post": {
        "description": "Requires the `agents:manage` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/containmentView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "summary": "Contain an agent: freeze it IN PLACE (deny all egress + LLM inference, revoke agent-operator authority); NOT a teardown - the VM keeps running so evidence is preserved",
        "x-required-capability": "agents:manage"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/exec": {
      "post": {
        "description": "Requires the `exec:access` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/openExecReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/execSessionView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Mint an exec-kind rendezvous session for an interactive PTY/exec into an agent",
        "x-required-capability": "exec:access"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/policy/destination": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/destinationPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author destination policy at agent scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/policy/exec": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/execPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the operator-exec-access capability at agent scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/policy/llm": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/llmPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author LLM governance policy at agent scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/policy/packs/{name}": {
      "delete": {
        "description": "Requires the `policy:write` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Uninstall a policy pack at agent scope",
        "x-required-capability": "policy:write"
      },
      "post": {
        "description": "Requires the `policy:write` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/installPackView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Install a policy pack at agent scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/policy/ssh": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/sshPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the operator-SSH-access capability at agent scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/policy/tunnel": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/tunnelPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the interactive-access (tunnel) capability at agent scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/policy/tunnel/ports": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/tunnelPortsPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the interactive-access (tunnel) port allow-list at agent scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/release": {
      "post": {
        "description": "Requires the `agents:manage` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/containmentView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "summary": "Release a contained agent: restore its prior policy surface and agent-operator authority (inspect first; the alternative is delete)",
        "x-required-capability": "agents:manage"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/ssh": {
      "post": {
        "description": "Requires the `ssh:access` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/openSSHReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/sshSessionView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Mint a short-TTL operator SSH cert + ssh-kind tunnel session to an agent",
        "x-required-capability": "ssh:access"
      }
    },
    "/api/v1/orgs/{org}/agents/{agent}/tunnel": {
      "post": {
        "description": "Requires the `tunnel:open` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/openTunnelReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/tunnelTicketView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Mint a short-TTL operator\u003c-\u003eagent tunnel pairing ticket",
        "x-required-capability": "tunnel:open"
      }
    },
    "/api/v1/orgs/{org}/config/{key}": {
      "delete": {
        "description": "Requires the `config:write` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete a config value at org scope",
        "x-required-capability": "config:write"
      },
      "post": {
        "description": "Requires the `config:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/configValueReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/configValueView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author a config value at org scope",
        "x-required-capability": "config:write"
      }
    },
    "/api/v1/orgs/{org}/erasure": {
      "post": {
        "description": "Requires the `platform:orgs` capability.",
        "responses": {
          "202": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/erasureView"
                }
              }
            },
            "description": "Accepted"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Begin org erasure: open the grace window (mark the org destroying; nothing destroyed yet)",
        "x-required-capability": "platform:orgs"
      }
    },
    "/api/v1/orgs/{org}/erasure/complete": {
      "post": {
        "description": "Requires the `platform:orgs` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/erasureResultView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Complete org erasure: crypto-shred the org key and sweep its rows (IRREVERSIBLE)",
        "x-required-capability": "platform:orgs"
      }
    },
    "/api/v1/orgs/{org}/grants": {
      "get": {
        "description": "Requires the `members:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/grantView"
                  },
                  "type": "array"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "List an org's grants",
        "x-required-capability": "members:read"
      },
      "post": {
        "description": "Requires the `members:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/createGrantReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/grantView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Create an org-scoped role or capability grant",
        "x-required-capability": "members:manage"
      }
    },
    "/api/v1/orgs/{org}/grants/{id}": {
      "delete": {
        "description": "Requires the `members:manage` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete an org grant",
        "x-required-capability": "members:manage"
      }
    },
    "/api/v1/orgs/{org}/groups": {
      "get": {
        "description": "Requires the `groups:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/groupView"
                  },
                  "type": "array"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "List an org's groups",
        "x-required-capability": "groups:read"
      },
      "post": {
        "description": "Requires the `groups:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/createGroupReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/groupView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Create a group in an org",
        "x-required-capability": "groups:manage"
      }
    },
    "/api/v1/orgs/{org}/groups/{group}": {
      "delete": {
        "description": "Requires the `groups:manage` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete a group",
        "x-required-capability": "groups:manage"
      },
      "get": {
        "description": "Requires the `groups:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/groupView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Get one group",
        "x-required-capability": "groups:read"
      }
    },
    "/api/v1/orgs/{org}/groups/{group}/config/{key}": {
      "delete": {
        "description": "Requires the `config:write` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete a config value at group scope",
        "x-required-capability": "config:write"
      },
      "post": {
        "description": "Requires the `config:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/configValueReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/configValueView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author a config value at group scope",
        "x-required-capability": "config:write"
      }
    },
    "/api/v1/orgs/{org}/groups/{group}/members": {
      "get": {
        "description": "Requires the `members:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/memberView"
                  },
                  "type": "array"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "List a group's members (live proxy of backend membership)",
        "x-required-capability": "members:read"
      }
    },
    "/api/v1/orgs/{org}/groups/{group}/policy/destination": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/destinationPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author destination policy at group scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/groups/{group}/policy/exec": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/execPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the operator-exec-access capability at group scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/groups/{group}/policy/llm": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/llmPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author LLM governance policy at group scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/groups/{group}/policy/packs/{name}": {
      "delete": {
        "description": "Requires the `policy:write` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Uninstall a policy pack at group scope",
        "x-required-capability": "policy:write"
      },
      "post": {
        "description": "Requires the `policy:write` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/installPackView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Install a policy pack at group scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/groups/{group}/policy/ssh": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/sshPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the operator-SSH-access capability at group scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/groups/{group}/policy/tunnel": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/tunnelPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the interactive-access (tunnel) capability at group scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/groups/{group}/policy/tunnel/ports": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/tunnelPortsPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the interactive-access (tunnel) port allow-list at group scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/idp": {
      "delete": {
        "description": "Requires the `idp:manage` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Remove an org's upstream IdP federation",
        "x-required-capability": "idp:manage"
      },
      "get": {
        "description": "Requires the `idp:manage` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/idpConnectorView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Get an org's upstream IdP reference (never the secret)",
        "x-required-capability": "idp:manage"
      },
      "put": {
        "description": "Requires the `idp:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/idpConnectorReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/idpConnectorView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Configure an org's upstream IdP federation",
        "x-required-capability": "idp:manage"
      }
    },
    "/api/v1/orgs/{org}/policy/destination": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/destinationPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author destination policy at org scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/policy/exec": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/execPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the operator-exec-access capability at org scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/policy/llm": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/llmPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author LLM governance policy at org scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/policy/packs/{name}": {
      "delete": {
        "description": "Requires the `policy:write` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Uninstall a policy pack at org scope",
        "x-required-capability": "policy:write"
      },
      "post": {
        "description": "Requires the `policy:write` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/installPackView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Install a policy pack at org scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/policy/ssh": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/sshPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the operator-SSH-access capability at org scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/policy/tunnel": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/tunnelPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the interactive-access (tunnel) capability at org scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/policy/tunnel/ports": {
      "post": {
        "description": "Requires the `policy:write` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/tunnelPortsPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the interactive-access (tunnel) port allow-list at org scope",
        "x-required-capability": "policy:write"
      }
    },
    "/api/v1/orgs/{org}/principals/{sub}/effective": {
      "get": {
        "description": "Requires the `members:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/effectiveView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Effective capabilities a principal holds at an org (grants + membership)",
        "x-required-capability": "members:read"
      }
    },
    "/api/v1/orgs/{org}/roles": {
      "get": {
        "description": "Requires the `members:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/roleView"
                  },
                  "type": "array"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "List an org's custom roles",
        "x-required-capability": "members:read"
      },
      "post": {
        "description": "Requires the `roles:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/createRoleReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/roleView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Create a custom role (a bundle of existing capabilities)",
        "x-required-capability": "roles:manage"
      }
    },
    "/api/v1/orgs/{org}/roles/{role}": {
      "delete": {
        "description": "Requires the `roles:manage` capability.",
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Delete a custom role",
        "x-required-capability": "roles:manage"
      },
      "get": {
        "description": "Requires the `members:read` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/roleView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Get one custom role",
        "x-required-capability": "members:read"
      },
      "put": {
        "description": "Requires the `roles:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/putRoleReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/roleView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Replace a custom role's capability bundle",
        "x-required-capability": "roles:manage"
      }
    },
    "/api/v1/orgs/{org}/serviceaccounts": {
      "get": {
        "description": "Requires the `serviceaccounts:manage` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/serviceAccountView"
                  },
                  "type": "array"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "List an org's service accounts",
        "x-required-capability": "serviceaccounts:manage"
      },
      "post": {
        "description": "Requires the `serviceaccounts:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/createServiceAccountReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/serviceAccountCredentialView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "summary": "Create an org service account (returns its credential exactly once)",
        "x-required-capability": "serviceaccounts:manage"
      }
    },
    "/api/v1/orgs/{org}/serviceaccounts/self-service": {
      "post": {
        "description": "Requires the `org:read` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/createSelfServiceSAReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/serviceAccountCredentialView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "summary": "Create a self-service group-scoped service account (returns its credential exactly once)",
        "x-required-capability": "org:read"
      }
    },
    "/api/v1/orgs/{org}/serviceaccounts/{sa}": {
      "delete": {
        "responses": {
          "204": {
            "description": "No Content"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "summary": "Delete a service account and revoke all its grants (a self-service account is deletable by its owner or a serviceaccounts:manage holder)"
      },
      "get": {
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/serviceAccountView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Get one service account (a self-service account is visible to its owner or a serviceaccounts:manage holder)"
      }
    },
    "/api/v1/orgs/{org}/serviceaccounts/{sa}/grants": {
      "get": {
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "items": {
                    "$ref": "#/components/schemas/serviceAccountGrantView"
                  },
                  "type": "array"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "List a service account's grants (a self-service account's grants are visible to its owner or a serviceaccounts:manage holder)"
      },
      "post": {
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/createServiceAccountGrantReq"
              }
            }
          }
        },
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/serviceAccountGrantView"
                }
              }
            },
            "description": "Created"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "502": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Gateway"
          }
        },
        "summary": "Grant a role or capability to a service account (self-service accounts: capability only, bounded by the owner's delegation ceiling)"
      }
    },
    "/api/v1/orgs/{org}/serviceaccounts/{sa}/grants/{id}": {
      "delete": {
        "responses": {
          "204": {
            "description": "No Content"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Revoke a service account's grant (a self-service account's grants are revocable by its owner or a serviceaccounts:manage holder)"
      }
    },
    "/api/v1/orgs/{org}/serviceaccounts/{sa}/keys": {
      "post": {
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/serviceAccountKeyView"
                }
              }
            },
            "description": "Created"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          },
          "503": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "summary": "Rotate a service account's credential (returns the new credential exactly once; retires the old one; a self-service account's credential is rotatable by its owner or a serviceaccounts:manage holder)"
      }
    },
    "/api/v1/orgs/{org}/serviceaccounts/{sa}/transfer": {
      "post": {
        "description": "Requires the `serviceaccounts:manage` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/transferServiceAccountReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/serviceAccountView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Transfer a self-service service account to a new owner (later grant changes are bounded by the new owner's delegation ceiling)",
        "x-required-capability": "serviceaccounts:manage"
      }
    },
    "/api/v1/orgs/{org}/users/{sub}/offboard": {
      "post": {
        "description": "Requires the `members:manage` capability.",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/offboardUserView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Offboard a user: tear down their self-service service accounts (idempotent)",
        "x-required-capability": "members:manage"
      }
    },
    "/api/v1/policy/destination": {
      "post": {
        "description": "Requires the `platform:policy` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/destinationPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author destination policy at platform scope",
        "x-required-capability": "platform:policy"
      }
    },
    "/api/v1/policy/exec": {
      "post": {
        "description": "Requires the `platform:policy` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/execPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the operator-exec-access capability at platform scope",
        "x-required-capability": "platform:policy"
      }
    },
    "/api/v1/policy/llm": {
      "post": {
        "description": "Requires the `platform:policy` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/llmPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author LLM governance policy at platform scope",
        "x-required-capability": "platform:policy"
      }
    },
    "/api/v1/policy/packs": {
      "post": {
        "description": "Requires the `platform:policy` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/definePackReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/definePackView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Define a reusable policy pack in the shared catalog",
        "x-required-capability": "platform:policy"
      }
    },
    "/api/v1/policy/ssh": {
      "post": {
        "description": "Requires the `platform:policy` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/sshPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the operator-SSH-access capability at platform scope",
        "x-required-capability": "platform:policy"
      }
    },
    "/api/v1/policy/tunnel": {
      "post": {
        "description": "Requires the `platform:policy` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/tunnelPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the interactive-access (tunnel) capability at platform scope",
        "x-required-capability": "platform:policy"
      }
    },
    "/api/v1/policy/tunnel/ports": {
      "post": {
        "description": "Requires the `platform:policy` capability.",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/tunnelPortsPolicyReq"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/policyWriteView"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Bad Request"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "403": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Forbidden"
          },
          "404": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Not Found"
          },
          "409": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Conflict"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Author the interactive-access (tunnel) port allow-list at platform scope",
        "x-required-capability": "platform:policy"
      }
    },
    "/api/v1/whoami": {
      "get": {
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/whoamiView"
                }
              }
            },
            "description": "OK"
          },
          "401": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Unauthorized"
          },
          "500": {
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            },
            "description": "Internal Server Error"
          }
        },
        "summary": "Return the caller's identity and effective capabilities"
      }
    },
    "/healthz": {
      "get": {
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HealthView"
                }
              }
            },
            "description": "OK"
          }
        },
        "security": [],
        "summary": "Liveness/readiness probe"
      }
    },
    "/oauth/token": {
      "post": {
        "description": "Accepts an RFC 7523 jwt-bearer token request (grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer plus the signed assertion, form-encoded) and forwards it to the deployment's identity issuer, returning the issuer's response. Callers never contact the issuer directly. Fail-closed: the jwt-bearer grant is the only forwarded grant type; any other grant_type is refused locally with `unsupported_grant_type` and no upstream call. ERROR SHAPE EXCEPTION: responses on this route - including issuer errors, forwarded verbatim with the issuer's status code - are OAuth 2.0 error bodies (RFC 6749 §5.2: `error`, `error_description`), NOT RFC 9457 problem documents, so standard OAuth clients work unchanged. Successful responses carry `Cache-Control: no-store`. Unauthenticated by design (the assertion is the credential); the issuer verifies the assertion - the controlplane never stores, caches, or logs assertion or token material. Rate-limited.",
        "requestBody": {
          "content": {
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/TokenRequest"
              }
            }
          }
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenResponse"
                }
              }
            },
            "description": "OK"
          },
          "400": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenError"
                }
              }
            },
            "description": "Bad Request"
          },
          "429": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenError"
                }
              }
            },
            "description": "Too Many Requests"
          },
          "503": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TokenError"
                }
              }
            },
            "description": "Service Unavailable"
          }
        },
        "security": [],
        "summary": "Exchange a service-account assertion for an access token (token facade; the request is proxied to the identity issuer)"
      }
    }
  },
  "security": [
    {
      "bearerAuth": []
    }
  ]
}