{ "components": { "schemas": { "AuditRecord": { "properties": { "action": { "type": "string" }, "actor": { "type": "string" }, "actor_kind": { "type": "string" }, "agent_id": { "type": "string" }, "agent_name": { "type": "string" }, "attrs": { "additionalProperties": { "type": "string" }, "type": "object" }, "dst": { "type": "string" }, "dst_host": { "type": "string" }, "dst_ip": { "type": "string" }, "dst_port": { "maximum": 65535, "minimum": 0, "type": "integer" }, "enclave_id": { "type": "string" }, "enclave_name": { "type": "string" }, "event_time": { "format": "date-time", "type": "string" }, "group_id": { "type": "string" }, "identified": { "type": "boolean" }, "namespace": { "type": "string" }, "org_id": { "type": "string" }, "outcome": { "type": "string" }, "proto": { "type": "string" }, "reason": { "type": "string" }, "resource": { "type": "string" }, "scope": { "type": "string" }, "security_id": { "type": "string" }, "session_id": { "type": "string" }, "source": { "type": "string" }, "src": { "type": "string" }, "src_ip": { "type": "string" }, "trace_id": { "type": "string" } }, "type": "object" }, "HealthView": { "properties": { "component": { "type": "string" }, "status": { "type": "string" }, "version": { "type": "string" } }, "type": "object" }, "Problem": { "properties": { "detail": { "type": "string" }, "instance": { "type": "string" }, "status": { "type": "integer" }, "title": { "type": "string" }, "type": { "type": "string" } }, "type": "object" }, "RecordPage": { "properties": { "next_offset": { "type": "integer" }, "records": { "items": { "$ref": "#/components/schemas/AuditRecord" }, "type": "array" } }, "type": "object" }, "agentRuntimeListResp": { "properties": { "agents": { "items": { "$ref": "#/components/schemas/agentRuntimeView" }, "type": "array" } }, "type": "object" }, "agentRuntimeView": { "properties": { "agent_uid": { "type": "string" }, "detail": { "type": "string" }, "phase": { "type": "string" } }, "type": "object" }, "approvalDecisionReq": { "properties": { "decision": { "type": "string" } }, "type": "object" }, "approvalStreamEvent": { "properties": { "approval": { "$ref": "#/components/schemas/approvalView" }, "type": { "type": "string" } }, "type": "object" }, "approvalView": { "properties": { "agent_id": { "type": "string" }, "decided_at": { "format": "date-time", "type": "string" }, "decided_by": { "type": "string" }, "expires_at": { "format": "date-time", "type": "string" }, "format": { "type": "string" }, "group_id": { "type": "string" }, "id": { "type": "string" }, "model": { "type": "string" }, "org_id": { "type": "string" }, "provider": { "type": "string" }, "requested_at": { "format": "date-time", "type": "string" }, "status": { "type": "string" }, "tool_args": {}, "tool_name": { "type": "string" } }, "type": "object" }, "createEnclaveGrantReq": { "properties": { "capability": { "type": "string" }, "group": { "type": "string" }, "principal": { "type": "string" }, "role": { "type": "string" } }, "type": "object" }, "enclaveGrantView": { "properties": { "capability": { "type": "string" }, "group_id": { "type": "string" }, "id": { "format": "int64", "type": "integer" }, "org_id": { "type": "string" }, "principal": { "type": "string" }, "role": { "type": "string" }, "scope_kind": { "type": "string" } }, "type": "object" }, "isolationGateView": { "properties": { "capabilities": { "items": { "type": "string" }, "type": "array" }, "detail": { "type": "string" }, "driver": { "type": "string" }, "requested": { "type": "string" }, "status": { "type": "string" } }, "type": "object" }, "secretReq": { "properties": { "value": { "type": "string" } }, "type": "object" } }, "securitySchemes": { "bearerAuth": { "bearerFormat": "JWT", "scheme": "bearer", "type": "http" } } }, "info": { "description": "The enclave broker's authenticated operator API, fronted by the relay edge: sovereign secret authoring, enclave-local grant authoring, human-in-the-loop tool-call approvals (list, decide, SSE stream), plus the shared audit read API. Authorization is enclave-local — a JWT bearer from the deployment's identity issuer, validated in-enclave, never a controlplane dial — and an operator writes only within its own org (the org scope comes from the token, the coordinate from the path). Sovereign secret bytes are authored here and never leave the enclave. Errors are RFC 9457 problem documents. This document describes the full surface; a broker mounts a route family only when it owns the backing store (sovereign store, grant store, audit reader).", "title": "Daevix enclave (broker) operator API", "version": "v1" }, "openapi": "3.2.0", "paths": { "/api/v1/agents/{agent}/secrets/{name}": { "delete": { "responses": { "204": { "description": "No Content" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Delete an agent-scoped secret" }, "put": { "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/secretReq" } } } }, "responses": { "204": { "description": "No Content" }, "400": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Bad Request" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "409": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Conflict" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Author an agent-scoped sovereign secret" } }, "/api/v1/approvals": { "get": { "responses": { "200": { "content": { "application/json": { "schema": { "items": { "$ref": "#/components/schemas/approvalView" }, "type": "array" } } }, "description": "OK" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "List pending and recently resolved tool-call approvals for the caller's org" } }, "/api/v1/approvals/stream": { "get": { "responses": { "200": { "content": { "text/event-stream": { "itemSchema": { "$ref": "#/components/schemas/approvalStreamEvent" } } }, "description": "OK" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Live Server-Sent-Events feed of pending approvals and their decisions" } }, "/api/v1/approvals/{id}/decision": { "post": { "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/approvalDecisionReq" } } } }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/approvalView" } } }, "description": "OK" }, "400": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Bad Request" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "404": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Not Found" }, "409": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Conflict" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Approve or deny a pending tool-call approval; decided_by is the authenticated principal" } }, "/api/v1/audit/events": { "get": { "parameters": [ { "description": "Narrowing org filter, honored only for a cross-org (platform:audit:read) caller", "in": "query", "name": "org", "schema": { "type": "string" } }, { "description": "Restrict to one audit scope", "in": "query", "name": "scope", "schema": { "type": "string" } }, { "description": "Restrict to one agent id", "in": "query", "name": "agent_id", "schema": { "type": "string" } }, { "description": "Restrict to one action (e.g. inference.request)", "in": "query", "name": "action", "schema": { "type": "string" } }, { "description": "Restrict to one outcome (e.g. allow, deny)", "in": "query", "name": "outcome", "schema": { "type": "string" } }, { "description": "Restrict to one actor kind (human-operator, agent-operator, service)", "in": "query", "name": "actor_kind", "schema": { "type": "string" } }, { "description": "Network protocol; matches network_flow rows only", "in": "query", "name": "proto", "schema": { "type": "string" } }, { "description": "Destination host; matches network_flow rows only", "in": "query", "name": "dst_host", "schema": { "type": "string" } }, { "description": "Lower bound on event_time (RFC3339)", "in": "query", "name": "since", "schema": { "type": "string" } }, { "description": "Upper bound on event_time (RFC3339)", "in": "query", "name": "until", "schema": { "type": "string" } }, { "description": "Maximum rows to return", "in": "query", "name": "limit", "schema": { "type": "string" } }, { "description": "Row offset for pagination", "in": "query", "name": "offset", "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RecordPage" } } }, "description": "OK" }, "400": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Bad Request" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "List audit records (unified view, filtered + paginated) for the caller's org" } }, "/api/v1/audit/stream": { "get": { "parameters": [ { "description": "Narrowing org filter, honored only for a cross-org (platform:audit:read) caller", "in": "query", "name": "org", "schema": { "type": "string" } }, { "description": "Restrict to one audit scope", "in": "query", "name": "scope", "schema": { "type": "string" } }, { "description": "Restrict to one agent id", "in": "query", "name": "agent_id", "schema": { "type": "string" } }, { "description": "Restrict to one action (e.g. inference.request)", "in": "query", "name": "action", "schema": { "type": "string" } }, { "description": "Restrict to one outcome (e.g. allow, deny)", "in": "query", "name": "outcome", "schema": { "type": "string" } }, { "description": "Restrict to one actor kind (human-operator, agent-operator, service)", "in": "query", "name": "actor_kind", "schema": { "type": "string" } }, { "description": "Network protocol; matches network_flow rows only", "in": "query", "name": "proto", "schema": { "type": "string" } }, { "description": "Destination host; matches network_flow rows only", "in": "query", "name": "dst_host", "schema": { "type": "string" } }, { "description": "Lower bound on event_time (RFC3339)", "in": "query", "name": "since", "schema": { "type": "string" } }, { "description": "Upper bound on event_time (RFC3339)", "in": "query", "name": "until", "schema": { "type": "string" } }, { "description": "Maximum rows to return", "in": "query", "name": "limit", "schema": { "type": "string" } }, { "description": "Row offset for pagination", "in": "query", "name": "offset", "schema": { "type": "string" } } ], "responses": { "200": { "content": { "text/event-stream": { "itemSchema": { "$ref": "#/components/schemas/AuditRecord" } } }, "description": "OK" }, "400": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Bad Request" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Live Server-Sent-Events tail of audit records (same filters) for the caller's org" } }, "/api/v1/grants": { "get": { "description": "Requires the `members:read` capability.", "responses": { "200": { "content": { "application/json": { "schema": { "items": { "$ref": "#/components/schemas/enclaveGrantView" }, "type": "array" } } }, "description": "OK" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "List this org's enclave-local grants", "x-required-capability": "members:read" }, "post": { "description": "Requires the `members:manage` capability.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/createEnclaveGrantReq" } } } }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/enclaveGrantView" } } }, "description": "Created" }, "400": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Bad Request" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Author an enclave-local role or capability grant", "x-required-capability": "members:manage" } }, "/api/v1/grants/{id}": { "delete": { "description": "Requires the `members:manage` capability.", "responses": { "204": { "description": "No Content" }, "400": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Bad Request" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "404": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Not Found" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Revoke an enclave-local grant", "x-required-capability": "members:manage" } }, "/api/v1/groups/{group}/secrets/{name}": { "delete": { "responses": { "204": { "description": "No Content" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Delete a group-scoped secret" }, "put": { "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/secretReq" } } } }, "responses": { "204": { "description": "No Content" }, "400": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Bad Request" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "409": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Conflict" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Author a group-scoped sovereign secret" } }, "/api/v1/secrets/{name}": { "delete": { "responses": { "204": { "description": "No Content" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Delete an org-scoped secret" }, "put": { "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/secretReq" } } } }, "responses": { "204": { "description": "No Content" }, "400": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Bad Request" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "409": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Conflict" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Author an org-scoped sovereign secret" } }, "/api/v1/status/agents": { "get": { "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/agentRuntimeListResp" } } }, "description": "OK" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "List observed agent runtime states (drift visibility)" } }, "/api/v1/status/isolation": { "get": { "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/isolationGateView" } } }, "description": "OK" }, "401": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Unauthorized" }, "403": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Forbidden" }, "500": { "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } }, "description": "Internal Server Error" } }, "summary": "Isolation gate verdict for the enclave's requested isolation class (VAL-ISO-004)" } }, "/healthz": { "get": { "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HealthView" } } }, "description": "OK" } }, "security": [], "summary": "Liveness/readiness probe" } } }, "security": [ { "bearerAuth": [] } ] }