{"components":{"requestBodies":{"request.BatchDispositionRequest":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BatchDispositionRequest"}}},"description":"Item IDs","required":true},"request.BulkAlertRequest":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BulkAlertRequest"}}},"description":"Alert IDs","required":true},"request.BulkSetDispositionRequest":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BulkSetDispositionRequest"}}},"description":"Item IDs, disposition and note","required":true},"request.SetDispositionRequest":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.SetDispositionRequest"}}},"description":"Disposition, note and optional version","required":true}},"responses":{"APIKeyForbidden":{"content":{"application/json":{"examples":{"api_key_not_allowed":{"summary":"API keys cannot call this endpoint","value":{"code":"api_key_not_allowed","error":"this endpoint is not available to API keys"}},"insufficient_permissions":{"summary":"The key lacks the permission this endpoint needs","value":{"code":"insufficient_permissions","error":"insufficient permissions"}},"ip_not_allowed":{"summary":"Request from an IP outside the key's allowlist","value":{"code":"ip_not_allowed","error":"request not allowed from this IP address"}},"plan_limit":{"summary":"The tenant's plan does not include the requested feature","value":{"code":"plan_limit","current_plan":"starter","current_usage":0,"error":"feature not available on current plan","limit_type":"feature_not_available","max_allowed":0,"required_plan":"professional","upgrade_required":true,"upgrade_url":""}},"tenant_suspended":{"summary":"The tenant is suspended","value":{"code":"tenant_suspended","error":"tenant suspended"}}},"schema":{"oneOf":[{"$ref":"#/components/schemas/response.Error"},{"$ref":"#/components/schemas/response.PlanLimitError"}]}}},"description":"Forbidden. The code field says why: insufficient_permissions (the key lacks the permission named in x-api-key-permission), api_key_not_allowed (API keys cannot call this endpoint), plan_limit (the tenant's plan does not include API keys, and the body has no limit_type; or the request hit a feature or usage limit of the plan, which limit_type names), tenant_suspended (the tenant is suspended), ip_not_allowed (the key is restricted to certain IP addresses and this request came from another one). An endpoint may name other codes in its description."},"APIKeyRateLimited":{"content":{"application/json":{"schema":{"properties":{"code":{"example":"rate_limit_exceeded","type":"string"},"message":{"example":"Too many requests. Please try again later.","type":"string"}},"type":"object"}}},"description":"Too many requests for this API key. Wait the number of seconds in the Retry-After header, then retry.","headers":{"Retry-After":{"description":"Seconds to wait before retrying.","schema":{"type":"integer"}}}},"APIKeyUnauthorized":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Authentication failed: the API key is missing, malformed, unknown, revoked or expired."}},"schemas":{"entity.AIAgent":{"properties":{"agent_created_at":{"type":"string"},"agent_type":{"$ref":"#/components/schemas/entity.AIAgentType"},"ai_review_item_id":{"type":"string"},"approval_status":{"$ref":"#/components/schemas/entity.AIReviewStatus"},"autonomy_level":{"$ref":"#/components/schemas/entity.AutonomyLevel"},"blast_radius":{"$ref":"#/components/schemas/entity.BlastRadius"},"capabilities":{"items":{"$ref":"#/components/schemas/entity.AgentCapability"},"type":"array"},"connector_id":{"type":"string"},"created_at":{"type":"string"},"created_by":{"type":"string"},"data_scopes":{"items":{"$ref":"#/components/schemas/entity.AgentDataScope"},"type":"array"},"description":{"type":"string"},"finding_ids":{"items":{"type":"string"},"type":"array"},"first_seen_at":{"type":"string"},"id":{"type":"string"},"last_active_at":{"type":"string"},"last_remediated_at":{"description":"LastRemediatedAt is a computed field populated when include=last_remediated is requested.","type":"string"},"last_seen_at":{"type":"string"},"name":{"type":"string"},"owner_active":{"type":"boolean"},"owner_email":{"type":"string"},"owner_id":{"type":"string"},"permissions":{"items":{"$ref":"#/components/schemas/entity.AgentPermission"},"type":"array"},"platform":{"$ref":"#/components/schemas/entity.AIAgentPlatform"},"platform_id":{"type":"string"},"publisher":{"type":"string"},"resource_ids":{"items":{"type":"string"},"type":"array"},"risk_confidence":{"$ref":"#/components/schemas/entity.RiskConfidence"},"risk_factors":{"items":{"$ref":"#/components/schemas/entity.AgentRiskFactor"},"type":"array"},"risk_score":{"type":"integer"},"stale_at":{"type":"string"},"tenant_id":{"type":"string"},"third_party_app_id":{"type":"string"},"tool_bindings":{"items":{"$ref":"#/components/schemas/entity.AgentToolBinding"},"type":"array"},"updated_at":{"type":"string"},"version":{"type":"string"}},"type":"object"},"entity.AIAgentPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.AIAgent"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.AIAgentPlatform":{"enum":["copilot","gemini","n8n","langsmith","bedrock","bedrock_agentcore","anthropic","openai","cloudflare_ai","mistral","dust","salesforce","unknown"],"type":"string","x-enum-varnames":["AIAgentPlatformCopilot","AIAgentPlatformGemini","AIAgentPlatformN8N","AIAgentPlatformLangSmith","AIAgentPlatformBedrock","AIAgentPlatformBedrockAgentCore","AIAgentPlatformAnthropic","AIAgentPlatformOpenAI","AIAgentPlatformCloudflareAI","AIAgentPlatformMistral","AIAgentPlatformDust","AIAgentPlatformSalesforce","AIAgentPlatformUnknown"]},"entity.AIAgentSummary":{"properties":{"approved":{"type":"integer"},"blocked":{"type":"integer"},"critical":{"type":"integer"},"needs_review":{"type":"integer"},"orphaned":{"type":"integer"},"total":{"type":"integer"}},"type":"object"},"entity.AIAgentType":{"enum":["assistant","workflow","extension","custom_agent","managed_agent","unknown"],"type":"string","x-enum-varnames":["AIAgentTypeAssistant","AIAgentTypeWorkflow","AIAgentTypeExtension","AIAgentTypeCustomAgent","AIAgentTypeManagedAgent","AIAgentTypeUnknown"]},"entity.AIDataExposure":{"properties":{"apps":{"items":{"$ref":"#/components/schemas/entity.AIDataExposureApp"},"type":"array"},"data_scope":{"type":"string"}},"type":"object"},"entity.AIDataExposureApp":{"properties":{"app_id":{"type":"string"},"app_name":{"type":"string"},"risk":{"type":"string"},"user_count":{"type":"integer"}},"type":"object"},"entity.AIReviewDecision":{"properties":{"actor_email":{"type":"string"},"actor_id":{"type":"string"},"ai_review_item_id":{"type":"string"},"created_at":{"type":"string"},"event_type":{"type":"string"},"from_status":{"$ref":"#/components/schemas/entity.AIReviewStatus"},"id":{"type":"string"},"metadata":{"additionalProperties":{},"type":"object"},"reason":{"type":"string"},"tenant_id":{"type":"string"},"to_status":{"$ref":"#/components/schemas/entity.AIReviewStatus"}},"type":"object"},"entity.AIReviewEvidencePackage":{"properties":{"decisions":{"items":{"$ref":"#/components/schemas/entity.AIReviewDecision"},"type":"array"},"item":{"$ref":"#/components/schemas/entity.AIReviewItem"}},"type":"object"},"entity.AIReviewItem":{"properties":{"aging_days":{"type":"integer"},"archived_at":{"type":"string"},"changed_since_review":{"type":"boolean"},"created_at":{"type":"string"},"decision_reason":{"type":"string"},"evidence":{"additionalProperties":{},"type":"object"},"evidence_hash":{"type":"string"},"first_seen_at":{"type":"string"},"id":{"type":"string"},"last_seen_at":{"type":"string"},"object_type":{"$ref":"#/components/schemas/entity.AIReviewObjectType"},"owner_email":{"type":"string"},"owner_id":{"type":"string"},"priority_reasons":{"items":{"type":"string"},"type":"array"},"priority_score":{"type":"integer"},"provider":{"type":"string"},"reviewed_at":{"type":"string"},"reviewed_by":{"type":"string"},"source_connector_id":{"type":"string"},"source_finding_id":{"type":"string"},"source_id":{"type":"string"},"source_type":{"$ref":"#/components/schemas/entity.AIReviewSourceType"},"stale_at":{"type":"string"},"status":{"$ref":"#/components/schemas/entity.AIReviewStatus"},"subtitle":{"type":"string"},"tenant_id":{"type":"string"},"title":{"type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.AIReviewObjectType":{"enum":["shadow_ai_app","managed_ai_project","managed_ai_key","managed_ai_identity","managed_ai_usage_signal","ai_agent"],"type":"string","x-enum-varnames":["AIReviewObjectShadowAIApp","AIReviewObjectManagedAIProject","AIReviewObjectManagedAIKey","AIReviewObjectManagedAIIdentity","AIReviewObjectManagedAIUsage","AIReviewObjectAIAgent"]},"entity.AIReviewSourceType":{"enum":["third_party_app","finding","resource","synthetic"],"type":"string","x-enum-varnames":["AIReviewSourceThirdPartyApp","AIReviewSourceFinding","AIReviewSourceResource","AIReviewSourceSynthetic"]},"entity.AIReviewStatus":{"enum":["discovered","approved","flagged","blocked","archived"],"type":"string","x-enum-varnames":["AIReviewStatusDiscovered","AIReviewStatusApproved","AIReviewStatusFlagged","AIReviewStatusBlocked","AIReviewStatusArchived"]},"entity.AIReviewSummary":{"properties":{"approved":{"type":"integer"},"blocked":{"type":"integer"},"critical_high":{"type":"integer"},"needs_review":{"type":"integer"},"new_this_week":{"type":"integer"},"overdue":{"type":"integer"},"stale":{"type":"integer"},"unknown_owner":{"type":"integer"}},"type":"object"},"entity.AIRiskSummary":{"properties":{"by_subcategory":{"additionalProperties":{"type":"integer"},"type":"object"},"high_risk_ai_apps":{"type":"integer"},"top_ai_apps_by_users":{"items":{"$ref":"#/components/schemas/entity.ThirdPartyApp"},"type":"array"},"total_ai_apps":{"type":"integer"},"trains_on_data_count":{"type":"integer"},"week_over_week":{"$ref":"#/components/schemas/entity.AITrend"}},"type":"object"},"entity.AISecurityAgentSummary":{"properties":{"by_autonomy":{"additionalProperties":{"type":"integer"},"type":"object"},"by_platform":{"additionalProperties":{"type":"integer"},"type":"object"},"by_risk_tier":{"additionalProperties":{"type":"integer"},"type":"object"},"by_status":{"additionalProperties":{"type":"integer"},"type":"object"},"total_agents":{"type":"integer"}},"type":"object"},"entity.AISecurityAutoRemediationStats":{"properties":{"cooldown_skipped_last_7d":{"type":"integer"},"rate_limited_last_7d":{"type":"integer"},"rules_enabled":{"type":"integer"},"triggered_last_7d":{"type":"integer"}},"type":"object"},"entity.AISecurityDashboard":{"properties":{"ai_risk":{"$ref":"#/components/schemas/entity.AIRiskSummary"},"auto_remediation_stats":{"$ref":"#/components/schemas/entity.AISecurityAutoRemediationStats"},"data_exposure":{"items":{"$ref":"#/components/schemas/entity.AIDataExposure"},"type":"array"},"governance_status":{"$ref":"#/components/schemas/entity.ThirdPartyAppSummary"},"recent_remediations":{"items":{"$ref":"#/components/schemas/entity.AISecurityRecentRemediation"},"type":"array"},"risk_trends":{"items":{"$ref":"#/components/schemas/entity.AISecurityRiskTrend"},"type":"array"},"summary":{"$ref":"#/components/schemas/entity.AISecurityAgentSummary"},"top_risk_agents":{"items":{"$ref":"#/components/schemas/entity.AISecurityTopRiskAgent"},"type":"array"}},"type":"object"},"entity.AISecurityRecentRemediation":{"properties":{"agent_count":{"type":"integer"},"created_at":{"type":"string"},"governance_rule_name":{"type":"string"},"playbook_id":{"type":"string"},"run_id":{"type":"string"},"status":{"type":"string"},"trigger_type":{"type":"string"}},"type":"object"},"entity.AISecurityRiskTrend":{"properties":{"avg_risk":{"type":"integer"},"critical_count":{"type":"integer"},"date":{"type":"string"},"high_count":{"type":"integer"},"total_agents":{"type":"integer"}},"type":"object"},"entity.AISecurityTopRiskAgent":{"properties":{"approval_status":{"type":"string"},"blast_radius":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string"},"risk_score":{"type":"integer"}},"type":"object"},"entity.AITrend":{"properties":{"new_apps":{"description":"7-day (existing)","type":"integer"},"new_apps_30d":{"type":"integer"},"new_apps_60d":{"type":"integer"},"new_apps_90d":{"type":"integer"}},"type":"object"},"entity.ActionStatus":{"enum":["pending","sent","failed","skipped","drafted","ticketed","closed"],"type":"string","x-enum-varnames":["ActionStatusPending","ActionStatusSent","ActionStatusFailed","ActionStatusSkipped","ActionStatusDrafted","ActionStatusTicketed","ActionStatusClosed"]},"entity.ActionType":{"enum":["nudge_owner","create_ticket","flag_agent"],"type":"string","x-enum-varnames":["ActionTypeNudgeOwner","ActionTypeCreateTicket","ActionTypeFlagAgent"]},"entity.ActivityItem":{"properties":{"actor":{"type":"string"},"event_type":{"type":"string"},"id":{"type":"string"},"metadata":{"additionalProperties":{},"type":"object"},"occurred_at":{"type":"string"},"resource_id":{"type":"string"},"resource_type":{"type":"string"},"source":{"$ref":"#/components/schemas/entity.ActivitySource"},"summary":{"type":"string"}},"type":"object"},"entity.ActivitySource":{"enum":["audit","policy"],"type":"string","x-enum-varnames":["ActivitySourceAudit","ActivitySourcePolicy"]},"entity.AgentCapability":{"properties":{"action":{"type":"string"},"constrained":{"type":"boolean"},"target":{"type":"string"}},"type":"object"},"entity.AgentDataScope":{"properties":{"access":{"type":"string"},"data_type":{"type":"string"},"volume":{"type":"string"}},"type":"object"},"entity.AgentGovernanceRule":{"properties":{"cooldown_hours":{"type":"integer"},"created_at":{"type":"string"},"description":{"type":"string"},"enabled":{"type":"boolean"},"expression":{"type":"string"},"id":{"type":"string"},"last_error_at":{"type":"string"},"last_error_msg":{"type":"string"},"name":{"type":"string"},"playbook_id":{"type":"string"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.AgentGovernanceRuleTestMatch":{"properties":{"agent_id":{"type":"string"},"agent_name":{"type":"string"},"blast_radius":{"type":"string"},"platform":{"type":"string"},"risk_score":{"type":"integer"},"skip_reason":{"type":"string"},"would_fire":{"type":"boolean"}},"type":"object"},"entity.AgentGovernanceRuleTestResult":{"properties":{"matched_agents":{"items":{"$ref":"#/components/schemas/entity.AgentGovernanceRuleTestMatch"},"type":"array"},"total_matched":{"type":"integer"},"would_fire":{"type":"integer"},"would_skip":{"type":"integer"}},"type":"object"},"entity.AgentPermission":{"properties":{"granted_at":{"type":"string"},"scope":{"type":"string"},"sensitivity":{"type":"string"},"source":{"type":"string"}},"type":"object"},"entity.AgentRiskFactor":{"properties":{"detail":{"type":"string"},"factor":{"type":"string"},"weight":{"type":"integer"}},"type":"object"},"entity.AgentToolBinding":{"properties":{"access_level":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string"},"type":{"type":"string"}},"type":"object"},"entity.AgingBucket":{"properties":{"bucket":{"type":"string"},"count":{"type":"integer"}},"type":"object"},"entity.Alert":{"properties":{"acknowledged_at":{"type":"string"},"acknowledged_by":{"type":"string"},"alert_rule_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"},"connector_id":{"example":"550e8400-e29b-41d4-a716-446655440003","type":"string"},"connector_name":{"example":"Production Okta","type":"string"},"connector_type":{"allOf":[{"$ref":"#/components/schemas/entity.ConnectorType"}],"example":"okta"},"created_at":{"type":"string"},"exception_id":{"type":"string"},"finding_count":{"example":5,"type":"integer"},"id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"resolved_at":{"type":"string"},"resolved_by":{"type":"string"},"scan_id":{"example":"550e8400-e29b-41d4-a716-446655440002","type":"string"},"severity":{"allOf":[{"$ref":"#/components/schemas/entity.Severity"}],"example":"critical"},"severity_counts":{"$ref":"#/components/schemas/entity.SeverityCounts"},"snooze_mode":{"$ref":"#/components/schemas/entity.SnoozeMode"},"snoozed_until":{"type":"string"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.AlertStatus"}],"example":"open"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.AlertPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.Alert"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.AlertRule":{"properties":{"connector_ids":{"items":{"type":"string"},"type":"array"},"created_at":{"type":"string"},"deliver_email":{"example":false,"type":"boolean"},"deliver_slack":{"example":true,"type":"boolean"},"enabled":{"example":true,"type":"boolean"},"expression":{"type":"string"},"id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"last_error_at":{"type":"string"},"last_error_message":{"type":"string"},"mode":{"allOf":[{"$ref":"#/components/schemas/entity.AlertRuleMode"}],"example":"scan"},"name":{"example":"Critical MFA violations","type":"string"},"policy_categories":{"items":{"type":"string"},"type":"array"},"severity_threshold":{"allOf":[{"$ref":"#/components/schemas/entity.Severity"}],"example":"high"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"threshold_days":{"example":90,"type":"integer"},"trigger_events":{"description":"TriggerEvents constrains which scan lifecycle events activate this rule.\nAn empty slice fires on completion events only (scan_completed and\nscan_completed_with_warnings); non-completion events such as\ndrift_detected require explicit opt-in by listing them here. Stored in\nalert_rules.trigger_events.","items":{"$ref":"#/components/schemas/entity.ScanAlertEvent"},"type":"array"},"updated_at":{"type":"string"},"version":{"example":1,"type":"integer"}},"type":"object"},"entity.AlertRuleMode":{"enum":["scan","scheduled"],"type":"string","x-enum-varnames":["AlertRuleModeScan","AlertRuleModeScheduled"]},"entity.AlertStatus":{"enum":["open","acknowledged","snoozed","resolved"],"type":"string","x-enum-varnames":["AlertStatusOpen","AlertStatusAcknowledged","AlertStatusSnoozed","AlertStatusResolved"]},"entity.AlertStatusCounts":{"properties":{"acknowledged":{"type":"integer"},"open":{"type":"integer"},"resolved":{"type":"integer"},"snoozed":{"type":"integer"}},"type":"object"},"entity.AppGovernanceRule":{"properties":{"action":{"type":"string"},"auto_create_finding":{"type":"boolean"},"create_ai_review_item":{"type":"boolean"},"created_at":{"type":"string"},"created_by":{"type":"string"},"enabled":{"type":"boolean"},"expression":{"type":"string"},"id":{"type":"string"},"last_error_at":{"type":"string"},"last_error_message":{"type":"string"},"match_type":{"type":"string"},"match_value":{"type":"string"},"name":{"type":"string"},"notify_channels":{"items":{"type":"string"},"type":"array"},"notify_on_discovery":{"type":"boolean"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.ApprovalChain":{"properties":{"created_at":{"type":"string"},"enabled":{"type":"boolean"},"id":{"type":"string"},"name":{"type":"string"},"priority":{"type":"integer"},"request_type":{"type":"string"},"severity_filter":{"items":{"type":"string"},"type":"array"},"steps":{"items":{"$ref":"#/components/schemas/entity.ApprovalStep"},"type":"array"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.ApprovalStep":{"properties":{"approver_email":{"type":"string"},"delegate_email":{"type":"string"},"on_timeout":{"type":"string"},"order":{"type":"integer"},"required":{"type":"boolean"},"timeout_hours":{"type":"integer"}},"type":"object"},"entity.AssigneeMetrics":{"properties":{"assigned":{"type":"integer"},"email":{"type":"string"},"id":{"type":"string"},"mttr_hours":{"type":"number"},"overdue":{"type":"integer"},"resolved_7d":{"type":"integer"}},"type":"object"},"entity.AuditAction":{"enum":["create","update","delete","revoke","test_connection","test_webhook","start_scan","update_status","bulk_update_status","bulk_test_connection","bulk_start_scan","cancel_scan","bulk_cancel_scan","login","logout","provision","health_check_failed","health_check_recovered","approve","reject","delegate","request_revocation","ticketing.integration.configured","ticketing.integration.updated","ticketing.integration.deleted","ticketing.ticket.created","ticketing.ticket.unlinked","ticketing.ticket.synced","subscribe","unsubscribe","upgrade","downgrade","pause","resume","cancel_downgrade","mfa_enabled","mfa_disabled","mfa_enrolled","mfa_removed","schedule_disabled","restore","assign","bulk_assign","preview_playbook","execute_remediation","update_notification_settings","auto_remediation_triggered","auto_remediation_duplicate","auto_remediation_cooldown","auto_remediation_rate_limited","auto_remediation_error","auto_remediation_blocked","test_notification_channel","submit_feedback","launch","close","decide","sign_off","download","expire","rotate"],"type":"string","x-enum-varnames":["AuditActionCreate","AuditActionUpdate","AuditActionDelete","AuditActionRevoke","AuditActionTestConnection","AuditActionTestWebhook","AuditActionStartScan","AuditActionUpdateStatus","AuditActionBulkUpdateStatus","AuditActionBulkTestConnection","AuditActionBulkStartScan","AuditActionCancelScan","AuditActionBulkCancelScan","AuditActionLogin","AuditActionLogout","AuditActionProvision","AuditActionHealthCheckFailed","AuditActionHealthCheckRecovered","AuditActionApprove","AuditActionReject","AuditActionDelegate","AuditActionRequestRevocation","AuditActionTicketingConfigure","AuditActionTicketingUpdate","AuditActionTicketingDelete","AuditActionTicketCreate","AuditActionTicketUnlink","AuditActionTicketSync","AuditActionSubscribe","AuditActionUnsubscribe","AuditActionUpgrade","AuditActionDowngrade","AuditActionPause","AuditActionResume","AuditActionCancelDowngrade","AuditActionMFAEnabled","AuditActionMFADisabled","AuditActionMFAEnrolled","AuditActionMFARemoved","AuditActionScheduleDisabled","AuditActionRestore","AuditActionAssign","AuditActionBulkAssign","AuditActionPreviewPlaybook","AuditActionExecuteRemediation","AuditActionUpdateNotificationSettings","AuditActionAutoRemediationTriggered","AuditActionAutoRemediationDuplicate","AuditActionAutoRemediationCooldown","AuditActionAutoRemediationRateLimited","AuditActionAutoRemediationError","AuditActionAutoRemediationBlocked","AuditActionTestNotificationChannel","AuditActionSubmitFeedback","AuditActionLaunch","AuditActionClose","AuditActionDecide","AuditActionSignOff","AuditActionDownload","AuditActionExpire","AuditActionRotate"]},"entity.AuditEvent":{"properties":{"action":{"allOf":[{"$ref":"#/components/schemas/entity.AuditAction"}],"example":"create"},"actor_email":{"example":"admin@example.com","type":"string"},"actor_id":{"example":"user-001","type":"string"},"created_at":{"type":"string"},"id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"ip_address":{"example":"192.168.1.1","type":"string"},"metadata":{"type":"object"},"resource_id":{"example":"550e8400-e29b-41d4-a716-446655440002","type":"string"},"resource_type":{"allOf":[{"$ref":"#/components/schemas/entity.AuditResourceType"}],"example":"connector"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"}},"type":"object"},"entity.AuditEventPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.AuditEvent"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.AuditExport":{"properties":{"created_at":{"type":"string"},"error":{"type":"string"},"event_count":{"example":500,"type":"integer"},"expires_at":{"type":"string"},"file_name":{"example":"audit-export-2026-03-03.ndjson","type":"string"},"file_size":{"example":102400,"type":"integer"},"filters":{"$ref":"#/components/schemas/entity.AuditExportFilter"},"id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.AuditExportStatus"}],"example":"completed"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"}},"type":"object"},"entity.AuditExportFilter":{"properties":{"action":{"type":"string"},"actor_id":{"type":"string"},"resource_type":{"type":"string"},"since":{"type":"string"},"until":{"type":"string"}},"type":"object"},"entity.AuditExportStatus":{"enum":["pending","processing","completed","failed"],"type":"string","x-enum-varnames":["AuditExportStatusPending","AuditExportStatusProcessing","AuditExportStatusCompleted","AuditExportStatusFailed"]},"entity.AuditReadiness":{"properties":{"coverage_score":{"description":"mapped leaf controls / total leaf * 100","type":"number"},"framework_id":{"type":"string"},"framework_name":{"type":"string"},"mapped_controls":{"type":"integer"},"persistent_failures":{"items":{"$ref":"#/components/schemas/entity.PersistentFailure"},"type":"array"},"posture_score":{"description":"passed / assessed * 100; nil when nothing is assessed","type":"number"},"readiness_score":{"description":"coverage * posture / 100; nil when posture is not assessed","type":"number"},"recent_regressions":{"items":{"$ref":"#/components/schemas/entity.ControlRegression"},"type":"array"},"suggested_mappings":{"items":{"$ref":"#/components/schemas/entity.MappingSuggestion"},"type":"array"},"total_controls":{"type":"integer"},"unmapped_controls":{"items":{"$ref":"#/components/schemas/entity.GapControl"},"type":"array"}},"type":"object"},"entity.AuditResourceType":{"enum":["connector","scan","finding","policy","identity","report","alert_rule","scan_schedule","compliance_control","exception","tenant","tenant_invite","tenant_sso","audit_export","third_party_app","tenant_policy","policy_override","tenant_member","finding_export","finding_comment","saved_view","approval_chain","report_schedule","governance_rule","ticketing_integration","ticket_link","subscription","tenant_mfa","user_mfa","alert","tenant_delivery","compliance_framework","severity_override","ai_review_item","sla_policy","geo_policy","ai_agent","remediation_run","notification_settings","agent_governance_rule","resource","feedback","review_campaign","review_item","reviewer_grant","control_attestation","content_scan_consent","login_source","api_key"],"type":"string","x-enum-varnames":["AuditResourceConnector","AuditResourceScan","AuditResourceFinding","AuditResourcePolicy","AuditResourceIdentity","AuditResourceReport","AuditResourceAlertRule","AuditResourceScanSchedule","AuditResourceComplianceControl","AuditResourceException","AuditResourceTenant","AuditResourceTenantInvite","AuditResourceTenantSSO","AuditResourceAuditExport","AuditResourceThirdPartyApp","AuditResourceTenantPolicy","AuditResourcePolicyOverride","AuditResourceTenantMember","AuditResourceFindingExport","AuditResourceFindingComment","AuditResourceSavedView","AuditResourceApprovalChain","AuditResourceReportSchedule","AuditResourceGovernanceRule","AuditResourceTicketingIntegration","AuditResourceTicketLink","AuditResourceSubscription","AuditResourceTenantMFA","AuditResourceUserMFA","AuditResourceAlert","AuditResourceTenantDelivery","AuditResourceComplianceFramework","AuditResourceSeverityOverride","AuditResourceAIReviewItem","AuditResourceSLAPolicy","AuditResourceGeoPolicy","AuditResourceAIAgent","AuditResourceRemediationRun","AuditResourceNotificationSettings","AuditResourceAgentGovernanceRule","AuditResourceResource","AuditResourceFeedback","AuditResourceReviewCampaign","AuditResourceReviewItem","AuditResourceReviewerGrant","AuditResourceAttestation","AuditResourceContentScanConsent","AuditResourceLoginSource","AuditResourceAPIKey"]},"entity.AutonomyLevel":{"enum":["unknown","human_in_loop","supervised","semi_autonomous","fully_autonomous"],"type":"string","x-enum-varnames":["AutonomyLevelUnknown","AutonomyLevelHumanInLoop","AutonomyLevelSupervised","AutonomyLevelSemiAutonomous","AutonomyLevelFullyAutonomous"]},"entity.BatchError":{"properties":{"id":{"type":"string"},"reason":{"type":"string"}},"type":"object"},"entity.BlastRadius":{"enum":["unknown","low","medium","high","critical"],"type":"string","x-enum-varnames":["BlastRadiusUnknown","BlastRadiusLow","BlastRadiusMedium","BlastRadiusHigh","BlastRadiusCritical"]},"entity.BlastRadiusGraph":{"properties":{"edges":{"items":{"$ref":"#/components/schemas/entity.GraphEdge"},"type":"array"},"nodes":{"items":{"$ref":"#/components/schemas/entity.GraphNode"},"type":"array"},"reach_summary":{"$ref":"#/components/schemas/entity.ReachSummary"}},"type":"object"},"entity.CampaignStep":{"properties":{"admin_url":{"type":"string"},"connector_name":{"type":"string"},"connector_type":{"type":"string"},"difficulty":{"type":"string"},"steps":{"items":{"type":"string"},"type":"array"}},"type":"object"},"entity.CancelResult":{"properties":{"error":{"type":"string"},"scan_id":{"type":"string"},"status":{"type":"string"}},"type":"object"},"entity.CanonicalAppRollup":{"properties":{"connector_count":{"type":"integer"},"display_name":{"type":"string"},"id":{"type":"string"},"max_risk":{"type":"string"},"member_count":{"type":"integer"},"source":{"type":"string"},"tenant_id":{"type":"string"},"user_reach":{"type":"integer"},"vendor_key":{"type":"string"}},"type":"object"},"entity.CanonicalAppRollupPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.CanonicalAppRollup"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.CanonicalPerson":{"properties":{"account_count":{"type":"integer"},"confidence":{"$ref":"#/components/schemas/entity.MatchConfidence"},"display_name":{"type":"string"},"failed_checks_count":{"type":"integer"},"id":{"type":"string"},"job_title":{"type":"string"},"max_risk_score":{"type":"number"},"primary_email":{"type":"string"},"privileged_anywhere":{"type":"boolean"},"privileged_count":{"type":"integer"}},"type":"object"},"entity.CanonicalPersonCursorResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.CanonicalPerson"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.CursorMeta"}},"type":"object"},"entity.CompareBucket":{"enum":["new","unchanged","resolved"],"type":"string","x-enum-varnames":["CompareNew","CompareUnchanged","CompareResolved"]},"entity.ComplianceControl":{"properties":{"children":{"items":{"$ref":"#/components/schemas/entity.ComplianceControl"},"type":"array"},"control_id":{"example":"A.5.15","type":"string"},"description":{"example":"Policies and procedures for access control","type":"string"},"framework_id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"mapping_overridden":{"description":"MappingOverridden is true when the caller's tenant has overridden this built-in\ncontrol's policy mapping (omitted otherwise).","type":"boolean"},"name":{"example":"Access control","type":"string"},"parent_id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"policy_ids":{"items":{"type":"string"},"type":"array"},"sort_order":{"example":1,"type":"integer"}},"type":"object"},"entity.ComplianceFramework":{"properties":{"audit_date":{"description":"Target audit date; drives DaysUntilAudit on enriched summary","example":"2026-06-30T00:00:00Z","type":"string"},"created_at":{"example":"2026-02-25T10:00:00Z","type":"string"},"description":{"example":"Information security management systems","type":"string"},"enabled":{"example":true,"type":"boolean"},"id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"name":{"example":"ISO 27001:2022","type":"string"},"tenant_id":{"description":"Owning tenant (nil = global/seeded)","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"updated_at":{"example":"2026-02-25T10:00:00Z","type":"string"},"version":{"example":"2022","type":"string"}},"type":"object"},"entity.ComplianceRef":{"properties":{"control_id":{"description":"Control identifier within the framework","example":"1.1.2","type":"string"},"control_name":{"description":"Human-readable control name","example":"Ensure MFA is enabled for all IAM users","type":"string"},"finding_id":{"description":"Not populated: refs are derived from the finding's policy mapping, so this is always empty","type":"string"},"framework":{"description":"Compliance framework name","example":"CIS","type":"string"},"id":{"description":"UUID of the mapped control (compliance_controls.id); unique per ref within one finding","example":"3f2b8c1e-7a4d-4e9b-9c55-0d6a1e2f3b4c","type":"string"}},"type":"object"},"entity.ComplianceTrend":{"properties":{"category_trends":{"type":"object"},"control_deltas":{"items":{"$ref":"#/components/schemas/entity.ControlDelta"},"type":"array"},"data_points":{"items":{"$ref":"#/components/schemas/entity.TrendPoint"},"type":"array"},"direction":{"description":"improving, declining, stable","example":"improving","type":"string"},"end_score":{"example":84.1,"type":"number"},"framework_id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"framework_name":{"example":"SOC 2","type":"string"},"period":{"example":"90d","type":"string"},"score_change":{"example":11.7,"type":"number"},"start_score":{"example":72.4,"type":"number"}},"type":"object"},"entity.Connector":{"properties":{"created_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","type":"string"},"data_region":{"description":"Data residency region (eu, us, ap, global)","example":"eu","type":"string"},"dpa_signed_at":{"description":"When the DPA/BAA was signed","example":"2025-06-15T00:00:00Z","type":"string"},"dpa_status":{"description":"DPA/BAA status (signed, pending, not_required)","example":"signed","type":"string"},"fetch_mode":{"allOf":[{"$ref":"#/components/schemas/entity.FetchMode"}],"description":"Where resource fetching runs (origin or edge)","example":"origin"},"id":{"description":"Unique identifier","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"last_health_check_at":{"description":"Timestamp of the last health check","example":"2026-03-11T12:00:00Z","type":"string"},"last_health_error":{"description":"Last health check error (nil = healthy)","example":"connection refused","type":"string"},"last_sync_at":{"description":"Timestamp of the last successful sync","example":"2025-01-15T10:30:00Z","type":"string"},"mode":{"$ref":"#/components/schemas/entity.ConnectorMode"},"name":{"description":"Human-readable connector name","example":"Production Okta","type":"string"},"paused_by_system":{"description":"System-paused due to plan downgrade over-limit","example":false,"type":"boolean"},"posture_score":{"description":"Policy pass rate: percentage of enabled policies with no open findings","example":85.5,"type":"number"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.ConnectorStatus"}],"description":"Operational state (active, inactive, error, configuring)","example":"active"},"tenant_id":{"description":"Tenant that owns this connector","example":"tenant-abc-123","type":"string"},"type":{"allOf":[{"$ref":"#/components/schemas/entity.ConnectorType"}],"description":"SaaS platform type (okta, cloudflare, gcp, workspace)","example":"okta"},"updated_at":{"description":"Last update timestamp","example":"2025-01-10T12:00:00Z","type":"string"},"version":{"description":"Optimistic concurrency control version","example":1,"type":"integer"}},"type":"object"},"entity.ConnectorCoverage":{"properties":{"ai_app_count":{"type":"integer"},"app_count":{"type":"integer"},"connector_id":{"type":"string"},"connector_name":{"type":"string"},"connector_type":{"type":"string"},"last_scan_at":{"type":"string"},"supported":{"type":"boolean"}},"type":"object"},"entity.ConnectorFacet":{"properties":{"connector_id":{"type":"string"},"connector_name":{"type":"string"},"count":{"type":"integer"}},"type":"object"},"entity.ConnectorGuide":{"properties":{"connector_type":{"type":"string"},"description":{"type":"string"},"display_name":{"type":"string"},"doc_url":{"type":"string"},"estimated_minutes":{"type":"integer"},"estimated_scan_minutes":{"description":"EstimatedScanMinutes is the typical wall-clock of the first full scan, shown on the\n\"scan running\" step. 0 means unknown (\"a few minutes\").","type":"integer"},"required_fields":{"items":{"$ref":"#/components/schemas/entity.GuideField"},"type":"array"},"required_permissions":{"items":{"$ref":"#/components/schemas/entity.GuidePermission"},"type":"array"},"setup_steps":{"description":"SetupSteps is the ordered, copy-paste-able credential walkthrough shown above the\nconfig form. Optional: guides without it render as before.","items":{"$ref":"#/components/schemas/entity.GuideStep"},"type":"array"},"setup_url":{"type":"string"}},"type":"object"},"entity.ConnectorHealth":{"properties":{"active":{"type":"integer"},"error":{"type":"integer"},"stale":{"type":"integer"},"total":{"type":"integer"}},"type":"object"},"entity.ConnectorMode":{"enum":["read_only","read_write"],"type":"string","x-enum-varnames":["ConnectorModeReadOnly","ConnectorModeReadWrite"]},"entity.ConnectorStatus":{"enum":["active","inactive","error","configuring"],"type":"string","x-enum-varnames":["ConnectorStatusActive","ConnectorStatusInactive","ConnectorStatusError","ConnectorStatusConfiguring"]},"entity.ConnectorType":{"enum":["okta","cloudflare","gcp","workspace","openai","m365","github","gitlab","aws","atlassian","auth0","anthropic","zoom","teams","notion","datadog","sentry","slack","1password","lastpass","salesforce","servicenow","azure","docusign","grafana","grafana_cloud","cloudflare_access","pagerduty","incidentio","discord","generic","vercel","digitalocean","circleci","snowflake","shopify","ovhcloud","akamai","workato","box","dropbox","terraform_cloud","teleport","chrome_enterprise","google_ads","bedrock","n8n","langsmith","workday","dust","mistral","duo","jumpcloud","pingone","figma","jamf","huggingface","chatgpt_enterprise","bamboohr","hibob","personio","openrouter"],"type":"string","x-enum-varnames":["ConnectorTypeOkta","ConnectorTypeCloudflare","ConnectorTypeGCP","ConnectorTypeWorkspace","ConnectorTypeOpenAI","ConnectorTypeM365","ConnectorTypeGitHub","ConnectorTypeGitLab","ConnectorTypeAWS","ConnectorTypeAtlassian","ConnectorTypeAuth0","ConnectorTypeAnthropic","ConnectorTypeZoom","ConnectorTypeTeams","ConnectorTypeNotion","ConnectorTypeDatadog","ConnectorTypeSentry","ConnectorTypeSlack","ConnectorType1Password","ConnectorTypeLastPass","ConnectorTypeSalesforce","ConnectorTypeServiceNow","ConnectorTypeAzure","ConnectorTypeDocusign","ConnectorTypeGrafana","ConnectorTypeGrafanaCloud","ConnectorTypeCloudflareAccess","ConnectorTypePagerDuty","ConnectorTypeIncidentIO","ConnectorTypeDiscord","ConnectorTypeGeneric","ConnectorTypeVercel","ConnectorTypeDigitalOcean","ConnectorTypeCircleCI","ConnectorTypeSnowflake","ConnectorTypeShopify","ConnectorTypeOVHCloud","ConnectorTypeAkamai","ConnectorTypeWorkato","ConnectorTypeBox","ConnectorTypeDropbox","ConnectorTypeTerraformCloud","ConnectorTypeTeleport","ConnectorTypeChromeEnterprise","ConnectorTypeGoogleAds","ConnectorTypeBedrock","ConnectorTypeN8N","ConnectorTypeLangSmith","ConnectorTypeWorkday","ConnectorTypeDust","ConnectorTypeMistral","ConnectorTypeDuo","ConnectorTypeJumpCloud","ConnectorTypePingOne","ConnectorTypeFigma","ConnectorTypeJamf","ConnectorTypeHuggingFace","ConnectorTypeChatGPTEnterprise","ConnectorTypeBambooHR","ConnectorTypeHiBob","ConnectorTypePersonio","ConnectorTypeOpenRouter"]},"entity.ControlAttestation":{"properties":{"attested_at":{"example":"2026-07-19T10:00:00Z","type":"string"},"attested_by":{"example":"grc@example.com","type":"string"},"control_code":{"example":"NIS2-21.2.b","type":"string"},"control_db_id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"created_at":{"example":"2026-07-19T10:00:00Z","type":"string"},"evidence_file_name":{"example":"soc2-training-records.pdf","type":"string"},"evidence_file_size":{"example":48213,"type":"integer"},"expires_at":{"example":"2027-07-19T10:00:00Z","type":"string"},"framework_id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"framework_name":{"example":"NIS2","type":"string"},"id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"last_reminder_at":{"type":"string"},"owner_email":{"example":"grc@example.com","type":"string"},"review_cadence_days":{"example":365,"type":"integer"},"statement":{"example":"Incident-reporting procedure reviewed and exercised in Q2.","type":"string"},"status":{"example":"active","type":"string"},"tenant_id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"updated_at":{"example":"2026-07-19T10:00:00Z","type":"string"}},"type":"object"},"entity.ControlDelta":{"properties":{"changed_at":{"example":"2026-03-15T10:00:00Z","type":"string"},"control_id":{"example":"CC6.1","type":"string"},"control_name":{"example":"Logical Access Controls","type":"string"},"domain":{"example":"Access Control","type":"string"},"new_status":{"example":"passed","type":"string"},"old_status":{"example":"failed","type":"string"}},"type":"object"},"entity.ControlPosture":{"properties":{"attested_count":{"type":"integer"},"children":{"items":{"$ref":"#/components/schemas/entity.ControlPosture"},"type":"array"},"control_id":{"type":"string"},"control_name":{"type":"string"},"failed_count":{"type":"integer"},"mapped_policies":{"description":"MappedPolicies is how many policies the framework maps to the control before\nany connector or scan narrowing. A leaf with zero is attestation-only; a leaf\nwith MappedPolicies > 0 and TotalPolicies == 0 merely has no scan evidence yet.","type":"integer"},"passed_count":{"type":"integer"},"status":{"$ref":"#/components/schemas/entity.ControlStatus"},"total_policies":{"type":"integer"}},"type":"object"},"entity.ControlRegression":{"properties":{"affected_connectors":{"items":{"type":"string"},"type":"array"},"control_id":{"type":"string"},"control_name":{"type":"string"},"domain":{"type":"string"},"regressed_at":{"type":"string"}},"type":"object"},"entity.ControlStatus":{"enum":["passed","failed","not_assessed","attested"],"type":"string","x-enum-varnames":["ControlStatusPassed","ControlStatusFailed","ControlStatusNotAssessed","ControlStatusAttested"]},"entity.ControlStub":{"properties":{"control_id":{"example":"CC6.1","type":"string"},"control_name":{"example":"Logical Access Controls","type":"string"},"finding_count":{"example":5,"type":"integer"}},"type":"object"},"entity.CoverageSummary":{"properties":{"connectors_with_discovery":{"type":"integer"},"connectors_without_discovery":{"type":"integer"},"distinct_apps":{"type":"integer"},"new_apps_last_30d":{"type":"integer"},"new_apps_last_7d":{"type":"integer"},"total_ai_apps":{"type":"integer"},"total_apps":{"type":"integer"}},"type":"object"},"entity.CursorMeta":{"properties":{"has_next":{"type":"boolean"},"limit":{"type":"integer"},"next_cursor":{"type":"string"}},"type":"object"},"entity.DashboardPosture":{"properties":{"categories":{"items":{"$ref":"#/components/schemas/entity.PostureCategoryScore"},"type":"array"},"compliance_score":{"type":"number"},"connector_health":{"$ref":"#/components/schemas/entity.ConnectorHealth"},"external_sharing":{"$ref":"#/components/schemas/entity.ExternalSharingSummary"},"finding_summary":{"$ref":"#/components/schemas/entity.FindingSummary"},"grade":{"$ref":"#/components/schemas/entity.PostureGrade"},"identity_risk":{"$ref":"#/components/schemas/entity.IdentityRiskBrief"},"last_scan_at":{"type":"string"},"overall_score":{"type":"number"},"recommendations":{"items":{"$ref":"#/components/schemas/entity.PostureRecommendation"},"type":"array"},"score_delta_30d":{"type":"number"},"score_delta_7d":{"type":"number"},"third_party_apps":{"$ref":"#/components/schemas/entity.ThirdPartyAppSummary"}},"type":"object"},"entity.DashboardSummary":{"properties":{"frameworks":{"items":{"$ref":"#/components/schemas/entity.FrameworkPosture"},"type":"array"},"posture":{"$ref":"#/components/schemas/entity.DashboardPosture"},"top_risks":{"items":{"$ref":"#/components/schemas/entity.Finding"},"type":"array"}},"type":"object"},"entity.DashboardTrendPoint":{"properties":{"captured_at":{"type":"string"},"compliance_score":{"type":"number"},"findings_open":{"type":"integer"},"framework_name":{"description":"FrameworkName is populated only on the per-connector series (the primary\nframework the connector snapshots cover); it is omitted on the tenant-wide\ncomposite series.","type":"string"},"overall_score":{"description":"OverallScore is DEPRECATED: a populated alias of ComplianceScore, kept\nthrough all of Wave A so the UI ScoreTimeline (plots y=\"overall_score\") and\nthe executive report keep rendering until Task 10 repoints them at\ncompliance_score. It always mirrors ComplianceScore (same value, same null).\nRemoving it is a Wave-B cleanup — do not drop it before the UI cutover.","type":"number"}},"type":"object"},"entity.DataCategoryAccess":{"properties":{"access":{"description":"\"read\" | \"write\"","type":"string"},"category":{"type":"string"}},"type":"object"},"entity.DeliveryChannel":{"properties":{"config":{"type":"object"},"type":{"type":"string"}},"type":"object"},"entity.DeliveryChannelType":{"enum":["slack","email","in_app"],"type":"string","x-enum-varnames":["DeliveryChannelSlack","DeliveryChannelEmail","DeliveryChannelInApp"]},"entity.DeliverySourceType":{"enum":["alert","exception","digest","report","sla"],"type":"string","x-enum-varnames":["DeliverySourceAlert","DeliverySourceException","DeliverySourceDigest","DeliverySourceReport","DeliverySourceSLA"]},"entity.DeliveryStatus":{"enum":["pending","success","failed","exhausted"],"type":"string","x-enum-varnames":["DeliveryStatusPending","DeliveryStatusSuccess","DeliveryStatusFailed","DeliveryStatusExhausted"]},"entity.DiscoveryCoverage":{"properties":{"connectors":{"items":{"$ref":"#/components/schemas/entity.ConnectorCoverage"},"type":"array"},"summary":{"$ref":"#/components/schemas/entity.CoverageSummary"},"supported_connector_types":{"items":{"type":"string"},"type":"array"}},"type":"object"},"entity.Disposition":{"properties":{"disposition":{"example":"in_review","type":"string"},"entity_id":{"example":"id-001","type":"string"},"entity_type":{"example":"identity","type":"string"},"id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"note":{"type":"string"},"set_at":{"type":"string"},"set_by":{"example":"analyst@example.com","type":"string"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"},"version":{"example":1,"type":"integer"}},"type":"object"},"entity.EdgeScanProgress":{"properties":{"created_at":{"type":"string"},"error":{"type":"string"},"error_kind":{"type":"string"},"marker_received":{"type":"boolean"},"pages_received":{"type":"integer"},"resource_type":{"type":"string"},"scan_id":{"type":"string"},"total_pages":{"type":"integer"},"updated_at":{"type":"string"}},"type":"object"},"entity.EnrichedScope":{"properties":{"category":{"type":"string"},"description":{"type":"string"},"risk":{"type":"string"},"scope":{"type":"string"}},"type":"object"},"entity.Exception":{"properties":{"approval_chain_id":{"description":"Optional approval chain reference","example":"c47ac10b-58cc-4372-a567-0e02b2c3d479","type":"string"},"approved_by":{"description":"Person who approved the exception","example":"security-lead@example.com","type":"string"},"created_at":{"description":"When the exception was created","example":"2026-02-25T10:00:00Z","type":"string"},"created_by_email":{"description":"Who created the exception: the creator's email, or `API key <name>` when an API key created it","example":"requester@example.com","type":"string"},"expires_at":{"description":"When the exception expires","example":"2026-06-01T00:00:00Z","type":"string"},"finding_id":{"description":"Associated finding","example":"f47ac10b-58cc-4372-a567-0e02b2c3d479","type":"string"},"id":{"description":"Unique exception identifier","example":"e47ac10b-58cc-4372-a567-0e02b2c3d479","type":"string"},"justification":{"description":"Reason for the exception","example":"Risk accepted per annual review","type":"string"},"revoked_at":{"description":"When the exception was revoked (null if not revoked)","example":"2026-03-15T10:00:00Z","type":"string"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.ExceptionStatus"}],"description":"Lifecycle state (active, expired, revoked)","example":"active"},"tenant_id":{"description":"Owning tenant","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"updated_at":{"description":"When the exception was last updated","example":"2026-02-25T10:00:00Z","type":"string"},"version":{"description":"Optimistic concurrency control version","example":1,"type":"integer"}},"type":"object"},"entity.ExceptionApproval":{"properties":{"approver_email":{"type":"string"},"approver_id":{"type":"string"},"assigned_approver_email":{"type":"string"},"assigned_delegate_email":{"type":"string"},"comment":{"type":"string"},"created_at":{"type":"string"},"decided_at":{"type":"string"},"decision":{"type":"string"},"delegated_at":{"type":"string"},"exception_id":{"type":"string"},"id":{"type":"string"},"is_delegate":{"type":"boolean"},"severity_override_id":{"type":"string"},"step_order":{"type":"integer"},"tenant_id":{"type":"string"}},"type":"object"},"entity.ExceptionStatus":{"enum":["active","expired","revoked","pending_approval","rejected"],"type":"string","x-enum-varnames":["ExceptionStatusActive","ExceptionStatusExpired","ExceptionStatusRevoked","ExceptionStatusPendingApproval","ExceptionStatusRejected"]},"entity.ExecuteRemediationResult":{"properties":{"actions_skipped":{"type":"integer"},"actions_total":{"type":"integer"},"agent_count":{"type":"integer"},"run_id":{"type":"string"},"status":{"type":"string"}},"type":"object"},"entity.ExternalSharingSummary":{"properties":{"external_user_shared_files":{"type":"integer"},"link_shared_files":{"type":"integer"},"org_sharing_restricted":{"type":"boolean"},"public_files":{"type":"integer"},"total_externally_shared_files":{"type":"integer"},"users_with_external_sharing":{"type":"integer"}},"type":"object"},"entity.FetchMode":{"enum":["origin","edge"],"type":"string","x-enum-varnames":["FetchModeOrigin","FetchModeEdge"]},"entity.Finding":{"properties":{"assigned_at":{"description":"When the finding was assigned","example":"2025-01-22T10:00:00Z","type":"string"},"assignee_id":{"description":"Assigned team member ID","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"category":{"description":"Category of the policy that raised the finding (e.g. mfa). Omitted\nwhere the response does not include it.","type":"string"},"compliance_refs":{"description":"Mapped compliance framework controls — populated by a separate code path, not in findingColumns","items":{"$ref":"#/components/schemas/entity.ComplianceRef"},"type":"array"},"connector_id":{"description":"Connector where the finding was detected","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"description":{"description":"Detailed explanation","example":"User john@example.com has admin privileges but MFA is not configured","type":"string"},"drifted":{"description":"True only when the latest scan that saw this finding re-opened it after resolution (configuration drift); regression_count counts every re-open","example":false,"type":"boolean"},"first_seen_at":{"description":"When the finding was first detected","example":"2025-01-15T10:30:00Z","type":"string"},"id":{"description":"Unique finding identifier","example":"f47ac10b-58cc-4372-a567-0e02b2c3d479","type":"string"},"last_resolved_at":{"description":"When this finding was last resolved before the current regression","example":"2026-01-20T09:00:00Z","type":"string"},"last_seen_at":{"description":"When the finding was last observed","example":"2025-01-20T14:00:00Z","type":"string"},"policy_id":{"description":"Policy that triggered the finding","example":"pol-mfa-001","type":"string"},"policy_uuid":{"description":"Native UUID copy of PolicyID for index-only policy joins; NULL for non-UUID policy IDs","type":"string"},"priority_factors":{"description":"Contributing factors (e.g. \"severity:critical\", \"privileged_user\")","items":{"type":"string"},"type":"array"},"priority_score":{"description":"Composite priority score (0-99.99)","example":72.5,"type":"number"},"regression_count":{"description":"Number of times this finding has drifted back to open","example":0,"type":"integer"},"remediation_info":{"allOf":[{"$ref":"#/components/schemas/entity.RemediationInfo"}],"description":"Unified remediation payload — populated by scanner, consumed by all delivery channels"},"resolved_at":{"description":"When the finding was resolved (null if still open)","example":"2025-01-21T09:00:00Z","type":"string"},"resource_id":{"description":"Identifier of the affected resource","example":"00u1a2b3c4d5e6f7g8","type":"string"},"resource_name":{"description":"Human-readable name of the affected resource","example":"john@example.com","type":"string"},"resource_type":{"description":"Type of affected resource","example":"user","type":"string"},"scan_id":{"description":"Scan that produced this finding","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"severity":{"allOf":[{"$ref":"#/components/schemas/entity.Severity"}],"description":"Severity level (critical, high, medium, low, info)","example":"high"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.FindingStatus"}],"description":"Lifecycle state (open, resolved, suppressed, accepted)","example":"open"},"suppression_source":{"description":"'sso_coverage' when the overlay suppressed this finding; empty for a human's manual suppression","example":"sso_coverage","type":"string"},"tenant_id":{"description":"Owning tenant","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"title":{"description":"Short summary of the finding","example":"MFA not enabled for admin user","type":"string"},"verification_requested_at":{"description":"When \"I fixed this\" was clicked","example":"2026-01-21T09:00:00Z","type":"string"},"version":{"description":"Optimistic concurrency control version","example":1,"type":"integer"}},"type":"object"},"entity.FindingComment":{"properties":{"author_email":{"example":"analyst@example.com","type":"string"},"author_id":{"example":"user-001","type":"string"},"body":{"example":"Confirmed with infrastructure team — this is expected.","type":"string"},"created_at":{"type":"string"},"finding_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"},"id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440002","type":"string"}},"type":"object"},"entity.FindingCursorResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.Finding"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.CursorMeta"},"withheld":{"allOf":[{"$ref":"#/components/schemas/entity.SeverityCounts"}],"description":"set only when a plan visible-window truncated the page"}},"type":"object"},"entity.FindingEvidence":{"properties":{"captured_at":{"type":"string"},"redacted_keys":{"items":{"type":"string"},"type":"array"},"resource_properties":{"additionalProperties":{},"type":"object"},"truncated":{"type":"boolean"}},"type":"object"},"entity.FindingEvidenceView":{"properties":{"evidence":{"$ref":"#/components/schemas/entity.FindingEvidence"},"finding_id":{"type":"string"},"resource_uuid":{"type":"string"}},"type":"object"},"entity.FindingExport":{"properties":{"created_at":{"type":"string"},"error_message":{"type":"string"},"expires_at":{"type":"string"},"file_name":{"example":"finding-export-2026-03-06.csv","type":"string"},"file_size":{"example":102400,"type":"integer"},"filters":{"type":"object"},"format":{"example":"csv","type":"string"},"id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"record_count":{"example":500,"type":"integer"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.FindingExportStatus"}],"example":"completed"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"}},"type":"object"},"entity.FindingExportStatus":{"enum":["pending","processing","completed","failed"],"type":"string","x-enum-varnames":["FindingExportStatusPending","FindingExportStatusProcessing","FindingExportStatusCompleted","FindingExportStatusFailed"]},"entity.FindingStatus":{"enum":["open","resolved","suppressed","accepted"],"type":"string","x-enum-varnames":["FindingStatusOpen","FindingStatusResolved","FindingStatusSuppressed","FindingStatusAccepted"]},"entity.FindingStatusChange":{"properties":{"changed_at":{"example":"2026-03-06T10:00:00Z","type":"string"},"changed_by":{"example":"user@example.com","type":"string"},"finding_id":{"example":"f47ac10b-58cc-4372-a567-0e02b2c3d479","type":"string"},"id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.FindingStatus"}],"example":"resolved"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"}},"type":"object"},"entity.FindingSummary":{"properties":{"critical":{"type":"integer"},"drift_count":{"type":"integer"},"high":{"type":"integer"},"info":{"type":"integer"},"low":{"type":"integer"},"medium":{"type":"integer"},"total":{"type":"integer"}},"type":"object"},"entity.FrameworkPosture":{"properties":{"attested":{"type":"integer"},"domains":{"items":{"$ref":"#/components/schemas/entity.ControlPosture"},"type":"array"},"failed_controls":{"type":"integer"},"framework_id":{"type":"string"},"framework_name":{"type":"string"},"not_assessed":{"type":"integer"},"overall_score":{"description":"nil when no control is assessed (no-data ≠ 0)","type":"number"},"passed_controls":{"type":"integer"},"total_controls":{"type":"integer"}},"type":"object"},"entity.FrameworkSummaryEnriched":{"properties":{"attested":{"type":"integer"},"audit_date":{"example":"2026-06-30T00:00:00Z","type":"string"},"blocking_controls":{"items":{"$ref":"#/components/schemas/entity.ControlStub"},"type":"array"},"days_until_audit":{"example":45,"type":"integer"},"domains":{"items":{"$ref":"#/components/schemas/entity.ControlPosture"},"type":"array"},"failed_controls":{"type":"integer"},"framework_id":{"type":"string"},"framework_name":{"type":"string"},"not_assessed":{"type":"integer"},"overall_score":{"description":"nil when no control is assessed (no-data ≠ 0)","type":"number"},"passed_controls":{"type":"integer"},"recent_wins":{"items":{"$ref":"#/components/schemas/entity.ControlStub"},"type":"array"},"stale_evidence_count":{"example":2,"type":"integer"},"total_controls":{"type":"integer"},"trend_direction":{"example":"improving","type":"string"}},"type":"object"},"entity.GapControl":{"properties":{"control_id":{"type":"string"},"control_name":{"type":"string"},"domain":{"type":"string"}},"type":"object"},"entity.GraphEdge":{"properties":{"from":{"type":"string"},"kind":{"description":"\"scope_grant\" | \"consent\" | \"finding\"","type":"string"},"meta":{"additionalProperties":{},"type":"object"},"to":{"type":"string"}},"type":"object"},"entity.GraphNode":{"properties":{"id":{"type":"string"},"label":{"type":"string"},"meta":{"additionalProperties":{},"type":"object"},"severity":{"type":"string"},"type":{"description":"\"integration\" | \"data_category\" | \"authorizer_cohort\" | \"person\" | \"finding\"","type":"string"}},"type":"object"},"entity.GuideField":{"properties":{"help_text":{"type":"string"},"key":{"type":"string"},"label":{"type":"string"},"required":{"type":"boolean"}},"type":"object"},"entity.GuidePermission":{"properties":{"permission":{"type":"string"},"reason":{"type":"string"},"required":{"type":"boolean"}},"type":"object"},"entity.GuideStep":{"properties":{"command":{"description":"Command is an optional shell/PowerShell block rendered with a copy button.\nPlaceholders use the <YOUR-…> form so the UI can highlight them.","type":"string"},"description":{"type":"string"},"error_match":{"description":"ErrorMatch lists case-insensitive substrings of a test-connection error that\npoint the user back to this step.","items":{"type":"string"},"type":"array"},"help_url":{"type":"string"},"note":{"description":"Note is the known gotcha for this step (e.g. propagation delay).","type":"string"},"order":{"type":"integer"},"title":{"type":"string"}},"type":"object"},"entity.Identity":{"properties":{"canonical_identity_id":{"type":"string"},"connector_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"},"created_at":{"example":"2025-01-01T00:00:00Z","type":"string"},"created_by_external_id":{"type":"string"},"deprovisioned_at":{"type":"string"},"display_name":{"example":"John Doe","type":"string"},"email":{"example":"john@example.com","type":"string"},"expires_at":{"type":"string"},"external_id":{"example":"00u1a2b3c4d5e6f7g8","type":"string"},"finding_count":{"description":"Number of open findings on this identity, as returned by the identity\nlist; 0 on other reads.","example":5,"type":"integer"},"id":{"example":"id-001","type":"string"},"identity_type":{"allOf":[{"$ref":"#/components/schemas/entity.IdentityType"}],"example":"human"},"is_privileged":{"description":"Whether the connector reports this identity as privileged, from its admin\nflags and role names. Omitted when the connector gives no privilege signal:\nunknown, not false.","type":"boolean"},"last_activity_at":{"example":"2025-01-20T14:00:00Z","type":"string"},"last_rotated_at":{"type":"string"},"offboarding_handled_at":{"type":"string"},"owner_canonical_identity_id":{"type":"string"},"properties":{"additionalProperties":{},"type":"object"},"revocation_detected_at":{"type":"string"},"risk_score":{"example":42,"type":"number"},"role":{"example":"admin","type":"string"},"status":{"example":"active","type":"string"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"updated_at":{"example":"2025-01-10T12:00:00Z","type":"string"}},"type":"object"},"entity.IdentityCursorResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.Identity"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.CursorMeta"}},"type":"object"},"entity.IdentityPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.Identity"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.IdentityRef":{"properties":{"connector_id":{"type":"string"},"external_id":{"type":"string"}},"type":"object"},"entity.IdentityRiskBrief":{"properties":{"average_score":{"type":"number"},"high_risk_count":{"type":"integer"},"total_identities":{"type":"integer"}},"type":"object"},"entity.IdentityRiskScore":{"properties":{"has_proxy_logins":{"example":true,"type":"boolean"},"identity_id":{"example":"id-001","type":"string"},"open_finding_count":{"example":7,"type":"integer"},"proxy_login_count":{"example":3,"type":"integer"},"role_factor":{"example":1.5,"type":"number"},"score":{"example":42,"type":"number"},"severity_breakdown":{"$ref":"#/components/schemas/entity.SeverityBreakdown"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"}},"type":"object"},"entity.IdentityRiskSnapshot":{"properties":{"captured_at":{"example":"2025-01-20T14:00:00Z","type":"string"},"connector_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"},"id":{"example":"snap-001","type":"string"},"identity_id":{"example":"id-001","type":"string"},"score":{"example":42,"type":"number"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"}},"type":"object"},"entity.IdentityRiskSnapshotPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.IdentityRiskSnapshot"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.IdentityRiskSummaryResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.IdentityRiskScore"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.CursorMeta"}},"type":"object"},"entity.IdentityStats":{"properties":{"active_count":{"type":"integer"},"admin_count":{"type":"integer"},"deprovisioned_count":{"type":"integer"},"dormant_count":{"type":"integer"},"mfa_enabled_count":{"type":"integer"},"nhi_by_type":{"additionalProperties":{"type":"integer"},"type":"object"},"suspended_count":{"type":"integer"},"total_count":{"type":"integer"},"total_nhis":{"type":"integer"}},"type":"object"},"entity.IdentityStub":{"properties":{"connector_id":{"type":"string"},"display_name":{"type":"string"},"email":{"type":"string"},"expires_at":{"type":"string"},"id":{"type":"string"},"identity_type":{"$ref":"#/components/schemas/entity.IdentityType"},"is_privileged":{"description":"Whether the connector reports this identity as privileged. Omitted when the\nconnector gives no privilege signal: unknown, not false.","type":"boolean"},"last_activity_at":{"type":"string"},"role":{"type":"string"},"status":{"type":"string"}},"type":"object"},"entity.IdentityType":{"enum":["human","service_account","bot","api_key","oauth_app","unknown"],"type":"string","x-enum-varnames":["IdentityTypeHuman","IdentityTypeServiceAccount","IdentityTypeBot","IdentityTypeAPIKey","IdentityTypeOAuthApp","IdentityTypeUnknown"]},"entity.IntegrationGuide":{"properties":{"description":{"type":"string"},"display_name":{"type":"string"},"doc_url":{"type":"string"},"estimated_minutes":{"type":"integer"},"integration_type":{"type":"string"},"permissions":{"items":{"$ref":"#/components/schemas/entity.GuidePermission"},"type":"array"},"prerequisites":{"items":{"type":"string"},"type":"array"},"required_fields":{"items":{"$ref":"#/components/schemas/entity.GuideField"},"type":"array"},"setup_steps":{"items":{"$ref":"#/components/schemas/entity.GuideStep"},"type":"array"}},"type":"object"},"entity.MappingSuggestion":{"properties":{"candidate_policies":{"items":{"$ref":"#/components/schemas/entity.PolicyStub"},"type":"array"},"control_id":{"type":"string"},"control_name":{"type":"string"},"suggested_reason":{"type":"string"}},"type":"object"},"entity.MatchConfidence":{"enum":["exact","alias_confirmed"],"type":"string","x-enum-varnames":["ConfidenceExact","ConfidenceAliasConfirmed"]},"entity.NHIConnectorSummary":{"properties":{"by_type":{"additionalProperties":{"type":"integer"},"type":"object"},"connector_id":{"type":"string"},"connector_name":{"type":"string"},"connector_type":{"type":"string"},"nhi_count":{"type":"integer"},"stale_count":{"type":"integer"}},"type":"object"},"entity.NHISummary":{"properties":{"by_connector":{"description":"Per-connector breakdown of non-human identities. Not returned yet.","items":{"$ref":"#/components/schemas/entity.NHIConnectorSummary"},"type":"array"},"by_type":{"additionalProperties":{"type":"integer"},"type":"object"},"expiring_count":{"type":"integer"},"hygiene_score":{"type":"number"},"never_rotated_count":{"type":"integer"},"orphaned_count":{"type":"integer"},"stale_count":{"type":"integer"},"total_nhis":{"type":"integer"}},"type":"object"},"entity.NotificationDelivery":{"properties":{"attempt_count":{"type":"integer"},"channel_type":{"$ref":"#/components/schemas/entity.DeliveryChannelType"},"completed_at":{"type":"string"},"created_at":{"type":"string"},"id":{"type":"string"},"last_attempted_at":{"type":"string"},"last_error":{"type":"string"},"max_attempts":{"type":"integer"},"recipient":{"type":"string"},"source_id":{"type":"string"},"source_type":{"$ref":"#/components/schemas/entity.DeliverySourceType"},"status":{"$ref":"#/components/schemas/entity.DeliveryStatus"},"tenant_id":{"type":"string"}},"type":"object"},"entity.NotificationDeliveryPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.NotificationDelivery"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.ObservationChange":{"enum":["new","persisted","reopened","resolved"],"type":"string","x-enum-varnames":["ObservationNew","ObservationPersisted","ObservationReopened","ObservationResolved"]},"entity.ObservedFinding":{"properties":{"assigned_at":{"description":"When the finding was assigned","example":"2025-01-22T10:00:00Z","type":"string"},"assignee_id":{"description":"Assigned team member ID","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"category":{"description":"Category of the policy that raised the finding (e.g. mfa). Omitted\nwhere the response does not include it.","type":"string"},"change":{"allOf":[{"$ref":"#/components/schemas/entity.ObservationChange"}],"description":"What the scan did to the finding: new, persisted or reopened","example":"reopened"},"compliance_refs":{"description":"Mapped compliance framework controls — populated by a separate code path, not in findingColumns","items":{"$ref":"#/components/schemas/entity.ComplianceRef"},"type":"array"},"connector_id":{"description":"Connector where the finding was detected","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"description":{"description":"Detailed explanation","example":"User john@example.com has admin privileges but MFA is not configured","type":"string"},"drifted":{"description":"True only when the latest scan that saw this finding re-opened it after resolution (configuration drift); regression_count counts every re-open","example":false,"type":"boolean"},"first_seen_at":{"description":"When the finding was first detected","example":"2025-01-15T10:30:00Z","type":"string"},"id":{"description":"Unique finding identifier","example":"f47ac10b-58cc-4372-a567-0e02b2c3d479","type":"string"},"last_resolved_at":{"description":"When this finding was last resolved before the current regression","example":"2026-01-20T09:00:00Z","type":"string"},"last_seen_at":{"description":"When the finding was last observed","example":"2025-01-20T14:00:00Z","type":"string"},"observed_at":{"description":"When the scan recorded it","example":"2026-10-20T08:00:00Z","type":"string"},"policy_id":{"description":"Policy that triggered the finding","example":"pol-mfa-001","type":"string"},"policy_uuid":{"description":"Native UUID copy of PolicyID for index-only policy joins; NULL for non-UUID policy IDs","type":"string"},"priority_factors":{"description":"Contributing factors (e.g. \"severity:critical\", \"privileged_user\")","items":{"type":"string"},"type":"array"},"priority_score":{"description":"Composite priority score (0-99.99)","example":72.5,"type":"number"},"regression_count":{"description":"Number of times this finding has drifted back to open","example":0,"type":"integer"},"remediation_info":{"allOf":[{"$ref":"#/components/schemas/entity.RemediationInfo"}],"description":"Unified remediation payload — populated by scanner, consumed by all delivery channels"},"resolved_at":{"description":"When the finding was resolved (null if still open)","example":"2025-01-21T09:00:00Z","type":"string"},"resource_id":{"description":"Identifier of the affected resource","example":"00u1a2b3c4d5e6f7g8","type":"string"},"resource_name":{"description":"Human-readable name of the affected resource","example":"john@example.com","type":"string"},"resource_type":{"description":"Type of affected resource","example":"user","type":"string"},"scan_id":{"description":"Scan that produced this finding","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"severity":{"allOf":[{"$ref":"#/components/schemas/entity.Severity"}],"description":"Severity level (critical, high, medium, low, info)","example":"high"},"severity_at_scan":{"description":"Severity as the scan evaluated it","example":"critical","type":"string"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.FindingStatus"}],"description":"Lifecycle state (open, resolved, suppressed, accepted)","example":"open"},"status_at_scan":{"description":"Status as the scan evaluated it","example":"open","type":"string"},"suppression_source":{"description":"'sso_coverage' when the overlay suppressed this finding; empty for a human's manual suppression","example":"sso_coverage","type":"string"},"tenant_id":{"description":"Owning tenant","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"title":{"description":"Short summary of the finding","example":"MFA not enabled for admin user","type":"string"},"verification_requested_at":{"description":"When \"I fixed this\" was clicked","example":"2026-01-21T09:00:00Z","type":"string"},"version":{"description":"Optimistic concurrency control version","example":1,"type":"integer"}},"type":"object"},"entity.OffboardingItem":{"properties":{"action_id":{"type":"string"},"channel":{"type":"string"},"finding_id":{"type":"string"},"name":{"type":"string"},"status":{"$ref":"#/components/schemas/entity.ActionStatus"},"subject_id":{"type":"string"},"subject_type":{"type":"string"}},"type":"object"},"entity.OffboardingPacketDetail":{"properties":{"closed_count":{"type":"integer"},"items":{"items":{"$ref":"#/components/schemas/entity.OffboardingItem"},"type":"array"},"person_display_name":{"type":"string"},"person_email":{"type":"string"},"run":{"$ref":"#/components/schemas/entity.RemediationRun"},"total_count":{"type":"integer"}},"type":"object"},"entity.OffboardingRisk":{"properties":{"active_api_key_list":{"description":"ActiveAPIKeyList enumerates api_key-type NHIs owned by the leaver\n(created_by_external_id). ActiveAPIKeys mirrors len(ActiveAPIKeyList).","items":{"$ref":"#/components/schemas/entity.IdentityStub"},"type":"array"},"active_api_keys":{"type":"integer"},"active_oauth_grants":{"description":"ActiveOAuthGrants surfaces third-party apps still authorized by a\ndeprovisioned user.","items":{"$ref":"#/components/schemas/entity.ThirdPartyAppStub"},"type":"array"},"canonical_person_id":{"description":"CanonicalPersonID is the leaver's canonical identity ID, when one is known.","type":"string"},"deprovisioned_at":{"type":"string"},"identity":{"$ref":"#/components/schemas/entity.IdentityStub"},"orphaned_nhis":{"items":{"$ref":"#/components/schemas/entity.IdentityStub"},"type":"array"},"recommended_actions":{"items":{"type":"string"},"type":"array"},"risk_level":{"$ref":"#/components/schemas/entity.OffboardingRiskLevel"},"status":{"type":"string"}},"type":"object"},"entity.OffboardingRiskLevel":{"enum":["high","medium","low"],"type":"string","x-enum-varnames":["OffboardingRiskHigh","OffboardingRiskMedium","OffboardingRiskLow"]},"entity.OffboardingSettings":{"properties":{"auto_send":{"type":"boolean"},"orchestration_enabled":{"type":"boolean"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.OpsMetrics":{"properties":{"aging_distribution":{"items":{"$ref":"#/components/schemas/entity.AgingBucket"},"type":"array"},"by_assignee":{"items":{"$ref":"#/components/schemas/entity.AssigneeMetrics"},"type":"array"},"mttr_hours":{"additionalProperties":{"format":"float64","type":"number"},"type":"object"},"overdue_count":{"additionalProperties":{"type":"integer"},"type":"object"},"trend_7d":{"$ref":"#/components/schemas/entity.TrendMetrics"},"unassigned_count":{"additionalProperties":{"type":"integer"},"type":"object"}},"type":"object"},"entity.OwnerEmailFacet":{"properties":{"count":{"type":"integer"},"email":{"type":"string"}},"type":"object"},"entity.PaginationMeta":{"properties":{"has_next":{"type":"boolean"},"limit":{"type":"integer"},"offset":{"type":"integer"},"total":{"type":"integer"}},"type":"object"},"entity.PersistentFailure":{"properties":{"control_id":{"type":"string"},"control_name":{"type":"string"},"days_failing":{"type":"integer"},"domain":{"type":"string"},"failing_policies":{"type":"integer"},"failing_since":{"type":"string"},"top_findings":{"items":{"type":"string"},"type":"array"}},"type":"object"},"entity.PersonRef":{"properties":{"display_name":{"type":"string"},"id":{"type":"string"},"primary_email":{"type":"string"}},"type":"object"},"entity.PersonRiskAggregate":{"properties":{"average_person_risk":{"type":"number"},"by_risk_band":{"additionalProperties":{"type":"integer"},"description":"critical/high/medium/low","type":"object"},"privileged_people":{"type":"integer"},"total_people":{"type":"integer"}},"type":"object"},"entity.Playbook":{"properties":{"actions":{"items":{"$ref":"#/components/schemas/entity.PlaybookAction"},"type":"array"},"description":{"type":"string"},"id":{"type":"string"},"match":{"$ref":"#/components/schemas/entity.PlaybookMatch"},"name":{"type":"string"},"platform":{"type":"string"}},"type":"object"},"entity.PlaybookAction":{"properties":{"channels":{"items":{"type":"string"},"type":"array"},"provider":{"type":"string"},"recipient":{"type":"string"},"require_owner":{"type":"boolean"},"status":{"type":"string"},"template":{"type":"string"},"type":{"$ref":"#/components/schemas/entity.ActionType"}},"type":"object"},"entity.PlaybookCondition":{"properties":{"field":{"type":"string"},"op":{"type":"string"},"value":{}},"type":"object"},"entity.PlaybookMatch":{"properties":{"conditions":{"items":{"$ref":"#/components/schemas/entity.PlaybookCondition"},"type":"array"},"policies":{"items":{"type":"string"},"type":"array"}},"type":"object"},"entity.PlaybookPreviewMatch":{"properties":{"agent_id":{"type":"string"},"agent_name":{"type":"string"},"matched_policies":{"items":{"type":"string"},"type":"array"}},"type":"object"},"entity.PlaybookPreviewResult":{"properties":{"matched":{"items":{"$ref":"#/components/schemas/entity.PlaybookPreviewMatch"},"type":"array"},"skipped":{"items":{"$ref":"#/components/schemas/entity.PlaybookPreviewSkip"},"type":"array"}},"type":"object"},"entity.PlaybookPreviewSkip":{"properties":{"agent_id":{"type":"string"},"reason":{"type":"string"}},"type":"object"},"entity.Policy":{"properties":{"admin_console_path":{"description":"Path in SaaS admin console for remediation","example":"/admin/security/mfa","type":"string"},"category":{"description":"Policy category for grouping","example":"mfa","type":"string"},"connector_type":{"allOf":[{"$ref":"#/components/schemas/entity.ConnectorType"}],"description":"SaaS platform this policy applies to","example":"okta"},"created_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","type":"string"},"description":{"description":"What this policy checks","example":"Ensures all admin users have MFA enabled","type":"string"},"docs_url":{"description":"Vendor documentation link","example":"https://help.okta.com/...","type":"string"},"effective_severity":{"allOf":[{"$ref":"#/components/schemas/entity.Severity"}],"example":"medium"},"enabled":{"description":"Whether the policy is active","example":true,"type":"boolean"},"estimated_fix_minutes":{"description":"Estimated time to remediate in minutes","example":15,"type":"integer"},"fix_difficulty":{"description":"Remediation difficulty: easy, medium, hard","example":"easy","type":"string"},"id":{"description":"Unique policy identifier","example":"pol-mfa-001","type":"string"},"impact_if_ignored":{"description":"Business impact if finding is left unresolved","type":"string"},"is_default":{"description":"Whether this is a built-in default policy","example":true,"type":"boolean"},"name":{"description":"Human-readable policy name","example":"Require MFA for admins","type":"string"},"open_finding_count":{"description":"Number of open findings for this policy (populated on list)","example":3,"type":"integer"},"prerequisites":{"description":"Required admin role/permission","example":"Requires Okta Super Admin role","type":"string"},"rego_source":{"description":"OPA Rego policy source code","example":"package sspm\nviolation[msg] { ... }","type":"string"},"remediation_steps":{"description":"Ordered steps to remediate the finding","items":{"type":"string"},"type":"array"},"resource_type":{"description":"Resource type this policy evaluates","example":"user","type":"string"},"rollback_risk":{"description":"low, medium, high — risk of remediation rollback","type":"string"},"root_cause":{"description":"Root cause explanation for campaign grouping","type":"string"},"severity":{"allOf":[{"$ref":"#/components/schemas/entity.Severity"}],"description":"Finding severity when violated (critical, high, medium, low, info)","example":"high"},"sso_role":{"description":"Relationship to federated login: substitutable, evidence, idp_critical","example":"substitutable","type":"string"},"summary":{"description":"One-line remediation summary","example":"Require MFA for all Okta super-admins","type":"string"},"tier_tags":{"description":"Tags indicating which plan tiers include this policy","items":{"type":"string"},"type":"array"},"updated_at":{"description":"Last update timestamp","example":"2025-01-10T12:00:00Z","type":"string"},"version":{"description":"Optimistic concurrency control version","example":1,"type":"integer"}},"type":"object"},"entity.PolicyEvent":{"properties":{"connector_id":{"type":"string"},"event_type":{"$ref":"#/components/schemas/entity.PolicyEventType"},"id":{"type":"string"},"metadata":{"type":"object"},"occurred_at":{"type":"string"},"policy_id":{"type":"string"},"policy_type":{"$ref":"#/components/schemas/entity.PolicyType"},"scan_id":{"type":"string"},"tenant_id":{"type":"string"}},"type":"object"},"entity.PolicyEventPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.PolicyEvent"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.PolicyEventType":{"enum":["findings_detected","findings_resolved","findings_reopened","exception_granted","exception_expired","exception_revoked","exception_approved","exception_rejected","finding_status_changed","policy_created","policy_updated","policy_enabled","policy_disabled","policy_deleted"],"type":"string","x-enum-varnames":["PolicyEventFindingsDetected","PolicyEventFindingsResolved","PolicyEventFindingsReopened","PolicyEventExceptionGranted","PolicyEventExceptionExpired","PolicyEventExceptionRevoked","PolicyEventExceptionApproved","PolicyEventExceptionRejected","PolicyEventFindingStatusChanged","PolicyEventPolicyCreated","PolicyEventPolicyUpdated","PolicyEventPolicyEnabled","PolicyEventPolicyDisabled","PolicyEventPolicyDeleted"]},"entity.PolicyPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.Policy"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.PolicyStub":{"properties":{"category":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"}},"type":"object"},"entity.PolicyTestResult":{"properties":{"error":{"type":"string"},"eval_duration_ms":{"type":"integer"},"remediation":{"type":"string"},"violation":{"type":"boolean"}},"type":"object"},"entity.PolicyType":{"enum":["default","tenant"],"type":"string","x-enum-varnames":["PolicyTypeDefault","PolicyTypeTenant"]},"entity.PolicyVersion":{"properties":{"created_at":{"type":"string"},"created_by":{"example":"user@example.com","type":"string"},"description":{"type":"string"},"enabled":{"type":"boolean"},"id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"name":{"example":"Require MFA for admins","type":"string"},"policy_id":{"example":"pol-mfa-001","type":"string"},"rego_source":{"type":"string"},"severity":{"allOf":[{"$ref":"#/components/schemas/entity.Severity"}],"example":"high"},"version_number":{"example":3,"type":"integer"}},"type":"object"},"entity.PolicyVersionPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.PolicyVersion"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.PostureCategoryScore":{"properties":{"category":{"type":"string"},"delta_30d":{"type":"number"},"delta_7d":{"type":"number"},"finding_count":{"type":"integer"},"grade":{"$ref":"#/components/schemas/entity.PostureGrade"},"score":{"type":"number"},"top_action":{"type":"string"}},"type":"object"},"entity.PostureGrade":{"enum":["A","B","C","D","F"],"type":"string","x-enum-varnames":["PostureGradeA","PostureGradeB","PostureGradeC","PostureGradeD","PostureGradeF"]},"entity.PostureRecommendation":{"properties":{"action":{"type":"string"},"admin_console_url":{"type":"string"},"category":{"type":"string"},"finding_count":{"type":"integer"},"fix_difficulty":{"type":"string"},"impact_points":{"type":"number"},"policy_id":{"type":"string"},"rank":{"type":"integer"},"remediation_steps":{"items":{"type":"string"},"type":"array"},"remediation_summary":{"type":"string"}},"type":"object"},"entity.PostureSnapshot":{"properties":{"attested":{"example":1,"type":"integer"},"captured_at":{"example":"2026-02-27T10:00:00Z","type":"string"},"category_scores":{"additionalProperties":{"format":"float64","type":"number"},"type":"object"},"connector_id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"failed_controls":{"example":1,"type":"integer"},"framework_id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"not_assessed":{"example":1,"type":"integer"},"overall_score":{"description":"nil when nothing is assessed (no-data ≠ 0)","example":85.5,"type":"number"},"passed_controls":{"example":12,"type":"integer"},"tenant_id":{"example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"total_controls":{"example":14,"type":"integer"}},"type":"object"},"entity.ProxyCountryCount":{"properties":{"count":{"example":8,"type":"integer"},"country_code":{"example":"ZM","type":"string"}},"type":"object"},"entity.ProxyIntelSummary":{"properties":{"datacenter_logins":{"example":9,"type":"integer"},"identities_with_proxy":{"example":12,"type":"integer"},"residential_logins":{"example":38,"type":"integer"},"top_countries":{"items":{"$ref":"#/components/schemas/entity.ProxyCountryCount"},"type":"array"},"top_providers":{"items":{"$ref":"#/components/schemas/entity.ProxyProviderCount"},"type":"array"},"total_proxy_logins":{"example":47,"type":"integer"},"unique_proxy_ips":{"example":23,"type":"integer"}},"type":"object"},"entity.ProxyProviderCount":{"properties":{"count":{"example":19,"type":"integer"},"provider":{"example":"Decodo residential proxies","type":"string"}},"type":"object"},"entity.ReachSummary":{"properties":{"authorizer_count":{"type":"integer"},"data_categories":{"items":{"$ref":"#/components/schemas/entity.DataCategoryAccess"},"type":"array"},"finding_count":{"type":"integer"},"last_consent_change_at":{"type":"string"},"offboarded_count":{"type":"integer"},"privileged_count":{"type":"integer"},"publisher":{"type":"string"},"reach_band":{"description":"backend-owned band","type":"string"},"reach_score":{"type":"integer"}},"type":"object"},"entity.RemediationAction":{"properties":{"action_type":{"$ref":"#/components/schemas/entity.ActionType"},"agent_id":{"type":"string"},"agent_name":{"type":"string"},"channel":{"type":"string"},"detail":{"additionalProperties":{"type":"string"},"type":"object"},"error":{"type":"string"},"executed_at":{"type":"string"},"finding_id":{"type":"string"},"id":{"type":"string"},"run_id":{"type":"string"},"status":{"$ref":"#/components/schemas/entity.ActionStatus"},"subject_id":{"type":"string"},"subject_type":{"type":"string"}},"type":"object"},"entity.RemediationActivity":{"properties":{"by_connector":{"items":{"$ref":"#/components/schemas/entity.RemediationGroup"},"type":"array"},"by_domain":{"items":{"$ref":"#/components/schemas/entity.RemediationGroup"},"type":"array"},"drifted":{"type":"integer"},"remediated":{"type":"integer"},"rows":{"items":{"$ref":"#/components/schemas/entity.RemediationActivityRow"},"type":"array"},"window_days":{"type":"integer"}},"type":"object"},"entity.RemediationActivityRow":{"properties":{"changed_at":{"type":"string"},"connector_id":{"type":"string"},"domain":{"type":"string"},"finding_id":{"type":"string"},"kind":{"description":"\"remediated\" | \"drifted\"","type":"string"},"policy_id":{"type":"string"},"severity":{"type":"string"}},"type":"object"},"entity.RemediationCampaign":{"properties":{"affected_connectors":{"items":{"type":"string"},"type":"array"},"aggregate_severity":{"$ref":"#/components/schemas/entity.Severity"},"category":{"type":"string"},"description":{"type":"string"},"drifted_count":{"type":"integer"},"estimated_minutes":{"type":"integer"},"finding_count":{"type":"integer"},"open_count":{"type":"integer"},"progress_pct":{"type":"number"},"recommended_steps":{"items":{"$ref":"#/components/schemas/entity.CampaignStep"},"type":"array"},"regression_count":{"type":"integer"},"resolved_count":{"type":"integer"},"title":{"type":"string"}},"type":"object"},"entity.RemediationGroup":{"properties":{"drifted":{"type":"integer"},"key":{"type":"string"},"remediated":{"type":"integer"}},"type":"object"},"entity.RemediationInfo":{"properties":{"admin_console_url":{"example":"https://admin.okta.com/admin/access/multifactor","type":"string"},"difficulty":{"example":"medium","type":"string"},"docs_url":{"example":"https://help.okta.com/oie/Content/Topics/Security/mfa/mfa-home.htm","type":"string"},"estimated_minutes":{"example":15,"type":"integer"},"impact_if_ignored":{"type":"string"},"prerequisites":{"example":"Requires Okta Super Admin role","type":"string"},"rollback_risk":{"type":"string"},"root_cause":{"type":"string"},"steps":{"items":{"type":"string"},"type":"array"},"summary":{"example":"Require MFA for all Okta super-admins","type":"string"}},"type":"object"},"entity.RemediationRun":{"properties":{"actions":{"items":{"$ref":"#/components/schemas/entity.RemediationAction"},"type":"array"},"agent_count":{"type":"integer"},"completed_at":{"type":"string"},"created_at":{"type":"string"},"governance_rule_id":{"type":"string"},"heartbeat_at":{"type":"string"},"id":{"type":"string"},"playbook_id":{"type":"string"},"status":{"$ref":"#/components/schemas/entity.RemediationStatus"},"target_id":{"type":"string"},"target_type":{"type":"string"},"tenant_id":{"type":"string"},"trigger_type":{"type":"string"},"triggered_by":{"type":"string"}},"type":"object"},"entity.RemediationRunPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.RemediationRun"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.RemediationStatus":{"enum":["pending","running","completed","partial_failure","failed"],"type":"string","x-enum-varnames":["RemediationStatusPending","RemediationStatusRunning","RemediationStatusCompleted","RemediationStatusPartialFailure","RemediationStatusFailed"]},"entity.Report":{"properties":{"completed_at":{"description":"When generation finished","example":"2026-02-23T10:01:00Z","type":"string"},"created_at":{"description":"Creation timestamp","example":"2026-02-23T10:00:00Z","type":"string"},"created_by":{"description":"Identity that requested the report","example":"jane@example.com","type":"string"},"error_message":{"description":"Error details if generation failed","example":"","type":"string"},"expires_at":{"description":"When the report expires","example":"2026-03-25T10:00:00Z","type":"string"},"file_name":{"description":"Download file name","example":"report-2026-02-23.csv","type":"string"},"file_size":{"description":"Generated file size in bytes","example":102400,"type":"integer"},"format":{"allOf":[{"$ref":"#/components/schemas/entity.ReportFormat"}],"description":"Output format","example":"csv"},"framework_id":{"description":"Compliance framework (for compliance reports)","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"id":{"description":"Unique report identifier","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"record_count":{"description":"Number of records in the report","example":500,"type":"integer"},"scan_ids":{"description":"Scans included in the report","example":["scan-1","scan-2"],"items":{"type":"string"},"type":"array"},"schedule_id":{"description":"Associated report schedule","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.ReportStatus"}],"description":"Job state","example":"completed"},"tenant_id":{"description":"Owning tenant","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"}},"type":"object"},"entity.ReportFilters":{"properties":{"connector_ids":{"items":{"type":"string"},"type":"array"},"framework_id":{"type":"string"},"severity":{"items":{"type":"string"},"type":"array"}},"type":"object"},"entity.ReportFormat":{"enum":["csv","pdf","compliance_pdf","compliance_csv","evidence_package","ai_inventory","security_digest","exception_register","executive_report","access_review","identity_population","offboarding_sla","dora_register"],"type":"string","x-enum-varnames":["ReportFormatCSV","ReportFormatPDF","ReportFormatCompliancePDF","ReportFormatComplianceCSV","ReportFormatEvidencePackage","ReportFormatAIInventory","ReportFormatSecurityDigest","ReportFormatExceptionRegister","ReportFormatExecutive","ReportFormatAccessReview","ReportFormatIdentityPopulation","ReportFormatOffboardingSLA","ReportFormatDORARegister"]},"entity.ReportSchedule":{"properties":{"created_at":{"type":"string"},"created_by":{"type":"string"},"deliver_email":{"type":"boolean"},"deliver_slack":{"type":"boolean"},"delivery_channels":{"items":{"$ref":"#/components/schemas/entity.DeliveryChannel"},"type":"array"},"enabled":{"type":"boolean"},"filters":{"$ref":"#/components/schemas/entity.ReportFilters"},"id":{"type":"string"},"interval":{"$ref":"#/components/schemas/entity.ScheduleInterval"},"last_run_at":{"type":"string"},"name":{"type":"string"},"next_run_at":{"type":"string"},"report_type":{"type":"string"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.ReportStatus":{"enum":["pending","processing","completed","failed","expired"],"type":"string","x-enum-varnames":["ReportStatusPending","ReportStatusProcessing","ReportStatusCompleted","ReportStatusFailed","ReportStatusExpired"]},"entity.ResourceActivity":{"properties":{"activity_type":{"example":"properties_changed","type":"string"},"changed_properties":{"type":"object"},"created_at":{"type":"string"},"id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"resource_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"},"scan_id":{"example":"550e8400-e29b-41d4-a716-446655440003","type":"string"},"summary":{"example":"is_public changed","type":"string"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440002","type":"string"}},"type":"object"},"entity.ResourceActivityPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.ResourceActivity"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.ResourceCursorListResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.ResourceRecord"},"type":"array"},"facets":{"$ref":"#/components/schemas/entity.ResourceFacets"},"pagination":{"$ref":"#/components/schemas/entity.CursorMeta"}},"type":"object"},"entity.ResourceFacets":{"properties":{"by_connector":{"items":{"$ref":"#/components/schemas/entity.ConnectorFacet"},"type":"array"},"by_severity":{"additionalProperties":{"type":"integer"},"type":"object"},"by_type":{"additionalProperties":{"type":"integer"},"type":"object"},"externally_shared":{"type":"integer"},"top_owner_emails":{"items":{"$ref":"#/components/schemas/entity.OwnerEmailFacet"},"type":"array"},"with_open_findings":{"type":"integer"}},"type":"object"},"entity.ResourceFetchResult":{"properties":{"category":{"type":"string"},"count":{"type":"integer"},"error":{"type":"string"},"resource_type":{"type":"string"},"status":{"type":"string"}},"type":"object"},"entity.ResourceIdentityLink":{"properties":{"connector_id":{"example":"550e8400-e29b-41d4-a716-446655440002","type":"string"},"display_name":{"example":"John Doe","type":"string"},"email":{"example":"john@example.com","type":"string"},"external_id":{"example":"00u1a2b3c4d5e6f7g8","type":"string"},"identity_id":{"example":"id-001","type":"string"},"last_activity_at":{"type":"string"},"resource_id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"resource_name":{"example":"john@example.com","type":"string"},"resource_type":{"example":"user","type":"string"},"role":{"example":"admin","type":"string"}},"type":"object"},"entity.ResourceRecord":{"properties":{"connector_id":{"example":"550e8400-e29b-41d4-a716-446655440002","type":"string"},"external_id":{"example":"00u1a2b3c4d5e6f7g8","type":"string"},"first_discovered_at":{"type":"string"},"id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"is_externally_shared":{"type":"boolean"},"last_changed_at":{"type":"string"},"last_scan_id":{"type":"string"},"last_seen_at":{"type":"string"},"max_priority_score":{"type":"number"},"max_severity":{"type":"string"},"open_finding_count":{"type":"integer"},"owner_email":{"type":"string"},"properties":{"type":"object"},"resource_name":{"example":"john@example.com","type":"string"},"resource_type":{"example":"user","type":"string"},"risk_factors":{"items":{"type":"string"},"type":"array"},"status":{"type":"string"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"}},"type":"object"},"entity.ResourceSummary":{"properties":{"by_type":{"additionalProperties":{"type":"integer"},"type":"object"},"externally_shared":{"type":"integer"},"total_resources":{"type":"integer"},"with_open_findings":{"type":"integer"}},"type":"object"},"entity.ReviewCampaign":{"properties":{"closed_at":{"type":"string"},"created_at":{"type":"string"},"created_by":{"type":"string"},"created_by_email":{"type":"string"},"due_at":{"type":"string"},"id":{"type":"string"},"last_reminder_at":{"type":"string"},"launched_at":{"type":"string"},"name":{"type":"string"},"report_id":{"type":"string"},"scope_connector_ids":{"items":{"type":"string"},"type":"array"},"scope_type":{"$ref":"#/components/schemas/entity.ReviewScopeType"},"status":{"$ref":"#/components/schemas/entity.ReviewCampaignStatus"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"},"version":{"type":"integer"}},"type":"object"},"entity.ReviewCampaignPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.ReviewCampaign"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.ReviewCampaignProgress":{"properties":{"decided_items":{"type":"integer"},"flagged_items":{"type":"integer"},"grants":{"items":{"$ref":"#/components/schemas/entity.ReviewGrantProgress"},"type":"array"},"revoke_items":{"type":"integer"},"total_items":{"type":"integer"}},"type":"object"},"entity.ReviewCampaignStatus":{"enum":["draft","active","closed","cancelled"],"type":"string","x-enum-comments":{"ReviewCampaignStatusCancelled":"nolint:misspell // British spelling matches DB column and migration"},"x-enum-descriptions":["","","","nolint:misspell // British spelling matches DB column and migration"],"x-enum-varnames":["ReviewCampaignStatusDraft","ReviewCampaignStatusActive","ReviewCampaignStatusClosed","ReviewCampaignStatusCancelled"]},"entity.ReviewDecision":{"enum":["keep","revoke","flag"],"type":"string","x-enum-varnames":["ReviewDecisionKeep","ReviewDecisionRevoke","ReviewDecisionFlag"]},"entity.ReviewGrantProgress":{"properties":{"connector_id":{"type":"string"},"decided_items":{"type":"integer"},"grant_id":{"type":"string"},"reviewer_email":{"type":"string"},"signed_off_at":{"type":"string"},"total_items":{"type":"integer"}},"type":"object"},"entity.ReviewItem":{"properties":{"campaign_id":{"type":"string"},"canonical_person_id":{"type":"string"},"connector_id":{"type":"string"},"connector_name":{"type":"string"},"connector_type":{"type":"string"},"created_at":{"type":"string"},"decided_at":{"type":"string"},"decided_by_email":{"type":"string"},"decision":{"$ref":"#/components/schemas/entity.ReviewDecision"},"finding_count":{"type":"integer"},"id":{"type":"string"},"identity_display_name":{"type":"string"},"identity_email":{"type":"string"},"identity_id":{"type":"string"},"identity_role":{"type":"string"},"identity_type":{"type":"string"},"is_privileged":{"type":"boolean"},"justification":{"type":"string"},"last_activity_at":{"type":"string"},"mfa_enabled":{"type":"boolean"},"remediation_assignee_id":{"type":"string"},"reviewer_grant_id":{"type":"string"},"risk_score":{"type":"integer"},"snapshot_properties":{"additionalProperties":{},"type":"object"},"tenant_id":{"type":"string"},"ticket_ref":{"type":"string"},"updated_at":{"type":"string"},"verification_status":{"$ref":"#/components/schemas/entity.ReviewVerificationStatus"},"verified_at":{"type":"string"}},"type":"object"},"entity.ReviewItemPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.ReviewItem"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.ReviewScopeType":{"enum":["privileged_all","connector_all","nhi_all"],"type":"string","x-enum-varnames":["ReviewScopePrivilegedAll","ReviewScopeConnectorAll","ReviewScopeNHIAll"]},"entity.ReviewVerificationStatus":{"enum":["not_applicable","pending","verified_gone","still_present"],"type":"string","x-enum-varnames":["ReviewVerificationNotApplicable","ReviewVerificationPending","ReviewVerificationVerifiedGone","ReviewVerificationStillPresent"]},"entity.ReviewerGrant":{"properties":{"campaign_id":{"type":"string"},"connector_id":{"type":"string"},"created_at":{"type":"string"},"expires_at":{"type":"string"},"id":{"type":"string"},"last_accessed_at":{"type":"string"},"reviewer_email":{"type":"string"},"revoked_at":{"type":"string"},"sign_off_statement":{"type":"string"},"signed_off_at":{"type":"string"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.RevocationAction":{"properties":{"action":{"type":"string"},"deep_link":{"type":"string"},"label":{"type":"string"},"reversible":{"type":"boolean"},"severity":{"type":"string"},"steps":{"items":{"type":"string"},"type":"array"}},"type":"object"},"entity.RevocationGuide":{"properties":{"actions":{"items":{"$ref":"#/components/schemas/entity.RevocationAction"},"type":"array"},"admin_portal":{"type":"string"},"docs_url":{"type":"string"},"platform":{"$ref":"#/components/schemas/entity.AIAgentPlatform"}},"type":"object"},"entity.RiskConfidence":{"enum":["high","medium","low"],"type":"string","x-enum-varnames":["RiskConfidenceHigh","RiskConfidenceMedium","RiskConfidenceLow"]},"entity.RiskTrend":{"properties":{"change_percent":{"description":"Percentage change (negative = improving)","example":-17.2,"type":"number"},"current_score":{"description":"Most recent aggregate score","example":35.2,"type":"number"},"direction":{"description":"Overall trend: improving, stable, degrading","example":"improving","type":"string"},"high_risk_change":{"description":"Change in high-risk identity count","example":-2,"type":"integer"},"points":{"description":"Daily trend data points","items":{"$ref":"#/components/schemas/entity.RiskTrendPoint"},"type":"array"},"previous_score":{"description":"Score from comparison period","example":42.5,"type":"number"}},"type":"object"},"entity.RiskTrendPoint":{"properties":{"average_score":{"description":"Average risk score for the period","example":42.5,"type":"number"},"date":{"description":"Date (YYYY-MM-DD)","example":"2026-03-15","type":"string"},"high_risk_count":{"description":"Number of identities with score > 70","example":5,"type":"integer"},"total_snapshots":{"description":"Total identity snapshots in period","example":120,"type":"integer"}},"type":"object"},"entity.SLAPolicy":{"properties":{"created_at":{"type":"string"},"escalation_channels":{"items":{"type":"string"},"type":"array"},"id":{"type":"string"},"is_active":{"type":"boolean"},"name":{"type":"string"},"rules":{"items":{"$ref":"#/components/schemas/entity.SLARule"},"type":"array"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.SLARule":{"properties":{"escalation_hours":{"type":"integer"},"response_hours":{"type":"integer"},"severity":{"$ref":"#/components/schemas/entity.Severity"}},"type":"object"},"entity.Scan":{"properties":{"cancelled_at":{"type":"string"},"cancelled_by":{"type":"string"},"completed_at":{"description":"When the scan finished","example":"2025-01-15T10:35:00Z","type":"string"},"connector_id":{"description":"Connector being scanned","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"created_at":{"description":"Creation timestamp","example":"2025-01-15T10:30:00Z","type":"string"},"delta_resource_count":{"description":"Set on delta scans only: resources the delta fetch returned, summed over all resource types, including types fetched in full","example":5,"type":"integer"},"error_message":{"description":"Error details if scan failed","example":"","type":"string"},"failed_resource_count":{"description":"FailedResourceCount is the number of resource types whose fetch failed during the scan.","example":1,"type":"integer"},"failed_resource_types":{"description":"FailedResourceTypes lists the specific resource types that failed to fetch (rate limit, 5xx, etc.).\nSerialized as JSONB; empty list for clean scans.","example":["drive_file"],"items":{"type":"string"},"type":"array"},"fallback_from_edge":{"description":"Whether this scan fell back from edge to origin","example":false,"type":"boolean"},"fallback_reason":{"description":"Reason for edge-to-origin fallback","example":"","type":"string"},"finalize_warnings":{"description":"Non-fatal warnings emitted during scan finalization","items":{"$ref":"#/components/schemas/entity.ScanWarning"},"type":"array"},"id":{"description":"Unique scan identifier","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"is_delta":{"description":"Whether this was a delta/incremental scan","example":false,"type":"boolean"},"requested_resource_types":{"description":"RequestedResourceTypes is the original set of resource types the scan was\nasked to cover, before any cooldown or other filtering. ResourceTypes is the\nsubset that was actually scanned. When the two differ, the difference is\n\"skipped\" (e.g., drive_file cooldown).","example":["user","drive_file"],"items":{"type":"string"},"type":"array"},"resource_fetch_results":{"description":"Per-resource-type fetch outcomes","items":{"$ref":"#/components/schemas/entity.ResourceFetchResult"},"type":"array"},"resource_types":{"description":"Resource types actually scanned (post-cooldown; see RequestedResourceTypes for pre-filter set)","example":["user","application"],"items":{"type":"string"},"type":"array"},"started_at":{"description":"When the scan started","example":"2025-01-15T10:30:00Z","type":"string"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.ScanStatus"}],"description":"Scan state (pending, running, completed, failed)","example":"completed"},"tenant_id":{"description":"Owning tenant","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"total_findings":{"description":"Number of findings produced","example":42,"type":"integer"}},"type":"object"},"entity.ScanAlertEvent":{"enum":["scan_completed","scan_completed_with_warnings","drift_detected"],"type":"string","x-enum-varnames":["AlertEventScanCompleted","AlertEventScanCompletedWithWarnings","AlertEventDriftDetected"]},"entity.ScanCompareCounts":{"properties":{"new":{"description":"Findings only the newer scan observed","example":3,"type":"integer"},"resolved":{"description":"Findings only the older scan observed","example":2,"type":"integer"},"unchanged":{"description":"Findings both scans observed","example":40,"type":"integer"}},"type":"object"},"entity.ScanCompareResult":{"properties":{"bucket":{"allOf":[{"$ref":"#/components/schemas/entity.CompareBucket"}],"description":"The bucket the items belong to","example":"new"},"counts":{"allOf":[{"$ref":"#/components/schemas/entity.ScanCompareCounts"}],"description":"The size of every bucket"},"items":{"description":"One page of the bucket","items":{"$ref":"#/components/schemas/entity.ObservedFinding"},"type":"array"},"newer_scan_id":{"description":"The current scan","example":"550e8400-e29b-41d4-a716-446655440001","type":"string"},"older_scan_id":{"description":"The baseline scan","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"total":{"description":"Findings in the whole bucket","example":3,"type":"integer"},"withheld":{"description":"Findings of the bucket the plan's visible window hides","example":2,"type":"integer"}},"type":"object"},"entity.ScanFindingsPage":{"properties":{"items":{"description":"One page of the scan's findings","items":{"$ref":"#/components/schemas/entity.ObservedFinding"},"type":"array"},"per_scan_detail_available":{"description":"Items are what the scan observed, with their at-scan fields","example":true,"type":"boolean"},"total":{"description":"Findings in the whole listing","example":42,"type":"integer"},"withheld":{"description":"Findings the plan's visible window hides","example":3,"type":"integer"}},"type":"object"},"entity.ScanProgress":{"properties":{"fetched":{"type":"integer"},"items":{"items":{"$ref":"#/components/schemas/entity.EdgeScanProgress"},"type":"array"},"scan_id":{"type":"string"},"status":{"$ref":"#/components/schemas/entity.ScanStatus"},"total":{"type":"integer"}},"type":"object"},"entity.ScanSchedule":{"properties":{"connector_id":{"description":"Connector to scan","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"consecutive_failures":{"description":"Number of consecutive trigger failures","example":0,"type":"integer"},"created_at":{"description":"Creation timestamp","example":"2026-02-24T10:00:00Z","type":"string"},"enabled":{"description":"Whether this schedule is active","example":true,"type":"boolean"},"id":{"description":"Unique identifier","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"interval":{"allOf":[{"$ref":"#/components/schemas/entity.ScheduleInterval"}],"description":"Recurring frequency","example":"every_1h"},"last_error":{"description":"Last trigger failure message","example":"","type":"string"},"last_run_at":{"description":"Last execution timestamp","example":"2026-02-24T11:00:00Z","type":"string"},"last_scan_id":{"description":"Last triggered scan ID","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"managed":{"description":"Platform-managed schedule (cannot be deleted by client)","example":false,"type":"boolean"},"next_run_at":{"description":"Next scheduled execution","example":"2026-02-24T12:00:00Z","type":"string"},"resource_types":{"description":"Resource types to scan","example":["user","application"],"items":{"type":"string"},"type":"array"},"tenant_id":{"description":"Owning tenant","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"updated_at":{"description":"Last update timestamp","example":"2026-02-24T10:00:00Z","type":"string"}},"type":"object"},"entity.ScanStatus":{"enum":["pending","running","completed","completed_with_warnings","failed","fetching_edge","cancelling","cancelled"],"type":"string","x-enum-comments":{"ScanStatusCancelled":"nolint:misspell // British spelling matches DB column and migration","ScanStatusCancelling":"nolint:misspell // British spelling matches DB column and migration"},"x-enum-descriptions":["","","","","","","nolint:misspell // British spelling matches DB column and migration","nolint:misspell // British spelling matches DB column and migration"],"x-enum-varnames":["ScanStatusPending","ScanStatusRunning","ScanStatusCompleted","ScanStatusCompletedWithWarnings","ScanStatusFailed","ScanStatusFetchingEdge","ScanStatusCancelling","ScanStatusCancelled"]},"entity.ScanWarning":{"properties":{"code":{"type":"string"},"detail":{"type":"string"},"rule_id":{"type":"string"}},"type":"object"},"entity.ScheduleInterval":{"enum":["every_15m","every_30m","every_1h","every_6h","daily","weekly","monthly"],"type":"string","x-enum-varnames":["ScheduleIntervalEvery15m","ScheduleIntervalEvery30m","ScheduleIntervalEvery1h","ScheduleIntervalEvery6h","ScheduleIntervalDaily","ScheduleIntervalWeekly","ScheduleIntervalMonthly"]},"entity.ScoreHistoryPoint":{"properties":{"day":{"description":"YYYY-MM-DD, UTC","type":"string"},"grade":{"$ref":"#/components/schemas/entity.PostureGrade"},"score":{"type":"number"}},"type":"object"},"entity.SetupAction":{"properties":{"cta_href":{"type":"string"},"key":{"type":"string"},"label":{"type":"string"},"priority":{"type":"integer"}},"type":"object"},"entity.SetupStatus":{"properties":{"action_required":{"$ref":"#/components/schemas/entity.SetupAction"},"first_scan_completed":{"type":"boolean"},"next_step":{"$ref":"#/components/schemas/entity.SetupStep"},"overall_progress":{"type":"number"},"steps":{"items":{"$ref":"#/components/schemas/entity.SetupStep"},"type":"array"}},"type":"object"},"entity.SetupStep":{"properties":{"completed_at":{"type":"string"},"key":{"type":"string"},"label":{"type":"string"},"status":{"type":"string"}},"type":"object"},"entity.Severity":{"enum":["critical","high","medium","low","info"],"type":"string","x-enum-varnames":["SeverityCritical","SeverityHigh","SeverityMedium","SeverityLow","SeverityInfo"]},"entity.SeverityBreakdown":{"properties":{"critical":{"example":1,"type":"integer"},"high":{"example":2,"type":"integer"},"info":{"example":0,"type":"integer"},"low":{"example":1,"type":"integer"},"medium":{"example":3,"type":"integer"}},"type":"object"},"entity.SeverityCounts":{"properties":{"critical":{"type":"integer"},"high":{"type":"integer"},"info":{"type":"integer"},"low":{"type":"integer"},"medium":{"type":"integer"}},"type":"object"},"entity.SeverityOverride":{"properties":{"approval_chain_id":{"type":"string"},"approved_by_email":{"type":"string"},"connector_id":{"type":"string"},"created_at":{"type":"string"},"created_by_email":{"type":"string"},"expires_at":{"type":"string"},"id":{"type":"string"},"justification":{"type":"string"},"original_severity":{"$ref":"#/components/schemas/entity.Severity"},"policy_id":{"type":"string"},"requested_severity":{"$ref":"#/components/schemas/entity.Severity"},"resource_id":{"type":"string"},"resource_type":{"type":"string"},"revoked_at":{"type":"string"},"revoked_by_email":{"type":"string"},"scope":{"$ref":"#/components/schemas/entity.SeverityOverrideScope"},"status":{"$ref":"#/components/schemas/entity.SeverityOverrideStatus"},"target_id":{"type":"string"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.SeverityOverridePagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.SeverityOverride"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.SeverityOverrideScope":{"enum":["policy","finding"],"type":"string","x-enum-varnames":["ScopePolicy","ScopeFinding"]},"entity.SeverityOverrideStatus":{"enum":["pending_approval","active","revoked","expired","rejected"],"type":"string","x-enum-varnames":["OverridePendingApproval","OverrideActive","OverrideRevoked","OverrideExpired","OverrideRejected"]},"entity.SnoozeMode":{"enum":["until_time","until_next_scan"],"type":"string","x-enum-varnames":["SnoozeModeUntilTime","SnoozeModeUntilNextScan"]},"entity.SuspectedDuplicatePerson":{"properties":{"display_name":{"type":"string"},"id":{"type":"string"},"primary_email":{"type":"string"},"reason":{"type":"string"}},"type":"object"},"entity.TenantPolicy":{"properties":{"connector_type":{"allOf":[{"$ref":"#/components/schemas/entity.ConnectorType"}],"example":"okta"},"created_at":{"example":"2025-01-01T00:00:00Z","type":"string"},"description":{"example":"Checks custom MFA requirements","type":"string"},"enabled":{"example":true,"type":"boolean"},"id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"name":{"example":"Custom MFA check","type":"string"},"rego_source":{"example":"package sspm\nviolation[msg] { ... }","type":"string"},"resource_type":{"example":"user","type":"string"},"severity":{"allOf":[{"$ref":"#/components/schemas/entity.Severity"}],"example":"high"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"},"updated_at":{"example":"2025-01-10T12:00:00Z","type":"string"}},"type":"object"},"entity.TenantPolicyOverride":{"properties":{"created_at":{"type":"string"},"enabled":{"example":false,"type":"boolean"},"policy_id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"}},"type":"object"},"entity.ThirdPartyApp":{"properties":{"ai_data_scopes":{"items":{"type":"string"},"type":"array"},"ai_detection_reason":{"type":"string"},"ai_publisher":{"description":"Publisher of the AI service. Set only when a single app is fetched.","type":"string"},"ai_risk_rationale":{"type":"string"},"ai_soc2_certified":{"type":"string"},"ai_source":{"type":"string"},"ai_stores_prompts":{"type":"string"},"ai_subcategory":{"type":"string"},"ai_trains_on_data":{"type":"string"},"app_id":{"type":"string"},"authorizer_count":{"description":"Blast-radius metrics: token-theft reach computed after BulkUpsert; persisted for ranked views.","type":"integer"},"authorizer_offboarded_count":{"type":"integer"},"authorizer_privileged_count":{"type":"integer"},"canonical_id":{"description":"Canonical app identity (Phase 0 schema; populated by reconcile / scanner in later phases).\ncanonical_id + merge_locked* are reconcile-owned; vendor_external_id is scanner-owned.","type":"string"},"categories":{"items":{"type":"string"},"type":"array"},"connector_id":{"type":"string"},"connector_type":{"$ref":"#/components/schemas/entity.ConnectorType"},"created_at":{"type":"string"},"data_categories":{"items":{"$ref":"#/components/schemas/entity.DataCategoryAccess"},"type":"array"},"data_category_count":{"type":"integer"},"enriched_scopes":{"items":{"$ref":"#/components/schemas/entity.EnrichedScope"},"type":"array"},"first_seen_at":{"type":"string"},"governance_rule_id":{"type":"string"},"has_sensitive_scopes":{"type":"boolean"},"id":{"type":"string"},"is_ai_app":{"type":"boolean"},"last_activity_at":{"description":"LastActivityAt is the latest consent-change timestamp sourced from OAuth grant\nmetadata (e.g. Okta grant LastUpdated/Created). NULL means unknown (no backfill).\nSemantics: last consent *change*, not last *use*; label accordingly in the UI.","type":"string"},"last_seen_at":{"type":"string"},"merge_locked":{"type":"boolean"},"merge_locked_at":{"type":"string"},"merge_locked_by":{"type":"string"},"name":{"type":"string"},"publisher":{"type":"string"},"reach_score":{"type":"integer"},"review_reasons":{"description":"Why the app needs review. Set on review-queue and search results only.","items":{"type":"string"},"type":"array"},"revocation_requested_at":{"type":"string"},"revocation_status":{"type":"string"},"risk":{"$ref":"#/components/schemas/entity.ThirdPartyAppRisk"},"scope_expanded_at":{"type":"string"},"scope_hash":{"type":"string"},"scopes":{"items":{"type":"string"},"type":"array"},"sensitive_scope_categories":{"items":{"type":"string"},"type":"array"},"status":{"$ref":"#/components/schemas/entity.ThirdPartyAppStatus"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"},"user_count":{"type":"integer"},"users":{"items":{"type":"string"},"type":"array"},"vendor_external_id":{"type":"string"}},"type":"object"},"entity.ThirdPartyAppExport":{"properties":{"created_at":{"type":"string"},"error_message":{"type":"string"},"expires_at":{"type":"string"},"file_name":{"type":"string"},"file_size":{"type":"integer"},"filters":{"type":"object"},"format":{"type":"string"},"id":{"type":"string"},"record_count":{"type":"integer"},"status":{"$ref":"#/components/schemas/entity.ThirdPartyAppExportStatus"},"tenant_id":{"type":"string"}},"type":"object"},"entity.ThirdPartyAppExportStatus":{"enum":["pending","processing","completed","failed"],"type":"string","x-enum-varnames":["ThirdPartyAppExportStatusPending","ThirdPartyAppExportStatusProcessing","ThirdPartyAppExportStatusCompleted","ThirdPartyAppExportStatusFailed"]},"entity.ThirdPartyAppPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.ThirdPartyApp"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"entity.ThirdPartyAppRisk":{"enum":["critical","high","medium","low","unknown"],"type":"string","x-enum-varnames":["ThirdPartyAppRiskCritical","ThirdPartyAppRiskHigh","ThirdPartyAppRiskMedium","ThirdPartyAppRiskLow","ThirdPartyAppRiskUnknown"]},"entity.ThirdPartyAppStatus":{"enum":["discovered","approved","flagged","blocked"],"type":"string","x-enum-varnames":["ThirdPartyAppStatusDiscovered","ThirdPartyAppStatusApproved","ThirdPartyAppStatusFlagged","ThirdPartyAppStatusBlocked"]},"entity.ThirdPartyAppStub":{"properties":{"canonical_id":{"type":"string"},"has_sensitive_scopes":{"type":"boolean"},"id":{"type":"string"},"name":{"type":"string"},"risk":{"$ref":"#/components/schemas/entity.ThirdPartyAppRisk"},"scopes":{"items":{"type":"string"},"type":"array"}},"type":"object"},"entity.ThirdPartyAppSummary":{"properties":{"ai_apps":{"type":"integer"},"approved":{"type":"integer"},"blocked":{"type":"integer"},"confirmed_ai_apps":{"type":"integer"},"discovered":{"type":"integer"},"distinct_apps":{"type":"integer"},"flagged":{"type":"integer"},"high_risk_apps":{"type":"integer"},"suspected_ai_apps":{"type":"integer"},"total_apps":{"type":"integer"}},"type":"object"},"entity.TicketIssueType":{"properties":{"id":{"type":"string"},"name":{"type":"string"}},"type":"object"},"entity.TicketLink":{"properties":{"created_at":{"type":"string"},"external_key":{"type":"string"},"external_url":{"type":"string"},"finding_id":{"type":"string"},"id":{"type":"string"},"last_sync_at":{"type":"string"},"last_sync_error":{"type":"string"},"provider":{"type":"string"},"retry_count":{"type":"integer"},"sync_status":{"$ref":"#/components/schemas/entity.TicketSyncStatus"},"tenant_id":{"type":"string"},"updated_at":{"type":"string"}},"type":"object"},"entity.TicketSyncStatus":{"enum":["synced","pending","failed"],"type":"string","x-enum-varnames":["TicketSyncStatusSynced","TicketSyncStatusPending","TicketSyncStatusFailed"]},"entity.TicketUser":{"properties":{"account_id":{"type":"string"},"avatar_url":{"type":"string"},"display_name":{"type":"string"},"email":{"type":"string"}},"type":"object"},"entity.TrendMetrics":{"properties":{"net_change":{"type":"integer"},"new":{"type":"integer"},"resolved":{"type":"integer"}},"type":"object"},"entity.TrendPoint":{"properties":{"date":{"example":"2026-03-15T00:00:00Z","type":"string"},"score":{"example":78.5,"type":"number"}},"type":"object"},"request.AssignFindingRequest":{"properties":{"assignee_id":{"description":"Team member ID to assign (null to unassign)","type":"string"}},"type":"object"},"request.BatchDispositionRequest":{"properties":{"ids":{"items":{"type":"string"},"maxItems":500,"minItems":1,"type":"array"}},"required":["ids"],"type":"object"},"request.BatchUpdateAIReviewOwnerRequest":{"properties":{"item_ids":{"items":{"type":"string"},"maxItems":100,"minItems":1,"type":"array"},"owner_email":{"type":"string"},"owner_id":{"type":"string"}},"required":["item_ids"],"type":"object"},"request.BatchUpdateAIReviewStatusRequest":{"properties":{"decision_reason":{"maxLength":2000,"type":"string"},"item_ids":{"items":{"type":"string"},"maxItems":100,"minItems":1,"type":"array"},"status":{"enum":["approved","flagged","blocked"],"type":"string"}},"required":["item_ids","status"],"type":"object"},"request.BatchUpdateAgentOwnerRequest":{"properties":{"agent_ids":{"items":{"type":"string"},"maxItems":100,"minItems":1,"type":"array"},"owner_email":{"type":"string"},"owner_id":{"type":"string"}},"required":["agent_ids"],"type":"object"},"request.BatchUpdateAgentStatusRequest":{"properties":{"agent_ids":{"items":{"type":"string"},"maxItems":100,"minItems":1,"type":"array"},"status":{"enum":["approved","flagged","blocked"],"type":"string"}},"required":["agent_ids","status"],"type":"object"},"request.BulkAlertRequest":{"properties":{"ids":{"example":["[\"550e8400-e29b-41d4-a716-446655440000\"]"],"items":{"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["ids"],"type":"object"},"request.BulkCancelScanRequest":{"properties":{"scan_ids":{"items":{"type":"string"},"maxItems":50,"minItems":1,"type":"array"}},"required":["scan_ids"],"type":"object"},"request.BulkFindingGroupAction":{"properties":{"action":{"enum":["suppress","accept","resolve"],"type":"string"},"connector_id":{"type":"string"},"policy_id":{"type":"string"},"severity":{"$ref":"#/components/schemas/entity.Severity"}},"required":["action","connector_id","policy_id"],"type":"object"},"request.BulkRequestRevocationRequest":{"properties":{"app_ids":{"items":{"type":"string"},"maxItems":500,"minItems":1,"type":"array"}},"required":["app_ids"],"type":"object"},"request.BulkSetDispositionRequest":{"properties":{"disposition":{"enum":["unclassified","in_review","approved","flagged","dismissed"],"type":"string"},"ids":{"items":{"type":"string"},"maxItems":500,"minItems":1,"type":"array"},"note":{"maxLength":2000,"type":"string"}},"required":["disposition","ids"],"type":"object"},"request.BulkStartScanRequest":{"properties":{"connector_ids":{"items":{"type":"string"},"maxItems":50,"minItems":1,"type":"array"},"force_full":{"type":"boolean"},"resource_types":{"items":{"type":"string"},"maxItems":20,"type":"array"}},"required":["connector_ids"],"type":"object"},"request.BulkTestConnectorsRequest":{"properties":{"connector_ids":{"items":{"type":"string"},"maxItems":50,"minItems":1,"type":"array"}},"required":["connector_ids"],"type":"object"},"request.BulkUpdateFindingStatusRequest":{"properties":{"finding_ids":{"description":"Finding IDs to update","items":{"type":"string"},"maxItems":500,"minItems":1,"type":"array"},"status":{"enum":["open","resolved","suppressed","accepted"],"type":"string"}},"required":["finding_ids","status"],"type":"object"},"request.BulkUpdateThirdPartyAppStatusRequest":{"properties":{"app_ids":{"items":{"type":"string"},"maxItems":500,"minItems":1,"type":"array"},"status":{"enum":["discovered","approved","flagged","blocked"],"type":"string"}},"required":["app_ids","status"],"type":"object"},"request.CloneFrameworkRequest":{"properties":{"name":{"example":"My SOC 2 Variant","maxLength":255,"type":"string"}},"required":["name"],"type":"object"},"request.CreateAIReviewItemRequest":{"properties":{"evidence":{"type":"object"},"object_type":{"enum":["shadow_ai_app","managed_ai_project","managed_ai_key","managed_ai_identity","managed_ai_usage_signal","ai_agent"],"type":"string"},"priority_reasons":{"items":{"type":"string"},"maxItems":10,"type":"array"},"provider":{"maxLength":100,"type":"string"},"subtitle":{"maxLength":500,"type":"string"},"title":{"maxLength":500,"minLength":1,"type":"string"}},"required":["object_type","title"],"type":"object"},"request.CreateAgentGovernanceRuleRequest":{"properties":{"cooldown_hours":{"maximum":720,"minimum":1,"type":"integer"},"description":{"maxLength":2000,"type":"string"},"enabled":{"type":"boolean"},"expression":{"maxLength":8000,"minLength":1,"type":"string"},"name":{"maxLength":255,"minLength":1,"type":"string"},"playbook_id":{"maxLength":255,"minLength":1,"type":"string"}},"required":["expression","name","playbook_id"],"type":"object"},"request.CreateAlertRuleRequest":{"properties":{"connector_ids":{"items":{"type":"string"},"type":"array"},"deliver_email":{"example":false,"type":"boolean"},"deliver_slack":{"example":true,"type":"boolean"},"expression":{"example":"severity_at_least(finding.severity, 'high')","maxLength":8000,"type":"string"},"name":{"example":"Critical MFA violations","maxLength":255,"type":"string"},"policy_categories":{"items":{"type":"string"},"type":"array"},"severity_threshold":{"enum":["critical","high","medium","low","info"],"example":"high","type":"string"},"trigger_events":{"items":{"type":"string"},"type":"array"}},"required":["name","severity_threshold"],"type":"object"},"request.CreateAppGovernanceRuleRequest":{"properties":{"action":{"enum":["approve","block","flag","revoke"],"example":"block","type":"string"},"auto_create_finding":{"type":"boolean"},"enabled":{"type":"boolean"},"expression":{"example":"app.risk == 'high' && app.scopes.exists(s, s.contains('write'))","maxLength":8000,"type":"string"},"match_type":{"enum":["exact_name","name_contains","ai_subcategory","risk_level","scope_contains"],"example":"exact_name","type":"string"},"match_value":{"example":"ChatGPT","maxLength":500,"minLength":1,"type":"string"},"name":{"example":"Block ChatGPT","maxLength":255,"minLength":1,"type":"string"},"notify_channels":{"items":{"type":"string"},"maxItems":10,"type":"array"},"notify_on_discovery":{"type":"boolean"}},"required":["action","name"],"type":"object"},"request.CreateAuditExport":{"properties":{"action":{"maxLength":100,"type":"string"},"actor_id":{"type":"string"},"resource_type":{"maxLength":100,"type":"string"},"since":{"type":"string"},"until":{"type":"string"}},"type":"object"},"request.CreateConnectorRequest":{"properties":{"config":{"description":"Provider-specific configuration (JSON object)","type":"object"},"fetch_mode":{"description":"Where resource fetching runs (origin or edge)","enum":["origin","edge"],"example":"origin","type":"string"},"mode":{"description":"Read/write mode; read_only is default","enum":["read_only","read_write"],"example":"read_only","type":"string"},"name":{"description":"Human-readable name","example":"Production Okta","maxLength":255,"type":"string"},"type":{"description":"SaaS platform type","enum":["okta","cloudflare","gcp","workspace","openai","m365","github","gitlab","aws","atlassian","anthropic","zoom","teams","notion","datadog","sentry","slack","1password","lastpass","salesforce","azure","docusign","grafana","grafana_cloud","cloudflare_access","pagerduty","incidentio","discord","vercel","digitalocean","circleci","snowflake","shopify","ovhcloud","akamai","workato","workday","bamboohr","hibob","personio","auth0","bedrock","box","chatgpt_enterprise","chrome_enterprise","dropbox","duo","dust","figma","google_ads","huggingface","jamf","jumpcloud","langsmith","mistral","n8n","openrouter","pingone","servicenow","terraform_cloud"],"example":"okta","type":"string"}},"required":["config","name","type"],"type":"object"},"request.CreateControlRequest":{"properties":{"control_id":{"example":"CUSTOM-1.1","maxLength":50,"type":"string"},"description":{"maxLength":1000,"type":"string"},"name":{"example":"Access Management","maxLength":255,"type":"string"},"parent_id":{"type":"string"},"sort_order":{"example":1,"minimum":0,"type":"integer"}},"required":["control_id","name"],"type":"object"},"request.CreateExceptionRequest":{"properties":{"approved_by":{"description":"Person who approved (optional when approval chain applies)","example":"security-lead@example.com","maxLength":512,"type":"string"},"expires_at":{"description":"Expiration date (RFC3339)","example":"2026-06-01T00:00:00Z","type":"string"},"finding_id":{"description":"Associated finding","example":"f47ac10b-58cc-4372-a567-0e02b2c3d479","type":"string"},"justification":{"description":"Reason for the exception","example":"Risk accepted per annual review","maxLength":2048,"type":"string"}},"required":["expires_at","finding_id","justification"],"type":"object"},"request.CreateFindingExportRequest":{"properties":{"filters":{"allOf":[{"$ref":"#/components/schemas/request.FindingExportFilters"}],"description":"Typed export filters"},"format":{"description":"Export format (csv or ndjson)","enum":["csv","ndjson"],"type":"string"}},"required":["format"],"type":"object"},"request.CreateFrameworkRequest":{"properties":{"description":{"example":"Custom HIPAA framework","maxLength":1000,"type":"string"},"name":{"example":"HIPAA Custom","maxLength":255,"type":"string"},"version":{"example":"2024","maxLength":50,"type":"string"}},"required":["name","version"],"type":"object"},"request.CreateReportRequest":{"properties":{"as_of":{"description":"identity_population parameters. AsOf is a date-only \"YYYY-MM-DD\" (UTC): empty\nor today = current state from live data; a past date resolves to the nearest\ncompleted population snapshot. Malformed/future/pre-first-snapshot as_of are\nrejected synchronously (400/400/422) before the async job is enqueued. Status,\nIdentityType, and ConnectorID are optional scoping filters.","example":"2026-07-01","type":"string"},"campaign_id":{"description":"Access-review campaign (required for access_review reports)","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"connector_id":{"description":"Optional connector filter (identity_population)","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"format":{"description":"Report format","enum":["csv","pdf","compliance_pdf","compliance_csv","evidence_package","ai_inventory","executive_report","exception_register","access_review","identity_population","offboarding_sla","dora_register"],"example":"csv","type":"string"},"framework_id":{"description":"Compliance framework (required for compliance reports)","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"from":{"description":"offboarding_sla window. From/To are date-only \"YYYY-MM-DD\" (UTC) bounding the\noffboarding events included; both empty resolves to a trailing audit window.\nA malformed date or an inverted range is rejected synchronously (400) before\nthe async job is enqueued.","example":"2026-04-01","type":"string"},"identity_type":{"description":"Optional identity-type filter (identity_population)","enum":["human","service_account","bot","api_key","oauth_app","unknown"],"example":"human","type":"string"},"scan_ids":{"description":"Scans to include","example":["a1b2c3d4-e5f6-7890-abcd-ef1234567890"],"items":{"type":"string"},"maxItems":50,"type":"array"},"status":{"description":"Optional status filter (identity_population)","enum":["active","suspended","deprovisioned"],"example":"active","type":"string"},"to":{"description":"Window end (offboarding_sla)","example":"2026-06-30","type":"string"}},"required":["format"],"type":"object"},"request.CreateReportScheduleRequest":{"properties":{"deliver_email":{"type":"boolean"},"deliver_slack":{"type":"boolean"},"delivery_channels":{"items":{"$ref":"#/components/schemas/entity.DeliveryChannel"},"type":"array"},"enabled":{"type":"boolean"},"filters":{"$ref":"#/components/schemas/entity.ReportFilters"},"interval":{"enum":["daily","weekly","monthly"],"type":"string"},"name":{"maxLength":255,"minLength":1,"type":"string"},"report_type":{"enum":["csv","pdf","compliance_pdf","compliance_csv"],"type":"string"}},"required":["interval","name","report_type"],"type":"object"},"request.CreateSLAPolicyRequest":{"properties":{"escalation_channels":{"items":{"type":"string"},"maxItems":10,"type":"array"},"name":{"maxLength":100,"minLength":1,"type":"string"},"rules":{"items":{"$ref":"#/components/schemas/request.SLARuleInput"},"type":"array"}},"required":["name","rules"],"type":"object"},"request.CreateScanScheduleRequest":{"properties":{"connector_id":{"description":"Connector to schedule","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"interval":{"description":"Recurring frequency","enum":["every_15m","every_30m","every_1h","every_6h","daily","weekly","monthly"],"example":"every_1h","type":"string"},"resource_types":{"description":"Resource types to scan","example":["user","application"],"items":{"type":"string"},"maxItems":20,"type":"array"}},"required":["connector_id","interval"],"type":"object"},"request.CreateSeverityOverrideRequest":{"properties":{"expires_at":{"type":"string"},"justification":{"maxLength":2000,"minLength":10,"type":"string"},"requested_severity":{"enum":["critical","high","medium","low","info"],"type":"string"},"scope":{"enum":["policy","finding"],"type":"string"},"target_id":{"type":"string"}},"required":["justification","requested_severity","scope","target_id"],"type":"object"},"request.CreateTenantPolicyRequest":{"properties":{"connector_type":{"enum":["generic","okta","cloudflare","gcp","workspace","openai","m365","github","gitlab","aws","atlassian","anthropic","zoom","teams","notion","datadog","sentry","slack","1password","lastpass","salesforce","azure","docusign","grafana","grafana_cloud","cloudflare_access","pagerduty","incidentio","discord","vercel","digitalocean","circleci","snowflake","shopify","ovhcloud","akamai","workato","workday","bamboohr","hibob","personio","auth0","bedrock","box","chatgpt_enterprise","chrome_enterprise","dropbox","duo","dust","figma","google_ads","huggingface","jamf","jumpcloud","langsmith","mistral","n8n","openrouter","pingone","servicenow","terraform_cloud"],"example":"okta","type":"string"},"description":{"example":"Checks custom MFA requirements","maxLength":2000,"type":"string"},"enabled":{"example":true,"type":"boolean"},"name":{"example":"Custom MFA check","maxLength":255,"type":"string"},"rego_source":{"example":"package sspm\nviolation[msg] { ... }","maxLength":65536,"type":"string"},"resource_type":{"example":"user","maxLength":255,"type":"string"},"severity":{"enum":["critical","high","medium","low","info"],"example":"high","type":"string"}},"required":["connector_type","name","rego_source","resource_type","severity"],"type":"object"},"request.CreateThirdPartyAppExportRequest":{"properties":{"filters":{"allOf":[{"$ref":"#/components/schemas/request.ThirdPartyAppExportFilters"}],"description":"Typed export filters"},"format":{"description":"Export format (csv or ndjson)","enum":["csv","ndjson"],"type":"string"}},"required":["format"],"type":"object"},"request.CreateTicketRequest":{"properties":{"assignee_id":{"maxLength":255,"type":"string"},"issue_type":{"maxLength":255,"type":"string"}},"required":["issue_type"],"type":"object"},"request.DeclareLoginSourceRequest":{"properties":{"idp_connector_id":{"description":"Connector ID of the declared identity provider","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"}},"required":["idp_connector_id"],"type":"object"},"request.ExecuteRemediationRequest":{"properties":{"agent_ids":{"items":{"type":"string"},"maxItems":100,"minItems":1,"type":"array"},"force":{"type":"boolean"},"playbook_id":{"type":"string"}},"required":["agent_ids","playbook_id"],"type":"object"},"request.FindingExportFilters":{"properties":{"assignee_id":{"description":"Team member UUID, or \"unassigned\" for findings with no assignee.","type":"string"},"categories":{"items":{"type":"string"},"type":"array"},"connector_ids":{"items":{"type":"string"},"type":"array"},"connector_type":{"type":"string"},"control_id":{"type":"string"},"first_seen_after":{"description":"Date bounds are RFC 3339 on the wire, as the list parses them.","type":"string"},"first_seen_before":{"type":"string"},"framework_id":{"type":"string"},"last_seen_after":{"type":"string"},"last_seen_before":{"type":"string"},"policy_ids":{"items":{"type":"string"},"type":"array"},"priority_max":{"maximum":100,"minimum":0,"type":"number"},"priority_min":{"maximum":100,"minimum":0,"type":"number"},"resolved_after":{"type":"string"},"resolved_before":{"type":"string"},"resource_id":{"type":"string"},"resource_type":{"type":"string"},"scan_id":{"type":"string"},"search":{"maxLength":255,"type":"string"},"severities":{"items":{"type":"string"},"type":"array"},"statuses":{"items":{"type":"string"},"type":"array"},"suppression_source":{"description":"SuppressionSource is tri-state: field absent = no filter; \"\" = only\nnever-suppressed findings; \"sso_coverage\" = only SSO-suppressed ones.\nThe oneof list quotes the empty string ('') because go-playground\nvalidator's omitempty only short-circuits on a nil pointer, not on a\nnon-nil pointer to the zero value — a bare \"oneof=sso_coverage\" would\nreject &\"\" outright.","enum":["","sso_coverage"],"type":"string"}},"type":"object"},"request.PreviewPlaybookRequest":{"properties":{"agent_ids":{"items":{"type":"string"},"maxItems":100,"minItems":1,"type":"array"}},"required":["agent_ids"],"type":"object"},"request.RevokeSeverityOverrideRequest":{"properties":{"reason":{"maxLength":2000,"type":"string"}},"type":"object"},"request.SLARuleInput":{"properties":{"escalation_hours":{"maximum":8760,"minimum":1,"type":"integer"},"response_hours":{"maximum":8760,"minimum":1,"type":"integer"},"severity":{"enum":["critical","high","medium","low"],"type":"string"}},"required":["escalation_hours","response_hours","severity"],"type":"object"},"request.SetControlPoliciesRequest":{"properties":{"policy_ids":{"example":["a1b2c3d4-e5f6-7890-abcd-ef1234567890"],"items":{"type":"string"},"type":"array"}},"required":["policy_ids"],"type":"object"},"request.SetDispositionRequest":{"properties":{"disposition":{"enum":["unclassified","in_review","approved","flagged","dismissed"],"example":"in_review","type":"string"},"note":{"maxLength":2000,"type":"string"},"version":{"minimum":1,"type":"integer"}},"required":["disposition"],"type":"object"},"request.SetPolicyOverrideRequest":{"properties":{"enabled":{"example":false,"type":"boolean"}},"type":"object"},"request.SnoozeAlertRequest":{"properties":{"mode":{"enum":["until_time","until_next_scan"],"example":"until_time","type":"string"},"until":{"example":"2026-04-01T00:00:00Z","type":"string"}},"required":["mode"],"type":"object"},"request.StartScanRequest":{"properties":{"connector_id":{"description":"Connector to scan","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"force_full":{"description":"Force a full scan instead of delta","example":false,"type":"boolean"},"resource_types":{"description":"Resource types to include (empty = all)","example":["user","application"],"items":{"type":"string"},"maxItems":20,"type":"array"}},"required":["connector_id"],"type":"object"},"request.TestPolicyRequest":{"properties":{"input":{"additionalProperties":{},"description":"Sample input for evaluation","type":"object"},"rego_source":{"description":"OPA Rego policy source code","maxLength":65536,"type":"string"}},"required":["input","rego_source"],"type":"object"},"request.ThirdPartyAppExportFilters":{"properties":{"ai_source":{"enum":["catalog","heuristic"],"type":"string"},"ai_subcategory":{"type":"string"},"ai_trains_on_data":{"type":"string"},"connector_id":{"type":"string"},"connector_type":{"type":"string"},"has_sensitive_scopes":{"type":"boolean"},"is_ai_app":{"type":"boolean"},"min_user_count":{"minimum":0,"type":"integer"},"q":{"type":"string"},"review_queue":{"type":"string"},"risk":{"type":"string"},"status":{"type":"string"}},"type":"object"},"request.UpdateAIReviewOwnerRequest":{"properties":{"owner_email":{"type":"string"},"owner_id":{"type":"string"}},"type":"object"},"request.UpdateAIReviewStatusRequest":{"properties":{"decision_reason":{"maxLength":2000,"type":"string"},"status":{"enum":["approved","flagged","blocked"],"type":"string"}},"required":["status"],"type":"object"},"request.UpdateAgentGovernanceRuleRequest":{"properties":{"cooldown_hours":{"maximum":720,"minimum":1,"type":"integer"},"description":{"maxLength":2000,"type":"string"},"enabled":{"type":"boolean"},"expression":{"maxLength":8000,"minLength":1,"type":"string"},"name":{"maxLength":255,"minLength":1,"type":"string"},"playbook_id":{"maxLength":255,"minLength":1,"type":"string"}},"type":"object"},"request.UpdateAgentOwnerRequest":{"properties":{"owner_email":{"type":"string"},"owner_id":{"type":"string"}},"type":"object"},"request.UpdateAgentStatusRequest":{"properties":{"status":{"enum":["discovered","approved","flagged","blocked"],"type":"string"}},"required":["status"],"type":"object"},"request.UpdateAlertRuleRequest":{"properties":{"connector_ids":{"items":{"type":"string"},"type":"array"},"deliver_email":{"type":"boolean"},"deliver_slack":{"type":"boolean"},"enabled":{"type":"boolean"},"expression":{"maxLength":8000,"type":"string"},"name":{"example":"Renamed rule","maxLength":255,"type":"string"},"policy_categories":{"items":{"type":"string"},"type":"array"},"severity_threshold":{"enum":["critical","high","medium","low","info"],"example":"critical","type":"string"},"trigger_events":{"items":{"type":"string"},"type":"array"},"version":{"example":1,"type":"integer"}},"type":"object"},"request.UpdateAppGovernanceRuleRequest":{"properties":{"action":{"enum":["approve","block","flag","revoke"],"example":"flag","type":"string"},"auto_create_finding":{"type":"boolean"},"enabled":{"type":"boolean"},"expression":{"maxLength":8000,"type":"string"},"match_type":{"enum":["exact_name","name_contains","ai_subcategory","risk_level","scope_contains"],"example":"name_contains","type":"string"},"match_value":{"example":"GPT","maxLength":500,"minLength":1,"type":"string"},"name":{"example":"Updated rule name","maxLength":255,"minLength":1,"type":"string"},"notify_channels":{"items":{"type":"string"},"maxItems":10,"type":"array"},"notify_on_discovery":{"type":"boolean"}},"type":"object"},"request.UpdateControlRequest":{"properties":{"description":{"maxLength":1000,"type":"string"},"name":{"maxLength":255,"type":"string"},"sort_order":{"minimum":0,"type":"integer"}},"type":"object"},"request.UpdateFindingStatusRequest":{"properties":{"status":{"description":"New finding status","enum":["open","resolved","suppressed","accepted"],"example":"resolved","type":"string"}},"required":["status"],"type":"object"},"request.UpdateFrameworkRequest":{"properties":{"audit_date":{"example":"2026-06-30T00:00:00Z","type":"string"},"description":{"example":"Updated description","maxLength":1000,"type":"string"},"name":{"example":"HIPAA Custom v2","maxLength":255,"type":"string"},"version":{"example":"2025","maxLength":50,"type":"string"}},"type":"object"},"request.UpdateGeoPolicyRequest":{"properties":{"country_codes":{"items":{"type":"string"},"maxItems":250,"type":"array"},"enabled":{"type":"boolean"},"mode":{"enum":["allow","deny"],"type":"string"},"severity":{"enum":["critical","high","medium","low"],"type":"string"}},"required":["mode","severity"],"type":"object"},"request.UpdateOffboardingSettingsRequest":{"properties":{"auto_send":{"type":"boolean"},"orchestration_enabled":{"type":"boolean"}},"type":"object"},"request.UpdateReportScheduleRequest":{"properties":{"deliver_email":{"type":"boolean"},"deliver_slack":{"type":"boolean"},"delivery_channels":{"items":{"$ref":"#/components/schemas/entity.DeliveryChannel"},"type":"array"},"enabled":{"type":"boolean"},"filters":{"$ref":"#/components/schemas/entity.ReportFilters"},"interval":{"enum":["daily","weekly","monthly"],"type":"string"},"name":{"maxLength":255,"minLength":1,"type":"string"},"report_type":{"type":"string"}},"type":"object"},"request.UpdateSLAPolicyRequest":{"properties":{"escalation_channels":{"items":{"type":"string"},"maxItems":10,"type":"array"},"name":{"maxLength":100,"minLength":1,"type":"string"},"rules":{"items":{"$ref":"#/components/schemas/request.SLARuleInput"},"type":"array"}},"required":["name","rules"],"type":"object"},"request.UpdateScanScheduleRequest":{"properties":{"enabled":{"description":"Enable or disable","type":"boolean"},"interval":{"description":"Updated frequency","enum":["every_15m","every_30m","every_1h","every_6h","daily","weekly","monthly"],"example":"every_6h","type":"string"},"resource_types":{"description":"Updated resource types","example":["user","application"],"items":{"type":"string"},"maxItems":20,"type":"array"}},"type":"object"},"request.UpdateTenantPolicyRequest":{"properties":{"description":{"example":"Updated description","maxLength":2000,"type":"string"},"enabled":{"example":false,"type":"boolean"},"name":{"example":"Updated name","maxLength":255,"type":"string"},"rego_source":{"example":"package sspm\nviolation[msg] { ... }","maxLength":65536,"type":"string"},"resource_type":{"example":"group","maxLength":255,"type":"string"},"severity":{"enum":["critical","high","medium","low","info"],"example":"medium","type":"string"}},"type":"object"},"request.UpdateThirdPartyAppStatusRequest":{"properties":{"status":{"description":"New review status","enum":["discovered","approved","flagged","blocked"],"example":"approved","type":"string"}},"required":["status"],"type":"object"},"response.BulkAppUpdateResult":{"properties":{"updated":{"type":"integer"}},"type":"object"},"response.BulkScanResult":{"properties":{"connector_id":{"type":"string"},"error":{"type":"string"},"limit_type":{"type":"string"},"scan":{"$ref":"#/components/schemas/entity.Scan"}},"type":"object"},"response.CanonicalAppDetail":{"properties":{"connectors":{"description":"Connectors is the deduped union of member connector types.","items":{"type":"string"},"type":"array"},"display_name":{"type":"string"},"id":{"type":"string"},"members":{"items":{"$ref":"#/components/schemas/response.CanonicalAppDetailMember"},"type":"array"},"reach_unavailable_sources":{"description":"ReachUnavailableSources is the number of member connectors that do not\nreport users (github, box, slack, teams, servicenow, ...). When > 0 the\nUI must render \"reach unavailable for N source(s)\" rather than \"0 users\".","type":"integer"},"scopes":{"description":"Scopes is the deduped union of OAuth scopes across all members.","items":{"type":"string"},"type":"array"},"source":{"type":"string"},"user_reach":{"description":"UserReach is the deduped count of distinct users over members from\nuser-reporting connectors only (workspace, m365, okta, dropbox).","type":"integer"},"vendor_key":{"type":"string"}},"type":"object"},"response.CanonicalAppDetailMember":{"properties":{"app_id":{"type":"string"},"connector_id":{"type":"string"},"connector_type":{"type":"string"},"name":{"type":"string"},"risk":{"type":"string"},"scopes":{"items":{"type":"string"},"type":"array"},"third_party_app_id":{"type":"string"},"user_count":{"type":"integer"},"users":{"items":{"type":"string"},"type":"array"}},"type":"object"},"response.CanonicalPersonDetail":{"properties":{"blast_radius":{"items":{"$ref":"#/components/schemas/entity.ThirdPartyAppStub"},"type":"array"},"members":{"items":{"$ref":"#/components/schemas/entity.IdentityRef"},"type":"array"},"owned_nhis":{"items":{"$ref":"#/components/schemas/entity.IdentityStub"},"type":"array"},"person":{"$ref":"#/components/schemas/entity.CanonicalPerson"},"suspected_duplicates":{"items":{"$ref":"#/components/schemas/entity.SuspectedDuplicatePerson"},"type":"array"}},"type":"object"},"response.ConnectorDetail":{"properties":{"created_at":{"description":"Creation timestamp","example":"2025-01-01T00:00:00Z","type":"string"},"data_region":{"description":"Data residency region (eu, us, ap, global)","example":"eu","type":"string"},"dpa_signed_at":{"description":"When the DPA/BAA was signed","example":"2025-06-15T00:00:00Z","type":"string"},"dpa_status":{"description":"DPA/BAA status (signed, pending, not_required)","example":"signed","type":"string"},"edge_support":{"$ref":"#/components/schemas/response.EdgeSupport"},"fetch_mode":{"allOf":[{"$ref":"#/components/schemas/entity.FetchMode"}],"description":"Where resource fetching runs (origin or edge)","example":"origin"},"id":{"description":"Unique identifier","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"last_health_check_at":{"description":"Timestamp of the last health check","example":"2026-03-11T12:00:00Z","type":"string"},"last_health_error":{"description":"Last health check error (nil = healthy)","example":"connection refused","type":"string"},"last_sync_at":{"description":"Timestamp of the last successful sync","example":"2025-01-15T10:30:00Z","type":"string"},"login_source":{"$ref":"#/components/schemas/response.LoginSourceInfo"},"mode":{"$ref":"#/components/schemas/entity.ConnectorMode"},"name":{"description":"Human-readable connector name","example":"Production Okta","type":"string"},"onboarding_scan_id":{"description":"OnboardingScanID is set only by POST /connectors when Create auto-started a scan.","type":"string"},"open_finding_count":{"type":"integer"},"paused_by_system":{"description":"System-paused due to plan downgrade over-limit","example":false,"type":"boolean"},"posture_score":{"description":"Policy pass rate: percentage of enabled policies with no open findings","example":85.5,"type":"number"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.ConnectorStatus"}],"description":"Operational state (active, inactive, error, configuring)","example":"active"},"tenant_id":{"description":"Tenant that owns this connector","example":"tenant-abc-123","type":"string"},"type":{"allOf":[{"$ref":"#/components/schemas/entity.ConnectorType"}],"description":"SaaS platform type (okta, cloudflare, gcp, workspace)","example":"okta"},"updated_at":{"description":"Last update timestamp","example":"2025-01-10T12:00:00Z","type":"string"},"version":{"description":"Optimistic concurrency control version","example":1,"type":"integer"}},"type":"object"},"response.ConnectorLoginSourceState":{"properties":{"connector_id":{"type":"string"},"connector_name":{"type":"string"},"connector_type":{"$ref":"#/components/schemas/entity.ConnectorType"},"idp_capable":{"type":"boolean"},"login_source":{"$ref":"#/components/schemas/response.LoginSourceInfo"},"substitutable_policy_count":{"type":"integer"},"suppressible_finding_count":{"type":"integer"},"verification_state":{"$ref":"#/components/schemas/ssocoverage.Verdict"}},"type":"object"},"response.ContentScanConsentDetail":{"properties":{"acknowledged_at":{"type":"string"},"acknowledgment_version":{"type":"integer"},"actor_email":{"type":"string"},"actor_identity_id":{"type":"string"},"connector_id":{"type":"string"},"created_at":{"type":"string"},"id":{"type":"string"},"needs_reconsent":{"type":"boolean"},"revoked_at":{"type":"string"},"revoked_by":{"type":"string"},"tenant_id":{"type":"string"}},"type":"object"},"response.CountResult":{"properties":{"total":{"type":"integer"}},"type":"object"},"response.EdgeSupport":{"properties":{"supported":{"type":"boolean"}},"type":"object"},"response.Error":{"properties":{"code":{"example":"config_validation_failed","type":"string"},"details":{"items":{"$ref":"#/components/schemas/response.FieldDetail"},"type":"array"},"docs_url":{"example":"https://docs.example.com/connectors/validation-errors#https-url","type":"string"},"error":{"example":"invalid connector configuration","type":"string"},"request_id":{"example":"95e1581fe171f65d9652684c5c0d1f82","type":"string"}},"type":"object"},"response.FieldDetail":{"properties":{"field":{"example":"adminApiKey","type":"string"},"message":{"example":"must start with sk-ant-admin","type":"string"}},"type":"object"},"response.GeoMapCountry":{"properties":{"country_code":{"type":"string"},"disallowed":{"type":"boolean"},"first_seen_count":{"type":"integer"},"identity_count":{"type":"integer"},"login_count":{"type":"integer"},"proxy_count":{"type":"integer"}},"type":"object"},"response.GeoMapResponse":{"properties":{"as_of":{"type":"string"},"countries":{"items":{"$ref":"#/components/schemas/response.GeoMapCountry"},"type":"array"},"total_identities":{"type":"integer"}},"type":"object"},"response.GeoObservation":{"properties":{"app":{"type":"string"},"asn_name":{"type":"string"},"connector":{"type":"string"},"country_code":{"type":"string"},"flags":{"items":{"type":"string"},"type":"array"},"is_datacenter":{"type":"boolean"},"observed_at":{"type":"string"},"source":{"type":"string"},"src_ip":{"type":"string"},"via_sso":{"type":"boolean"}},"type":"object"},"response.GeoObservationsResponse":{"properties":{"observations":{"items":{"$ref":"#/components/schemas/response.GeoObservation"},"type":"array"}},"type":"object"},"response.GeoPolicyResponse":{"properties":{"country_codes":{"items":{"type":"string"},"type":"array"},"enabled":{"type":"boolean"},"mode":{"type":"string"},"severity":{"type":"string"}},"type":"object"},"response.IdentityDetail":{"properties":{"canonical_identity_id":{"type":"string"},"connector_id":{"example":"550e8400-e29b-41d4-a716-446655440001","type":"string"},"created_at":{"example":"2025-01-01T00:00:00Z","type":"string"},"created_by_external_id":{"type":"string"},"deprovisioned_at":{"type":"string"},"display_name":{"example":"John Doe","type":"string"},"email":{"example":"john@example.com","type":"string"},"expires_at":{"type":"string"},"external_id":{"example":"00u1a2b3c4d5e6f7g8","type":"string"},"finding_count":{"description":"Number of open findings on this identity, as returned by the identity\nlist; 0 on other reads.","example":5,"type":"integer"},"id":{"example":"id-001","type":"string"},"identity_type":{"allOf":[{"$ref":"#/components/schemas/entity.IdentityType"}],"example":"human"},"is_privileged":{"description":"Whether the connector reports this identity as privileged, from its admin\nflags and role names. Omitted when the connector gives no privilege signal:\nunknown, not false.","type":"boolean"},"last_activity_at":{"example":"2025-01-20T14:00:00Z","type":"string"},"last_rotated_at":{"type":"string"},"offboarding_handled_at":{"type":"string"},"owner_canonical_identity_id":{"type":"string"},"owner_person":{"$ref":"#/components/schemas/entity.PersonRef"},"properties":{"additionalProperties":{},"type":"object"},"revocation_detected_at":{"type":"string"},"risk_score":{"example":42,"type":"number"},"role":{"example":"admin","type":"string"},"status":{"example":"active","type":"string"},"tenant_id":{"example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"updated_at":{"example":"2025-01-10T12:00:00Z","type":"string"}},"type":"object"},"response.LoginSourceDeletionResult":{"properties":{"reconciliation_pending":{"type":"boolean"},"restored":{"type":"integer"},"suppressed":{"type":"integer"}},"type":"object"},"response.LoginSourceInfo":{"properties":{"declared_at":{"type":"string"},"declared_by":{"type":"string"},"idp_connector_id":{"type":"string"},"idp_connector_name":{"type":"string"},"idp_connector_type":{"$ref":"#/components/schemas/entity.ConnectorType"}},"type":"object"},"response.LoginSourceListResponse":{"properties":{"items":{"items":{"$ref":"#/components/schemas/response.ConnectorLoginSourceState"},"type":"array"},"reconciliation_pending":{"type":"boolean"}},"type":"object"},"response.LoginSourceMutationResult":{"properties":{"changed":{"type":"boolean"},"created":{"type":"boolean"},"login_source":{"$ref":"#/components/schemas/response.LoginSourceInfo"},"previous_idp_connector_id":{"type":"string"},"reconciliation_pending":{"type":"boolean"},"restored":{"type":"integer"},"suppressed":{"type":"integer"}},"type":"object"},"response.MergeCandidateMemberView":{"properties":{"connector_type":{"type":"string"},"name":{"type":"string"},"publisher":{"type":"string"},"risk":{"type":"string"},"third_party_app_id":{"type":"string"},"user_count":{"type":"integer"}},"type":"object"},"response.MergeCandidateView":{"properties":{"cluster_key":{"type":"string"},"confidence":{"type":"string"},"created_at":{"type":"string"},"id":{"type":"string"},"members":{"items":{"$ref":"#/components/schemas/response.MergeCandidateMemberView"},"type":"array"},"signal":{"type":"string"},"status":{"type":"string"},"target_canonical_id":{"type":"string"}},"type":"object"},"response.PlanLimitError":{"properties":{"code":{"type":"string"},"current_plan":{"type":"string"},"current_usage":{"description":"CurrentUsage is the tenant's usage at the time of denial. Zero when the\nemission site did not thread usage into the error (e.g. tier restrictions).","type":"integer"},"error":{"type":"string"},"limit_type":{"type":"string"},"max_allowed":{"description":"MaxAllowed is the cap imposed by the current plan for this limit. Zero means\n\"unlimited\" OR \"no numeric cap applies\" (e.g. feature-flag limits).","type":"integer"},"required_plan":{"description":"RequiredPlan is the lowest plan that unblocks this LimitType. Omitted for\na limit type that maps to no plan, and when it is the tenant's current\nplan, which leaves nothing to upgrade to.","type":"string"},"upgrade_required":{"type":"boolean"},"upgrade_url":{"description":"UpgradeURL is a deep link to the plan page (/settings/plan) carrying the\ncurrent tenant, current plan, and required plan in its query. Empty when\nthe frontend URL is not configured or required_plan is omitted.","type":"string"}},"type":"object"},"response.RemediationGuideResult":{"properties":{"finding_id":{"type":"string"},"guide":{"$ref":"#/components/schemas/entity.RemediationInfo"},"remediation":{"type":"string"}},"type":"object"},"response.ScanPagedResult":{"properties":{"data":{"items":{"$ref":"#/components/schemas/response.ScanResponse"},"type":"array"},"pagination":{"$ref":"#/components/schemas/entity.PaginationMeta"}},"type":"object"},"response.ScanResponse":{"properties":{"cancelled_at":{"type":"string"},"cancelled_by":{"type":"string"},"completed_at":{"description":"When the scan finished","example":"2025-01-15T10:35:00Z","type":"string"},"connector_id":{"description":"Connector being scanned","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"created_at":{"description":"Creation timestamp","example":"2025-01-15T10:30:00Z","type":"string"},"delta_resource_count":{"description":"Set on delta scans only: resources the delta fetch returned, summed over all resource types, including types fetched in full","example":5,"type":"integer"},"error_message":{"description":"Error details if scan failed","example":"","type":"string"},"failed_resource_count":{"description":"FailedResourceCount is the number of resource types whose fetch failed during the scan.","example":1,"type":"integer"},"failed_resource_types":{"description":"FailedResourceTypes lists the specific resource types that failed to fetch (rate limit, 5xx, etc.).\nSerialized as JSONB; empty list for clean scans.","example":["drive_file"],"items":{"type":"string"},"type":"array"},"fallback_from_edge":{"description":"Whether this scan fell back from edge to origin","example":false,"type":"boolean"},"fallback_reason":{"description":"Reason for edge-to-origin fallback","example":"","type":"string"},"finalize_warnings":{"description":"Non-fatal warnings emitted during scan finalization","items":{"$ref":"#/components/schemas/entity.ScanWarning"},"type":"array"},"id":{"description":"Unique scan identifier","example":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","type":"string"},"is_delta":{"description":"Whether this was a delta/incremental scan","example":false,"type":"boolean"},"partial_failure_rate":{"example":0.5,"type":"number"},"per_scan_detail_available":{"description":"PerScanDetailAvailable is true when GET /scans/{scan_id}/findings lists\nthe findings this scan observed, with their at-scan fields: a scan run\nsince per-scan tracking, less than 30 days old.","example":true,"type":"boolean"},"requested_resource_types":{"description":"RequestedResourceTypes is the original set of resource types the scan was\nasked to cover, before any cooldown or other filtering. ResourceTypes is the\nsubset that was actually scanned. When the two differ, the difference is\n\"skipped\" (e.g., drive_file cooldown).","example":["user","drive_file"],"items":{"type":"string"},"type":"array"},"resource_fetch_results":{"description":"Per-resource-type fetch outcomes","items":{"$ref":"#/components/schemas/entity.ResourceFetchResult"},"type":"array"},"resource_types":{"description":"Resource types actually scanned (post-cooldown; see RequestedResourceTypes for pre-filter set)","example":["user","application"],"items":{"type":"string"},"type":"array"},"started_at":{"description":"When the scan started","example":"2025-01-15T10:30:00Z","type":"string"},"status":{"allOf":[{"$ref":"#/components/schemas/entity.ScanStatus"}],"description":"Scan state (pending, running, completed, failed)","example":"completed"},"tenant_id":{"description":"Owning tenant","example":"550e8400-e29b-41d4-a716-446655440000","type":"string"},"total_findings":{"description":"Number of findings produced","example":42,"type":"integer"}},"type":"object"},"ssocoverage.Verdict":{"enum":["contradicted","no_contradiction_observed","unknown","not_verifiable"],"type":"string","x-enum-varnames":["VerdictContradicted","VerdictNoContradictionObserved","VerdictUnknown","VerdictNotVerifiable"]},"v1.activityResponse":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.ActivityItem"},"type":"array"},"pagination":{"$ref":"#/components/schemas/v1.paginationMeta"}},"type":"object"},"v1.paginationMeta":{"properties":{"page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"}},"type":"object"}},"securitySchemes":{"ApiKeyAuth":{"bearerFormat":"bcs_<keyid>_<secret>","description":"Tenant API key, created in the dashboard. Send it as a Bearer token: Authorization: Bearer bcs_<keyid>_<secret>","scheme":"bearer","type":"http"}}},"info":{"description":"Beta. The Black Cat Security API gives programmatic, tenant-scoped access to your SaaS security posture data. Endpoints and fields may change before general availability.\n\n## Authentication\n\nCreate an API key in the dashboard and send it as a Bearer token:\n\n```\ncurl -H \"Authorization: Bearer bcs_<keyid>_<secret>\" https://api.blackcatsecurity.fr/v1/findings\n```\n\nEach operation lists the permission the key needs in `x-api-key-permission`.","title":"Black Cat Security API","version":"v1-beta"},"openapi":"3.0.0","paths":{"/access-reviews":{"get":{"description":"List the tenant's access-review campaigns. Requires access_reviews:read.","parameters":[{"description":"Filter by status","in":"query","name":"status","schema":{"enum":["draft","active","closed","cancelled"],"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ReviewCampaignPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List access-review campaigns","tags":["AccessReviews"],"x-api-key-permission":"access_reviews:read"}},"/access-reviews/{id}":{"get":{"description":"Get a single access-review campaign by ID. Requires access_reviews:read.","parameters":[{"description":"Campaign ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ReviewCampaign"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an access-review campaign","tags":["AccessReviews"],"x-api-key-permission":"access_reviews:read"}},"/access-reviews/{id}/grants":{"get":{"description":"List a campaign's reviewer grants. Token material is never returned. API keys get each grant without reviewer_email. Requires access_reviews:read.","parameters":[{"description":"Campaign ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ReviewerGrant"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"List reviewer grants","tags":["AccessReviews"],"x-api-key-permission":"access_reviews:read"}},"/access-reviews/{id}/items":{"get":{"description":"List the frozen review items of a campaign. API keys get each item without decided_by_email. Requires access_reviews:read.","parameters":[{"description":"Campaign ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Filter by decision","in":"query","name":"decision","schema":{"enum":["keep","revoke","flag","undecided"],"type":"string"}},{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by reviewer grant ID","in":"query","name":"grant_id","schema":{"type":"string"}},{"description":"Filter by verification status","in":"query","name":"verification_status","schema":{"enum":["not_applicable","pending","verified_gone","still_present"],"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ReviewItemPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List access-review items","tags":["AccessReviews"],"x-api-key-permission":"access_reviews:read"}},"/access-reviews/{id}/progress":{"get":{"description":"Get campaign-level and per-reviewer completion counts. API keys get each reviewer without reviewer_email. Requires access_reviews:read.","parameters":[{"description":"Campaign ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ReviewCampaignProgress"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get access-review campaign progress","tags":["AccessReviews"],"x-api-key-permission":"access_reviews:read"}},"/agent-governance-rules":{"get":{"description":"Returns the tenant's agent governance rules. Requires ai_governance:read.","parameters":[{"description":"Items per page","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"$ref":"#/components/schemas/entity.AgentGovernanceRule"},"type":"array"},"total":{"type":"integer"}},"type":"object"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List agent governance rules","tags":["Agent Governance Rules"],"x-api-key-permission":"ai_governance:read"},"post":{"description":"Creates an agent governance rule. Requires ai_governance:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateAgentGovernanceRuleRequest"}}},"description":"Rule to create","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AgentGovernanceRule"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create an agent governance rule","tags":["Agent Governance Rules"],"x-api-key-permission":"ai_governance:write"}},"/agent-governance-rules/{id}":{"delete":{"description":"Deletes an agent governance rule. Requires ai_governance:write.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Delete an agent governance rule","tags":["Agent Governance Rules"],"x-api-key-permission":"ai_governance:write"},"get":{"description":"Returns one agent governance rule. Requires ai_governance:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AgentGovernanceRule"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an agent governance rule","tags":["Agent Governance Rules"],"x-api-key-permission":"ai_governance:read"},"put":{"description":"Updates the supplied fields of an agent governance rule. Requires ai_governance:write.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateAgentGovernanceRuleRequest"}}},"description":"Fields to change","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update an agent governance rule","tags":["Agent Governance Rules"],"x-api-key-permission":"ai_governance:write"}},"/agent-governance-rules/{id}/test":{"post":{"description":"Evaluates a rule against the current AI agents without running its playbook. Requires ai_governance:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AgentGovernanceRuleTestResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Test an agent governance rule","tags":["Agent Governance Rules"],"x-api-key-permission":"ai_governance:read"}},"/agents":{"get":{"description":"Returns a page of AI agents discovered across connectors. Requires ai_governance:read.","parameters":[{"description":"Filter by agent platform","in":"query","name":"platform","schema":{"type":"string"}},{"description":"Filter by review status","in":"query","name":"status","schema":{"type":"string"}},{"description":"Filter by autonomy level","in":"query","name":"autonomy_level","schema":{"type":"string"}},{"description":"Filter by owner ID (UUID)","in":"query","name":"owner_id","schema":{"type":"string"}},{"description":"Filter by connector ID (UUID)","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Full-text search","in":"query","name":"q","schema":{"type":"string"}},{"description":"Comma-separated extras; supports last_remediated","in":"query","name":"include","schema":{"type":"string"}},{"description":"Items per page","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Sort column","in":"query","name":"sort_by","schema":{"type":"string"}},{"description":"Sort direction","in":"query","name":"sort_order","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AIAgentPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List AI agents","tags":["AI Agents"],"x-api-key-permission":"ai_governance:read"}},"/agents/batch-owner":{"post":{"description":"Sets the owner on a batch of AI agents. Requires ai_governance:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BatchUpdateAgentOwnerRequest"}}},"description":"Agent IDs and the new owner","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"updated":{"type":"integer"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Assign an owner to several AI agents","tags":["AI Agents"],"x-api-key-permission":"ai_governance:write"}},"/agents/batch-status":{"post":{"description":"Sets the review status on a batch of AI agents. Requires ai_governance:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BatchUpdateAgentStatusRequest"}}},"description":"Agent IDs and the new status","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"updated":{"type":"integer"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update the status of several AI agents","tags":["AI Agents"],"x-api-key-permission":"ai_governance:write"}},"/agents/remediate":{"post":{"description":"Runs a playbook against the listed AI agents and starts a remediation run. Returns 409 when a run already covers one of the agents. Requires ai_governance:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.ExecuteRemediationRequest"}}},"description":"Playbook, agent IDs and force flag","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ExecuteRemediationResult"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"properties":{"error":{"type":"string"},"existing_run_id":{"type":"string"},"overlapping_agents":{"items":{"type":"string"},"type":"array"}},"type":"object"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Run a remediation playbook","tags":["Remediation"],"x-api-key-permission":"ai_governance:write"}},"/agents/summary":{"get":{"description":"Returns AI agent counts for the tenant. Requires ai_governance:read.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AIAgentSummary"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get AI agent summary","tags":["AI Agents"],"x-api-key-permission":"ai_governance:read"}},"/agents/{id}":{"get":{"description":"Returns one AI agent. Requires ai_governance:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AIAgent"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an AI agent","tags":["AI Agents"],"x-api-key-permission":"ai_governance:read"}},"/agents/{id}/owner":{"put":{"description":"Sets the owner of one AI agent. Requires ai_governance:write.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateAgentOwnerRequest"}}},"description":"New owner","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Assign an AI agent owner","tags":["AI Agents"],"x-api-key-permission":"ai_governance:write"}},"/agents/{id}/permissions":{"get":{"description":"Returns the permissions, data scopes, capabilities and tool bindings of one AI agent. Requires ai_governance:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"capabilities":{"items":{"$ref":"#/components/schemas/entity.AgentCapability"},"type":"array"},"data_scopes":{"items":{"$ref":"#/components/schemas/entity.AgentDataScope"},"type":"array"},"permissions":{"items":{"$ref":"#/components/schemas/entity.AgentPermission"},"type":"array"},"tool_bindings":{"items":{"$ref":"#/components/schemas/entity.AgentToolBinding"},"type":"array"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get AI agent permissions","tags":["AI Agents"],"x-api-key-permission":"ai_governance:read"}},"/agents/{id}/revocation-guide":{"get":{"description":"Returns the steps to revoke one AI agent. Requires ai_governance:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.RevocationGuide"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an AI agent revocation guide","tags":["AI Agents"],"x-api-key-permission":"ai_governance:read"}},"/agents/{id}/status":{"put":{"description":"Sets the review status of one AI agent. Requires ai_governance:write.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateAgentStatusRequest"}}},"description":"New status","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update an AI agent status","tags":["AI Agents"],"x-api-key-permission":"ai_governance:write"}},"/ai-governance/items":{"get":{"description":"List shadow-AI apps, managed AI keys, and other AI governance review items.","parameters":[{"description":"Filter by status","in":"query","name":"status","schema":{"enum":["discovered","approved","flagged","blocked"],"type":"string"}},{"description":"Filter by object type","in":"query","name":"object_type","schema":{"enum":["shadow_ai_app","managed_ai_project","managed_ai_key","managed_ai_identity","managed_ai_usage_signal","ai_agent"],"type":"string"}},{"description":"Filter by provider","in":"query","name":"provider","schema":{"type":"string"}},{"description":"Filter by owner ID (UUID)","in":"query","name":"owner_id","schema":{"type":"string"}},{"description":"Filter by priority reason","in":"query","name":"reason","schema":{"type":"string"}},{"description":"Filter shadow-AI items by tier","in":"query","name":"ai_source","schema":{"enum":["catalog","heuristic"],"type":"string"}},{"description":"Full-text search (title, subtitle)","in":"query","name":"q","schema":{"type":"string"}},{"description":"Show only items changed since last review","in":"query","name":"changed_only","schema":{"type":"boolean"}},{"description":"Include archived items","in":"query","name":"show_archived","schema":{"type":"boolean"}},{"description":"Show only stale items","in":"query","name":"stale_only","schema":{"type":"boolean"}},{"description":"Show only overdue items","in":"query","name":"overdue_only","schema":{"type":"boolean"}},{"description":"Minimum priority score","in":"query","name":"min_priority","schema":{"type":"integer"}},{"description":"Items per page (default 100)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Sort column","in":"query","name":"sort_by","schema":{"enum":["priority_score","last_seen_at","first_seen_at","title"],"type":"string"}},{"description":"Sort direction","in":"query","name":"sort_order","schema":{"enum":["asc","desc"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":true,"type":"object"}}},"description":"paged list of AI review items"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List AI review items","tags":["AI Governance"],"x-api-key-permission":"ai_governance:read"},"post":{"description":"Creates a manual AI review item. Requires ai_governance:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateAIReviewItemRequest"}}},"description":"AI review item to create","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AIReviewItem"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create an AI review item","tags":["AI Governance"],"x-api-key-permission":"ai_governance:write"}},"/ai-governance/items/batch-owner":{"post":{"description":"Sets the owner on a batch of AI review items. Requires ai_governance:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BatchUpdateAIReviewOwnerRequest"}}},"description":"Item IDs and the new owner","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"errors":{"items":{"$ref":"#/components/schemas/entity.BatchError"},"type":"array"},"skipped":{"type":"integer"},"updated":{"type":"integer"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Assign an owner to several AI review items","tags":["AI Governance"],"x-api-key-permission":"ai_governance:write"}},"/ai-governance/items/batch-status":{"post":{"description":"Sets the review status on a batch of AI review items. Requires ai_governance:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BatchUpdateAIReviewStatusRequest"}}},"description":"Item IDs and the new status","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"errors":{"items":{"$ref":"#/components/schemas/entity.BatchError"},"type":"array"},"skipped":{"type":"integer"},"updated":{"type":"integer"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update the status of several AI review items","tags":["AI Governance"],"x-api-key-permission":"ai_governance:write"}},"/ai-governance/items/{id}":{"get":{"description":"Returns one AI review item. Requires ai_governance:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AIReviewItem"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an AI review item","tags":["AI Governance"],"x-api-key-permission":"ai_governance:read"}},"/ai-governance/items/{id}/evidence":{"get":{"description":"Returns the evidence package for one AI review item. Requires ai_governance:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AIReviewEvidencePackage"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get AI review evidence","tags":["AI Governance"],"x-api-key-permission":"ai_governance:read"}},"/ai-governance/items/{id}/owner":{"put":{"description":"Sets the owner of one AI review item. Requires ai_governance:write.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateAIReviewOwnerRequest"}}},"description":"New owner","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Assign an AI review item owner","tags":["AI Governance"],"x-api-key-permission":"ai_governance:write"}},"/ai-governance/items/{id}/restore":{"post":{"description":"Restores an archived AI review item. Requires ai_governance:write.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Restore an archived AI review item","tags":["AI Governance"],"x-api-key-permission":"ai_governance:write"}},"/ai-governance/items/{id}/status":{"put":{"description":"Sets the review status of one AI review item. Requires ai_governance:write.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateAIReviewStatusRequest"}}},"description":"New status and reason","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update an AI review item status","tags":["AI Governance"],"x-api-key-permission":"ai_governance:write"}},"/ai-governance/summary":{"get":{"description":"Returns the AI review counts for the tenant. Requires ai_governance:read.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AIReviewSummary"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get AI governance summary","tags":["AI Governance"],"x-api-key-permission":"ai_governance:read"}},"/alert-rules":{"get":{"description":"List all alert rules with optional filters.","parameters":[{"description":"Filter by alert type","in":"query","name":"type","schema":{"enum":["slack","jira","configuration_drift","email"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.AlertRule"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List alert rules","tags":["AlertRules"],"x-api-key-permission":"alert_rules:read"},"post":{"description":"Create a new alert rule for post-scan notifications. Requires admin role.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateAlertRuleRequest"}}},"description":"Alert rule configuration","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AlertRule"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create an alert rule","tags":["AlertRules"],"x-api-key-permission":"alert_rules:write"}},"/alert-rules/{id}":{"delete":{"description":"Delete an alert rule by its ID. Requires admin role.","parameters":[{"description":"Alert Rule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Delete an alert rule","tags":["AlertRules"],"x-api-key-permission":"alert_rules:write"},"get":{"description":"Get an alert rule by its ID.","parameters":[{"description":"Alert Rule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AlertRule"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an alert rule","tags":["AlertRules"],"x-api-key-permission":"alert_rules:read"},"put":{"description":"Update an existing alert rule. Requires admin role.","parameters":[{"description":"Alert Rule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateAlertRuleRequest"}}},"description":"Updated alert rule fields","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update an alert rule","tags":["AlertRules"],"x-api-key-permission":"alert_rules:write"}},"/alert-rules/{id}/test":{"post":{"description":"Send a test notification via the configured alert rule notifier. Requires admin role.","parameters":[{"description":"Alert Rule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Test an alert rule","tags":["AlertRules"],"x-api-key-permission":"alert_rules:write"}},"/alerts":{"get":{"description":"List security alerts with optional filters and pagination.","parameters":[{"description":"Comma-separated statuses","in":"query","name":"status","schema":{"enum":["open","acknowledged","snoozed","resolved"],"type":"string"}},{"description":"Comma-separated severities","in":"query","name":"severity","schema":{"enum":["critical","high","medium","low","info"],"type":"string"}},{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by alert rule ID","in":"query","name":"alert_rule_id","schema":{"type":"string"}},{"description":"Group by dimension","in":"query","name":"group_by","schema":{"enum":["rule","connector"],"type":"string"}},{"description":"Sort field","in":"query","name":"sort","schema":{"enum":["created_at","severity","updated_at"],"type":"string"}},{"description":"Sort direction","in":"query","name":"order","schema":{"enum":["asc","desc"],"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AlertPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List alerts","tags":["Alerts"],"x-api-key-permission":"alert_rules:read"}},"/alerts/bulk-acknowledge":{"post":{"description":"Acknowledge multiple alerts at once.","requestBody":{"$ref":"#/components/requestBodies/request.BulkAlertRequest"},"responses":{"200":{"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk acknowledge alerts","tags":["Alerts"],"x-api-key-permission":"alert_rules:write"}},"/alerts/bulk-resolve":{"post":{"description":"Resolve multiple alerts at once.","requestBody":{"$ref":"#/components/requestBodies/request.BulkAlertRequest"},"responses":{"200":{"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk resolve alerts","tags":["Alerts"],"x-api-key-permission":"alert_rules:write"}},"/alerts/count":{"get":{"description":"Return alert counts grouped by status.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AlertStatusCounts"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Count alerts by status","tags":["Alerts"],"x-api-key-permission":"alert_rules:read"}},"/alerts/{id}":{"get":{"description":"Get a single alert by ID.","parameters":[{"description":"Alert ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Alert"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an alert","tags":["Alerts"],"x-api-key-permission":"alert_rules:read"}},"/alerts/{id}/acknowledge":{"post":{"description":"Mark an alert as acknowledged.","parameters":[{"description":"Alert ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Acknowledge an alert","tags":["Alerts"],"x-api-key-permission":"alert_rules:write"}},"/alerts/{id}/resolve":{"post":{"description":"Manually resolve an alert.","parameters":[{"description":"Alert ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Resolve an alert","tags":["Alerts"],"x-api-key-permission":"alert_rules:write"}},"/alerts/{id}/snooze":{"post":{"description":"Snooze an alert until a specific time or until the next scan.","parameters":[{"description":"Alert ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.SnoozeAlertRequest"}}},"description":"Snooze parameters","required":true},"responses":{"200":{"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Snooze an alert","tags":["Alerts"],"x-api-key-permission":"alert_rules:write"}},"/app-governance-rules":{"get":{"description":"List all app governance rules for the tenant.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.AppGovernanceRule"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List app governance rules","tags":["AppGovernanceRules"],"x-api-key-permission":"third_party_apps:read"},"post":{"description":"Create an automated governance policy for third-party app management. Requires third_party_apps:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateAppGovernanceRuleRequest"}}},"description":"Governance rule details","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AppGovernanceRule"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create an app governance rule","tags":["AppGovernanceRules"],"x-api-key-permission":"third_party_apps:write"}},"/app-governance-rules/{id}":{"delete":{"description":"Delete an app governance rule by its ID. Requires third_party_apps:write permission.","parameters":[{"description":"Governance Rule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Delete an app governance rule","tags":["AppGovernanceRules"],"x-api-key-permission":"third_party_apps:write"},"get":{"description":"Get an app governance rule by its ID.","parameters":[{"description":"Governance Rule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AppGovernanceRule"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an app governance rule","tags":["AppGovernanceRules"],"x-api-key-permission":"third_party_apps:read"},"put":{"description":"Update an existing app governance rule. Requires third_party_apps:write permission.","parameters":[{"description":"Governance Rule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateAppGovernanceRuleRequest"}}},"description":"Updated rule fields","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update an app governance rule","tags":["AppGovernanceRules"],"x-api-key-permission":"third_party_apps:write"}},"/approval-chains":{"get":{"description":"List all approval chains for the tenant.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ApprovalChain"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List approval chains","tags":["ApprovalChains"],"x-api-key-permission":"exceptions:read"}},"/approval-chains/match":{"get":{"description":"Preview which approval chain would gate a request of the given type for a finding severity. Chains of request_type \"both\" match either type.","parameters":[{"description":"Finding severity to match against","in":"query","name":"severity","required":true,"schema":{"enum":["critical","high","medium","low","info"],"type":"string"}},{"description":"Request that would be gated (default exceptions)","in":"query","name":"request_type","schema":{"enum":["exceptions","severity_overrides"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ApprovalChain"}}},"description":"OK"},"204":{"description":"No matching chain"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Match approval chain","tags":["ApprovalChains"],"x-api-key-permission":"exceptions:read"}},"/approval-chains/{id}":{"get":{"description":"Get an approval chain by its ID.","parameters":[{"description":"Approval Chain ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ApprovalChain"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an approval chain","tags":["ApprovalChains"],"x-api-key-permission":"exceptions:read"}},"/audit-log":{"get":{"description":"List audit log entries for the current tenant with pagination. Requires audit_log:read permission.","parameters":[{"description":"Filter by actor ID","in":"query","name":"actor_id","schema":{"type":"string"}},{"description":"Filter by action","in":"query","name":"action","schema":{"type":"string"}},{"description":"Filter by resource type","in":"query","name":"resource_type","schema":{"type":"string"}},{"description":"Start of date range (RFC3339)","in":"query","name":"since","schema":{"type":"string"}},{"description":"End of date range (RFC3339)","in":"query","name":"until","schema":{"type":"string"}},{"description":"Page size (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Page offset (default 0)","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Sort field (created_at, action, resource_type, actor_email)","in":"query","name":"sort_by","schema":{"type":"string"}},{"description":"Sort direction (asc, desc)","in":"query","name":"sort_order","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AuditEventPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List audit events","tags":["Audit"],"x-api-key-permission":"audit_log:read"}},"/audit-log/export":{"post":{"description":"Create an async NDJSON export of audit log entries. Requires audit_log:read permission. A 429 concurrent_export_limit has no Retry-After header: retry once a running export finishes.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateAuditExport"}}},"description":"Export filters"},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AuditExport"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create audit log export","tags":["Audit"],"x-api-key-permission":"audit_log:read"}},"/audit-log/export/{id}":{"get":{"description":"Get the status of an audit log export job. Requires audit_log:read permission.","parameters":[{"description":"Export ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AuditExport"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get audit export status","tags":["Audit"],"x-api-key-permission":"audit_log:read"}},"/audit-log/export/{id}/download":{"get":{"description":"Download a completed audit log export file. Requires audit_log:read permission.","parameters":[{"description":"Export ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/octet-stream":{"schema":{"format":"binary","type":"string"}}},"description":"OK"},"400":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Download audit export","tags":["Audit"],"x-api-key-permission":"audit_log:read"}},"/campaigns":{"get":{"description":"Return all remediation campaigns for the tenant, grouped by policy category.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.RemediationCampaign"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List remediation campaigns","tags":["Campaigns"],"x-api-key-permission":"findings:read"}},"/campaigns/{category}":{"get":{"description":"Return a single remediation campaign by policy category.","parameters":[{"description":"Policy category slug","in":"path","name":"category","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.RemediationCampaign"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a remediation campaign","tags":["Campaigns"],"x-api-key-permission":"findings:read"}},"/canonical-apps":{"get":{"description":"List distinct cross-connector vendor identities with rollup stats. Empty groups are filtered out.","parameters":[{"description":"Filter by group source","in":"query","name":"source","schema":{"enum":["auto","confirmed","manual"],"type":"string"}},{"description":"Filter by max risk","in":"query","name":"risk","schema":{"enum":["critical","high","medium","low","unknown"],"type":"string"}},{"description":"Case-insensitive substring match on display_name","in":"query","name":"q","schema":{"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Sort column","in":"query","name":"sort_by","schema":{"enum":["display_name","member_count","user_reach","max_risk"],"type":"string"}},{"description":"Sort direction","in":"query","name":"sort_order","schema":{"enum":["asc","desc"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.CanonicalAppRollupPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List canonical apps (Vendors)","tags":["Canonical Apps"],"x-api-key-permission":"third_party_apps:read"}},"/canonical-apps/merge-candidates":{"get":{"description":"List the name-cluster review queue: pending merge candidates with their proposed member rows and a confidence derived from the match signal.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/response.MergeCandidateView"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List pending merge candidates","tags":["Canonical Apps"],"x-api-key-permission":"third_party_apps:read"}},"/canonical-apps/{id}":{"get":{"description":"Get a canonical vendor: its members and the deduped cross-connector blast radius (users, scopes, connectors). User reach excludes connectors that do not report users; those are surfaced as reach_unavailable_sources.","parameters":[{"description":"Canonical app ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.CanonicalAppDetail"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a canonical app (Vendor detail)","tags":["Canonical Apps"],"x-api-key-permission":"third_party_apps:read"}},"/compliance/controls/{id}":{"delete":{"description":"Delete a control (and its children) from a tenant-owned framework. Requires compliance:write permission.","parameters":[{"description":"Control ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Delete a control from a custom framework","tags":["Compliance"],"x-api-key-permission":"compliance:write"},"get":{"description":"Get a compliance control by ID with its current posture.","parameters":[{"description":"Control ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ComplianceControl"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a compliance control","tags":["Compliance"],"x-api-key-permission":"compliance:read"},"put":{"description":"Update name, description, or sort_order of a control. Requires compliance:write permission.","parameters":[{"description":"Control ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateControlRequest"}}},"description":"Updated fields","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update a control in a custom framework","tags":["Compliance"],"x-api-key-permission":"compliance:write"}},"/compliance/controls/{id}/attestation":{"get":{"description":"Return the active attestation for a control, or 404 when none is active. Requires compliance:read permission.","parameters":[{"description":"Control ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ControlAttestation"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a control attestation","tags":["Compliance"],"x-api-key-permission":"compliance:read"}},"/compliance/controls/{id}/attestation/evidence":{"get":{"description":"Download the evidence file of a control's active attestation. Always served as an attachment (never inline). Requires compliance:read. 404 when no active attestation or no file.","parameters":[{"description":"Control ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/octet-stream":{"schema":{"format":"binary","type":"string"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Download attestation evidence","tags":["Compliance"],"x-api-key-permission":"compliance:read"}},"/compliance/controls/{id}/policies":{"delete":{"description":"Reset a built-in framework control's policy mapping to the default by deleting the caller's tenant override. Succeeds when no override exists. Controls of tenant-owned frameworks have no default and return 400 no_default_mapping; without a tenant the reset returns 400 tenant_required. Requires compliance:write permission.","parameters":[{"description":"Control ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Reset control policies","tags":["Compliance"],"x-api-key-permission":"compliance:write"},"put":{"description":"Set policy mappings for a compliance control. Requires compliance:write permission. Send an empty policy_ids array to clear all mappings from the control. A built-in control's mapping needs a tenant (400 tenant_required without one).","parameters":[{"description":"Control ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.SetControlPoliciesRequest"}}},"description":"Policy IDs","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Set control policies","tags":["Compliance"],"x-api-key-permission":"compliance:write"}},"/compliance/enriched-summary":{"get":{"description":"Return posture for all enabled frameworks enriched with audit deadline, trend direction, top blocking controls, and stale evidence count.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.FrameworkSummaryEnriched"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get enriched compliance summary","tags":["Compliance"],"x-api-key-permission":"compliance:read"}},"/compliance/frameworks":{"get":{"description":"List all compliance frameworks with optional filters.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ComplianceFramework"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List compliance frameworks","tags":["Compliance"],"x-api-key-permission":"compliance:read"},"post":{"description":"Create a tenant-owned compliance framework. Requires compliance:write permission.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateFrameworkRequest"}}},"description":"Framework details","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ComplianceFramework"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create a custom compliance framework","tags":["Compliance"],"x-api-key-permission":"compliance:write"}},"/compliance/frameworks/{id}":{"delete":{"description":"Delete a tenant-owned compliance framework. Requires compliance:write permission.","parameters":[{"description":"Framework ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Delete a custom compliance framework","tags":["Compliance"],"x-api-key-permission":"compliance:write"},"get":{"description":"Get a compliance framework by ID, including its control tree.","parameters":[{"description":"Framework ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ComplianceFramework"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a compliance framework","tags":["Compliance"],"x-api-key-permission":"compliance:read"},"put":{"description":"Update name, version, or description of a tenant-owned framework. Requires compliance:write permission.","parameters":[{"description":"Framework ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateFrameworkRequest"}}},"description":"Updated fields","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update a custom compliance framework","tags":["Compliance"],"x-api-key-permission":"compliance:write"}},"/compliance/frameworks/{id}/clone":{"post":{"description":"Clone a global or tenant-owned framework into a new tenant-owned framework. Requires compliance:write permission.","parameters":[{"description":"Source Framework ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CloneFrameworkRequest"}}},"description":"New framework name","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ComplianceFramework"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Clone a compliance framework","tags":["Compliance"],"x-api-key-permission":"compliance:write"}},"/compliance/frameworks/{id}/controls":{"post":{"description":"Add a control to a tenant-owned compliance framework. Requires compliance:write permission.","parameters":[{"description":"Framework ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateControlRequest"}}},"description":"Control details","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ComplianceControl"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create a control in a custom framework","tags":["Compliance"],"x-api-key-permission":"compliance:write"}},"/compliance/frameworks/{id}/gaps":{"get":{"description":"Return gap analysis: unmapped controls, persistent failures, recent regressions, mapping suggestions, and a composite readiness score.","parameters":[{"description":"Framework ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AuditReadiness"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get framework audit readiness","tags":["Compliance"],"x-api-key-permission":"compliance:read"}},"/compliance/frameworks/{id}/history":{"get":{"description":"Get posture snapshots over time for a framework. Without connector_id it reads the tenant-wide scope. since defaults to 365 days before until (or now) and any wider window is clamped to 365 days.","parameters":[{"description":"Framework ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Filter by connector ID (omit for the tenant-wide scope)","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Start time (RFC3339, default 365 days before until, clamped to 365 days)","in":"query","name":"since","schema":{"type":"string"}},{"description":"End time (RFC3339)","in":"query","name":"until","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.PostureSnapshot"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get posture history","tags":["Compliance"],"x-api-key-permission":"compliance:read"}},"/compliance/frameworks/{id}/posture":{"get":{"description":"Compute compliance posture for a framework. Optionally scoped to a connector.","parameters":[{"description":"Framework ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Optional connector ID for per-connector posture","in":"query","name":"connector_id","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.FrameworkPosture"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get framework posture","tags":["Compliance"],"x-api-key-permission":"compliance:read"}},"/compliance/frameworks/{id}/trends":{"get":{"description":"Return trend data for a framework over the specified period (30d, 90d, 1y).","parameters":[{"description":"Framework ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Period: 30d, 90d (default), 1y","in":"query","name":"period","schema":{"type":"string"}},{"description":"Optional connector ID to scope trends","in":"query","name":"connector_id","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ComplianceTrend"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get compliance trends","tags":["Compliance"],"x-api-key-permission":"compliance:read"}},"/compliance/summary":{"get":{"description":"Compute posture across all enabled compliance frameworks.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.FrameworkPosture"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get compliance summary","tags":["Compliance"],"x-api-key-permission":"compliance:read"}},"/connectors":{"get":{"description":"List all connectors with optional filters.","parameters":[{"description":"Filter by connector type","in":"query","name":"type","schema":{"enum":["okta","cloudflare","gcp","workspace","openai","m365","github","gitlab","aws","atlassian","anthropic","zoom","teams","notion","salesforce"],"type":"string"}},{"description":"Filter by status","in":"query","name":"status","schema":{"enum":["active","inactive","error","configuring"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.Connector"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List connectors","tags":["Connectors"],"x-api-key-permission":"connectors:read"},"post":{"description":"Create a new SaaS connector integration. Requires admin role.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateConnectorRequest"}}},"description":"Connector configuration","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.ConnectorDetail"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create a connector","tags":["Connectors"],"x-api-key-permission":"connectors:write"}},"/connectors/bulk-test":{"post":{"description":"Test connectivity for multiple connectors at once.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BulkTestConnectorsRequest"}}},"description":"Connector IDs to test","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{"type":"string"},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk test connectors","tags":["Connectors"],"x-api-key-permission":"connectors:write"}},"/connectors/{id}":{"delete":{"description":"Permanently delete a connector and all its data. Blocked if a scan is in progress.","parameters":[{"description":"Connector ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Scan in progress"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Delete a connector","tags":["Connectors"],"x-api-key-permission":"connectors:write"},"get":{"description":"Get a connector by its ID. Pass ?include=config to see masked config keys.","parameters":[{"description":"Connector ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Include additional data (config)","in":"query","name":"include","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Connector"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a connector","tags":["Connectors"],"x-api-key-permission":"connectors:read"}},"/connectors/{id}/content-scan-consent":{"get":{"description":"Return the active content-scan consent for a connector, or null when none is active — absence of consent is a normal state, not a 404. A consent record acknowledging an outdated disclosure version is still returned (it exists), but needs_reconsent is true and the grant path stays available. Requires connectors:read permission.","parameters":[{"description":"Connector ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.ContentScanConsentDetail"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get content-scan consent","tags":["Connectors"],"x-api-key-permission":"connectors:read"}},"/connectors/{id}/identities":{"get":{"description":"List all identities for a specific connector.","parameters":[{"description":"Connector ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Filter by status","in":"query","name":"status","schema":{"type":"string"}},{"description":"Filter by email","in":"query","name":"email","schema":{"type":"string"}},{"description":"Filter by role","in":"query","name":"role","schema":{"type":"string"}},{"description":"Filter by identity type (human, service_account, bot, api_key, oauth_app)","in":"query","name":"identity_type","schema":{"type":"string"}},{"description":"Filter non-human identities only","in":"query","name":"is_non_human","schema":{"type":"boolean"}},{"description":"Search by name or email","in":"query","name":"search","schema":{"type":"string"}},{"description":"Page size","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Page offset","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.IdentityPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List connector identities","tags":["Connectors"],"x-api-key-permission":"identities:read"}},"/connectors/{id}/identities/stats":{"get":{"description":"Get aggregate identity statistics for a connector.","parameters":[{"description":"Connector ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.IdentityStats"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get connector identity stats","tags":["Connectors"],"x-api-key-permission":"identities:read"}},"/connectors/{id}/resource-types":{"get":{"description":"Returns distinct resource types discovered by a specific connector, sorted alphabetically.","parameters":[{"description":"Connector ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"type":"string"},"type":"array"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List connector resource types","tags":["Connectors"],"x-api-key-permission":"connectors:read"}},"/connectors/{id}/scans":{"get":{"description":"List scan history for a specific connector, showing timestamps, status, error messages, and finding counts.","parameters":[{"description":"Connector ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Filter by scan status","in":"query","name":"status","schema":{"enum":["pending","running","completed","failed"],"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.ScanPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List connector scan history","tags":["Connectors"],"x-api-key-permission":"scans:read"}},"/connectors/{id}/test":{"post":{"description":"Test connectivity for a connector. Requires admin role.","parameters":[{"description":"Connector ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{"type":"string"},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Test a connector","tags":["Connectors"],"x-api-key-permission":"connectors:write"}},"/dashboard/ai-risk":{"get":{"description":"Get aggregated AI app risk data including subcategory breakdown, training status, and top apps.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AIRiskSummary"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get AI risk summary","tags":["Dashboard"],"x-api-key-permission":"ai_governance:read"}},"/dashboard/ai-security":{"get":{"description":"Get a composed AI security dashboard combining AI risk summary, data exposure, and governance status.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.AISecurityDashboard"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get AI security dashboard","tags":["Dashboard"],"x-api-key-permission":"ai_governance:read"}},"/dashboard/posture":{"get":{"description":"Get overall security posture score and grade for the current tenant.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.DashboardPosture"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get security posture","tags":["Dashboard"],"x-api-key-permission":"findings:read"}},"/dashboard/proxy-intel":{"get":{"description":"Aggregated proxy login metrics for the tenant","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ProxyIntelSummary"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Proxy intelligence summary","tags":["Dashboard"],"x-api-key-permission":"geo:read"}},"/dashboard/remediation-activity":{"get":{"description":"Get a rolling-window summary of findings that became remediated or drifted (became open/re-opened).\nClassification uses the latest in-window transition per finding to avoid double-counting flaps.","parameters":[{"description":"Window in days (default 14, max 90)","in":"query","name":"window","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.RemediationActivity"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get remediation activity","tags":["Dashboard"],"x-api-key-permission":"findings:read"}},"/dashboard/risk-trends":{"get":{"description":"Get computed identity risk trend analytics from risk snapshots over the last 30 days.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.RiskTrend"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get risk trends","tags":["Dashboard"],"x-api-key-permission":"findings:read"}},"/dashboard/score-history":{"get":{"description":"Get the composite posture-score timeline as a calendar-densified daily series (one point per UTC day). Days with no recorded composite are explicit null points. Defaults to the last 30 days; the lookback is clamped to 365 days.","parameters":[{"description":"Start date (RFC3339)","in":"query","name":"since","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ScoreHistoryPoint"},"type":"array"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get composite score history","tags":["Dashboard"],"x-api-key-permission":"findings:read"}},"/dashboard/summary":{"get":{"description":"Get aggregated dashboard summary including findings, connectors, identities, and third-party apps.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.DashboardSummary"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get dashboard summary","tags":["Dashboard"],"x-api-key-permission":"findings:read"}},"/dashboard/trends":{"get":{"description":"Get historical posture score trend data points. Defaults to last 30 days.","parameters":[{"description":"Start date (RFC3339)","in":"query","name":"since","schema":{"type":"string"}},{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.DashboardTrendPoint"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get posture trends","tags":["Dashboard"],"x-api-key-permission":"findings:read"}},"/exceptions":{"get":{"description":"List all exceptions with optional filters.","parameters":[{"description":"Filter by finding ID","in":"query","name":"finding_id","schema":{"type":"string"}},{"description":"Filter by status","in":"query","name":"status","schema":{"enum":["active","expired","revoked"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.Exception"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List exceptions","tags":["Exceptions"],"x-api-key-permission":"exceptions:read"},"post":{"description":"Create a risk acceptance exception for a finding. Requires analyst or admin role.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateExceptionRequest"}}},"description":"Exception details","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Exception"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create an exception","tags":["Exceptions"],"x-api-key-permission":"exceptions:write"}},"/exceptions/{id}":{"get":{"description":"Get an exception by its ID.","parameters":[{"description":"Exception ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Exception"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an exception","tags":["Exceptions"],"x-api-key-permission":"exceptions:read"}},"/exceptions/{id}/approvals":{"get":{"description":"List all approval records for an exception.","parameters":[{"description":"Exception ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ExceptionApproval"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get exception approvals","tags":["Exceptions"],"x-api-key-permission":"exceptions:read"}},"/exceptions/{id}/revoke":{"post":{"description":"Revoke an active exception, reverting the finding to open. Requires analyst or admin role.","parameters":[{"description":"Exception ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"400":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Revoke an exception","tags":["Exceptions"],"x-api-key-permission":"exceptions:write"}},"/findings":{"get":{"description":"List all findings with optional filters, pagination, and sorting.\nWhen the group_by parameter is set, the response schema changes to\nentity.FindingGroupPagedResult, which returns aggregated FindingGroup\nobjects instead of individual Finding records.\nWhen the plan's visible-window limits the result set, the response\nincludes a withheld severity-count summary and pagination is pinned\nto a closed cursor (has_next false, next_cursor empty).","parameters":[{"description":"Filter by connector ID (comma-separated for multiple)","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by scan ID","in":"query","name":"scan_id","schema":{"type":"string"}},{"description":"Filter by severity (comma-separated)","in":"query","name":"severity","schema":{"enum":["critical","high","medium","low","info"],"type":"string"}},{"description":"Filter by status (comma-separated)","in":"query","name":"status","schema":{"enum":["open","resolved","suppressed","accepted"],"type":"string"}},{"description":"Filter by policy ID (comma-separated for multiple)","in":"query","name":"policy_id","schema":{"type":"string"}},{"description":"Filter by resource type (comma-separated for multiple)","in":"query","name":"resource_type","schema":{"type":"string"}},{"description":"Filter by compliance framework ID","in":"query","name":"framework_id","schema":{"type":"string"}},{"description":"Filter by compliance control ID","in":"query","name":"control_id","schema":{"type":"string"}},{"description":"Text search across title, resource_name, description","in":"query","name":"q","schema":{"type":"string"}},{"description":"Filter by assignee: a team member ID, or 'unassigned' for findings with no assignee","in":"query","name":"assignee_id","schema":{"type":"string"}},{"description":"Filter by policy category (comma-separated for multiple)","in":"query","name":"category","schema":{"type":"string"}},{"description":"Filter by connector type","in":"query","name":"connector_type","schema":{"type":"string"}},{"description":"Filter by resource ID","in":"query","name":"resource_id","schema":{"type":"string"}},{"description":"Minimum priority score (0-100)","in":"query","name":"priority_min","schema":{"type":"number"}},{"description":"Maximum priority score (0-100)","in":"query","name":"priority_max","schema":{"type":"number"}},{"description":"Findings first seen after (RFC 3339)","in":"query","name":"first_seen_after","schema":{"type":"string"}},{"description":"Findings first seen before (RFC 3339)","in":"query","name":"first_seen_before","schema":{"type":"string"}},{"description":"Findings last seen after (RFC 3339)","in":"query","name":"last_seen_after","schema":{"type":"string"}},{"description":"Findings last seen before (RFC 3339)","in":"query","name":"last_seen_before","schema":{"type":"string"}},{"description":"Findings resolved after (RFC 3339)","in":"query","name":"resolved_after","schema":{"type":"string"}},{"description":"Findings resolved before (RFC 3339)","in":"query","name":"resolved_before","schema":{"type":"string"}},{"description":"Filter for drifted findings","in":"query","name":"drift","schema":{"enum":["true"],"type":"string"}},{"description":"Alias for drift","in":"query","name":"drifted","schema":{"enum":["true"],"type":"string"}},{"description":"Filter for SLA-overdue findings","in":"query","name":"overdue","schema":{"enum":["true"],"type":"string"}},{"description":"Filter by suppression source; empty matches never-suppressed findings","in":"query","name":"suppression_source","schema":{"enum":["","sso_coverage"],"type":"string"}},{"description":"Group findings by dimension","in":"query","name":"group_by","schema":{"enum":["policy","connector","severity","category","resource"],"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Opaque keyset cursor for the next page (omit for first page)","in":"query","name":"cursor","schema":{"type":"string"}},{"description":"Sort column","in":"query","name":"sort_by","schema":{"enum":["last_seen_at","first_seen_at","severity","status","resource_type","priority_score","resource_name"],"type":"string"}},{"description":"Sort direction","in":"query","name":"sort_order","schema":{"enum":["asc","desc"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.FindingCursorResult"}}},"description":"Cursor-paginated findings (FindingGroupPagedResult when group_by is set)"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List findings","tags":["Findings"],"x-api-key-permission":"findings:read"}},"/findings/bulk-action":{"post":{"description":"Apply a status action to all open findings matching a policy+connector+severity group.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BulkFindingGroupAction"}}},"description":"Group filter and action","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{"type":"integer"},"type":"object"}}},"description":"affected count"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk action on finding group","tags":["Findings"],"x-api-key-permission":"findings:write"}},"/findings/bulk-status":{"patch":{"description":"Update the status of multiple findings at once. Requires analyst or admin role.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BulkUpdateFindingStatusRequest"}}},"description":"Finding IDs and new status","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{"type":"integer"},"type":"object"}}},"description":"updated count"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk update finding statuses","tags":["Findings"],"x-api-key-permission":"findings:write"}},"/findings/count":{"get":{"description":"Return the total count of findings matching filters, without loading rows.","parameters":[{"description":"Filter by connector ID (comma-separated for multiple)","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by severity (comma-separated)","in":"query","name":"severity","schema":{"enum":["critical","high","medium","low","info"],"type":"string"}},{"description":"Filter by status (comma-separated)","in":"query","name":"status","schema":{"enum":["open","resolved","suppressed","accepted"],"type":"string"}},{"description":"Filter by policy ID (comma-separated for multiple)","in":"query","name":"policy_id","schema":{"type":"string"}},{"description":"Filter by resource type (comma-separated for multiple)","in":"query","name":"resource_type","schema":{"type":"string"}},{"description":"Filter by compliance framework ID","in":"query","name":"framework_id","schema":{"type":"string"}},{"description":"Filter by compliance control ID","in":"query","name":"control_id","schema":{"type":"string"}},{"description":"Text search","in":"query","name":"q","schema":{"type":"string"}},{"description":"Filter by assignee: a team member ID, or 'unassigned' for findings with no assignee","in":"query","name":"assignee_id","schema":{"type":"string"}},{"description":"Filter by policy category (comma-separated for multiple)","in":"query","name":"category","schema":{"type":"string"}},{"description":"Filter by connector type","in":"query","name":"connector_type","schema":{"type":"string"}},{"description":"Filter by resource ID","in":"query","name":"resource_id","schema":{"type":"string"}},{"description":"Minimum priority score (0-100)","in":"query","name":"priority_min","schema":{"type":"number"}},{"description":"Maximum priority score (0-100)","in":"query","name":"priority_max","schema":{"type":"number"}},{"description":"Findings first seen after (RFC 3339)","in":"query","name":"first_seen_after","schema":{"type":"string"}},{"description":"Findings first seen before (RFC 3339)","in":"query","name":"first_seen_before","schema":{"type":"string"}},{"description":"Findings last seen after (RFC 3339)","in":"query","name":"last_seen_after","schema":{"type":"string"}},{"description":"Findings last seen before (RFC 3339)","in":"query","name":"last_seen_before","schema":{"type":"string"}},{"description":"Findings resolved after (RFC 3339)","in":"query","name":"resolved_after","schema":{"type":"string"}},{"description":"Findings resolved before (RFC 3339)","in":"query","name":"resolved_before","schema":{"type":"string"}},{"description":"Filter for drifted findings","in":"query","name":"drift","schema":{"enum":["true"],"type":"string"}},{"description":"Alias for drift","in":"query","name":"drifted","schema":{"enum":["true"],"type":"string"}},{"description":"Filter for SLA-overdue findings","in":"query","name":"overdue","schema":{"enum":["true"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.CountResult"}}},"description":"total count"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Count findings","tags":["Findings"],"x-api-key-permission":"findings:read"}},"/findings/export":{"post":{"description":"Create an async export of findings. Requires findings:read permission. A 429 concurrent_export_limit has no Retry-After header: retry once a running export finishes.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateFindingExportRequest"}}},"description":"Export request","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.FindingExport"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create finding export","tags":["Findings"],"x-api-key-permission":"findings:read"}},"/findings/export/{id}":{"get":{"description":"Get the status of a finding export job. Requires findings:read permission.","parameters":[{"description":"Export ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.FindingExport"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get finding export status","tags":["Findings"],"x-api-key-permission":"findings:read"}},"/findings/export/{id}/download":{"get":{"description":"Download a completed finding export file. Requires findings:read permission.","parameters":[{"description":"Export ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/octet-stream":{"schema":{"format":"binary","type":"string"}}},"description":"OK"},"400":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Download finding export","tags":["Findings"],"x-api-key-permission":"findings:read"}},"/findings/{id}":{"get":{"description":"Get a finding by its ID.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Finding"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a finding","tags":["Findings"],"x-api-key-permission":"findings:read"}},"/findings/{id}/assign":{"patch":{"description":"Assign or unassign a finding to a team member. Send null assignee_id to unassign.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.AssignFindingRequest"}}},"description":"Assignment","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Assign a finding","tags":["Findings"],"x-api-key-permission":"findings:write"}},"/findings/{id}/comments":{"get":{"description":"List all comments for a finding.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.FindingComment"},"type":"array"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List finding comments","tags":["Findings"],"x-api-key-permission":"findings:read"}},"/findings/{id}/evidence":{"get":{"description":"Persisted evidence snapshot (redacted resource properties captured at evaluation time) plus the canonical resource UUID for the live-resource link.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.FindingEvidenceView"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get finding evidence","tags":["Findings"],"x-api-key-permission":"findings:read"}},"/findings/{id}/history":{"get":{"description":"List all status changes for a finding.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.FindingStatusChange"},"type":"array"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List finding status history","tags":["Findings"],"x-api-key-permission":"findings:read"}},"/findings/{id}/remediation":{"get":{"description":"Get the detailed remediation info for a finding. Prerequisites field requires guided_remediation feature.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.RemediationGuideResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get remediation guide","tags":["Findings"],"x-api-key-permission":"findings:read"}},"/findings/{id}/request-verification":{"post":{"description":"Mark a finding as \"I fixed this\" and trigger a targeted re-scan.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Scan"}}},"description":"Verification scan started"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Verification already in progress"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Request finding verification","tags":["Findings"],"x-api-key-permission":"findings:write"}},"/findings/{id}/status":{"patch":{"description":"Update the status of a finding. Requires analyst or admin role.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateFindingStatusRequest"}}},"description":"New status","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Unprocessable Entity"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update finding status","tags":["Findings"],"x-api-key-permission":"findings:write"}},"/findings/{id}/ticket":{"delete":{"description":"Remove the link between a finding and its external ticket.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Unlink a finding ticket","tags":["Ticketing"],"x-api-key-permission":"ticketing:write"},"get":{"description":"Get the external ticket linked to a finding.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.TicketLink"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a finding ticket","tags":["Ticketing"],"x-api-key-permission":"ticketing:read"},"post":{"description":"Create an external ticket linked to a finding.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateTicketRequest"}}},"description":"Ticket parameters","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.TicketLink"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create a finding ticket","tags":["Ticketing"],"x-api-key-permission":"ticketing:write"}},"/findings/{id}/ticket/sync":{"post":{"description":"Synchronize a finding's ticket status with the external ticketing system.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{"type":"string"},"type":"object"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Sync a finding ticket","tags":["Ticketing"],"x-api-key-permission":"ticketing:write"}},"/findings/{id}/verify":{"post":{"description":"Re-check a finding's policy against its live resource.","parameters":[{"description":"Finding ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Policy could not be evaluated; finding left unchanged"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Verify a finding","tags":["Findings"],"x-api-key-permission":"findings:write"}},"/geo/map":{"get":{"description":"Per-country distinct-identity + login counts over a time range,\nwith each country flagged disallowed per the tenant geo policy.\nRequires geo:read permission.","parameters":[{"description":"Range start (RFC3339 or YYYY-MM-DD); defaults to 30 days ago","in":"query","name":"from","schema":{"type":"string"}},{"description":"Range end (RFC3339 or YYYY-MM-DD); defaults to now","in":"query","name":"to","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.GeoMapResponse"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get the login-geography map","tags":["Geo"],"x-api-key-permission":"geo:read"}},"/geo/observations":{"get":{"description":"List a tenant's login observations, newest first, by identity_id,\nby email (across all connectors), OR by country (ISO alpha-2,\nover an optional from/to range). Exactly one filter is required.\nRequires geo:read permission.","parameters":[{"description":"Resolved identity UUID","in":"query","name":"identity_id","schema":{"type":"string"}},{"description":"Login email, across all connectors","in":"query","name":"email","schema":{"type":"string"}},{"description":"ISO alpha-2 country code","in":"query","name":"country","schema":{"type":"string"}},{"description":"Range start (RFC3339 or YYYY-MM-DD); country filter only","in":"query","name":"from","schema":{"type":"string"}},{"description":"Range end (RFC3339 or YYYY-MM-DD); country filter only","in":"query","name":"to","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.GeoObservationsResponse"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List login observations (drill-down)","tags":["Geo"],"x-api-key-permission":"geo:read"}},"/geo/policy":{"get":{"description":"Get the country allow/deny geo policy. Requires geo:read permission.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.GeoPolicyResponse"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get the tenant geo policy","tags":["Geo"],"x-api-key-permission":"geo:read"},"put":{"description":"Upsert the country allow/deny geo policy. Requires geo:write permission.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateGeoPolicyRequest"}}},"description":"Geo policy","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.GeoPolicyResponse"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update the tenant geo policy","tags":["Geo"],"x-api-key-permission":"geo:write"}},"/identities":{"get":{"description":"List all identities with optional filters.","parameters":[{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by status","in":"query","name":"status","schema":{"type":"string"}},{"description":"Filter by email","in":"query","name":"email","schema":{"type":"string"}},{"description":"Filter by role","in":"query","name":"role","schema":{"type":"string"}},{"description":"Filter by privileged identities (is_privileged; deprovisioned included)","in":"query","name":"is_admin","schema":{"type":"boolean"}},{"description":"Filter by identity type (human, service_account, bot, api_key, oauth_app)","in":"query","name":"identity_type","schema":{"type":"string"}},{"description":"Filter non-human identities only","in":"query","name":"is_non_human","schema":{"type":"boolean"}},{"description":"Search by name or email","in":"query","name":"search","schema":{"type":"string"}},{"description":"Sort field (email, display_name, role, status, created_at, finding_count, risk_score)","in":"query","name":"sort_by","schema":{"type":"string"}},{"description":"Sort direction (asc, desc)","in":"query","name":"sort_order","schema":{"type":"string"}},{"description":"Page size","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Opaque keyset cursor for the next page (omit for first page)","in":"query","name":"cursor","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.IdentityCursorResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List identities","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/bulk-disposition":{"post":{"description":"Sets the same triage disposition on up to 500 identities or resources. Requires identities:write for identities and resources:write for resources.","requestBody":{"$ref":"#/components/requestBodies/request.BulkSetDispositionRequest"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.BulkAppUpdateResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk-set triage disposition","tags":["dispositions"],"x-api-key-permission":"identities:write"}},"/identities/dispositions/batch":{"post":{"description":"Returns the triage dispositions of up to 500 identities or resources, keyed by ID. Requires identities:read for identities and resources:read for resources.","requestBody":{"$ref":"#/components/requestBodies/request.BatchDispositionRequest"},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"dispositions":{"additionalProperties":{"$ref":"#/components/schemas/entity.Disposition"},"type":"object"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Batch-read triage dispositions","tags":["dispositions"],"x-api-key-permission":"identities:read"}},"/identities/nhi-summary":{"get":{"description":"Aggregate non-human identity metrics for the tenant.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.NHISummary"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get NHI summary","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/offboarding-report":{"get":{"description":"List deprovisioned identities with non-zero offboarding risk.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.OffboardingRisk"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Offboarding report","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/people":{"get":{"description":"Cursor-paginated list of canonical human identities with rollup stats.","parameters":[{"description":"Case-insensitive name/email substring search","in":"query","name":"search","schema":{"type":"string"}},{"description":"Sort column (max_risk_score, display_name)","in":"query","name":"sort_by","schema":{"type":"string"}},{"description":"Sort direction (asc, desc)","in":"query","name":"sort_order","schema":{"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Opaque keyset cursor for the next page (omit for first page)","in":"query","name":"cursor","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.CanonicalPersonCursorResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List canonical people","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/people/risk-summary":{"get":{"description":"Tenant-wide canonical person risk aggregate: total, privileged, average\nrisk, and breakdown by risk band.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.PersonRiskAggregate"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get people risk summary","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/people/{id}":{"get":{"description":"Get a canonical human identity by ID, including member identity refs\nand the unified blast radius (deduplicated OAuth grants across all members).","parameters":[{"description":"Canonical person ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.CanonicalPersonDetail"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"invalid id"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get canonical person","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/risk-history":{"get":{"description":"Retrieve historical risk score snapshots in a date range, newest first, in one page. Without identity_id only the connector aggregate rows (the trend) are returned. Defaults to the last 30 days; the lookback is clamped to 365 days.","parameters":[{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"One identity's series (omit for the connector aggregate rows)","in":"query","name":"identity_id","schema":{"type":"string"}},{"description":"Start date (RFC3339, default 30 days ago, clamped to 365 days)","in":"query","name":"since","schema":{"type":"string"}},{"description":"End date (RFC3339)","in":"query","name":"until","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.IdentityRiskSnapshotPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get identity risk history","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/risk-summary":{"get":{"description":"Bounded top-N identities for a connector, ordered by the persisted\nrisk score (descending). Cursor-paginated; reads the persisted column\n(no per-request recompute).","parameters":[{"description":"Connector ID (required)","in":"query","name":"connector_id","required":true,"schema":{"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Opaque keyset cursor for the next page (omit for first page)","in":"query","name":"cursor","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.IdentityRiskSummaryResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get identity risk summary","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/{id}":{"get":{"description":"Get an identity by its ID.","parameters":[{"description":"Identity ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.IdentityDetail"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an identity","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/{id}/disposition":{"patch":{"description":"Sets the triage disposition of one identity or resource. Requires identities:write for identities and resources:write for resources. Returns 409 version_conflict when the disposition changed since the supplied version.","parameters":[{"description":"Identity or resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"$ref":"#/components/requestBodies/request.SetDispositionRequest"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Disposition"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Set the triage disposition of an inventory item","tags":["dispositions"],"x-api-key-permission":"identities:write"}},"/identities/{id}/offboard":{"post":{"description":"Starts an on-demand offboarding packet for one identity. Requires identities:write. Returns 403 orchestration_disabled when offboarding orchestration is off.","parameters":[{"description":"Identity ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.RemediationRun"}}},"description":"Accepted"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Offboard an identity","tags":["Offboarding"],"x-api-key-permission":"identities:write"}},"/identities/{id}/offboarding-risk":{"get":{"description":"Surface orphaned NHIs and OAuth grants for an identity.","parameters":[{"description":"Identity ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.OffboardingRisk"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get offboarding risk","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/{id}/resources":{"get":{"description":"List resources linked to an identity.","parameters":[{"description":"Identity ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ResourceIdentityLink"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List identity resources","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/identities/{id}/risk":{"get":{"description":"Compute the risk score for a single identity.","parameters":[{"description":"Identity ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.IdentityRiskScore"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get identity risk score","tags":["Identities"],"x-api-key-permission":"identities:read"}},"/login-sources":{"get":{"description":"List every connector for the tenant with its declared login source (if any), verification state, and blast-radius counts.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.LoginSourceListResponse"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List login sources","tags":["LoginSources"],"x-api-key-permission":"policies:read"}},"/login-sources/{id}":{"delete":{"description":"Remove the connector's declared login source. Requires policies:write permission.","parameters":[{"description":"Connector ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.LoginSourceDeletionResult"}}},"description":"OK"},"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.LoginSourceDeletionResult"}}},"description":"Accepted — reconciliation pending"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Service Unavailable"}},"security":[{"ApiKeyAuth":[]}],"summary":"Remove a declared login source","tags":["LoginSources"],"x-api-key-permission":"policies:write"},"put":{"description":"Declare or replace the connector that federates login for the target connector. Requires policies:write permission.","parameters":[{"description":"Connector ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.DeclareLoginSourceRequest"}}},"description":"Declared identity provider connector","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.LoginSourceMutationResult"}}},"description":"OK"},"202":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.LoginSourceMutationResult"}}},"description":"Accepted — reconciliation pending"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Service Unavailable"}},"security":[{"ApiKeyAuth":[]}],"summary":"Declare a login source","tags":["LoginSources"],"x-api-key-permission":"policies:write"}},"/notification-deliveries":{"get":{"description":"List recent notification delivery attempts for the current tenant, newest first. Readable by any authenticated tenant member.","parameters":[{"description":"Filter by delivery status","in":"query","name":"status","schema":{"enum":["pending","success","failed","exhausted"],"type":"string"}},{"description":"Leave out in_app rows (the SLA escalation's per-finding tracking rows); only the value true applies","in":"query","name":"exclude_in_app","schema":{"type":"boolean"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.NotificationDeliveryPagedResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List notification deliveries","tags":["Notifications"],"x-api-key-permission":"audit_log:read"}},"/notifications/deliveries":{"get":{"description":"List notification delivery audit records for the current tenant. Requires audit_log:read permission.","parameters":[{"description":"Filter by delivery status (pending, success, failed, exhausted)","in":"query","name":"status","schema":{"type":"string"}},{"description":"Filter by channel type (slack, email, in_app)","in":"query","name":"channel_type","schema":{"type":"string"}},{"description":"Filter by source type (alert, exception, digest, report)","in":"query","name":"source_type","schema":{"type":"string"}},{"description":"Filter by source ID","in":"query","name":"source_id","schema":{"type":"string"}},{"description":"Start of date range (RFC3339)","in":"query","name":"from","schema":{"type":"string"}},{"description":"End of date range (RFC3339)","in":"query","name":"to","schema":{"type":"string"}},{"description":"Page size (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Page offset (default 0)","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.NotificationDeliveryPagedResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List delivery logs","tags":["Notifications"],"x-api-key-permission":"audit_log:read"}},"/offboarding/packets":{"get":{"description":"Returns a page of offboarding packets. Requires identities:read.","parameters":[{"description":"Items per page","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"items":{"items":{"$ref":"#/components/schemas/entity.RemediationRun"},"type":"array"},"total":{"type":"integer"}},"type":"object"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List offboarding packets","tags":["Offboarding"],"x-api-key-permission":"identities:read"}},"/offboarding/packets/{id}":{"get":{"description":"Returns one offboarding packet with its items. Requires identities:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.OffboardingPacketDetail"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an offboarding packet","tags":["Offboarding"],"x-api-key-permission":"identities:read"}},"/offboarding/packets/{id}/send":{"post":{"description":"Approves and dispatches a drafted offboarding packet. Returns 409 already_dispatched when the packet is no longer pending. Requires identities:write. Returns 403 orchestration_disabled when offboarding orchestration is off.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Send an offboarding packet","tags":["Offboarding"],"x-api-key-permission":"identities:write"}},"/offboarding/settings":{"get":{"description":"Returns the offboarding orchestration toggles. Requires identities:read.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.OffboardingSettings"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get offboarding settings","tags":["Offboarding"],"x-api-key-permission":"identities:read"},"put":{"description":"Sets the offboarding orchestration and auto-send toggles. Requires identities:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateOffboardingSettingsRequest"}}},"description":"Orchestration and auto-send toggles","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update offboarding settings","tags":["Offboarding"],"x-api-key-permission":"identities:write"}},"/ops/activity":{"get":{"description":"Unified timeline merging audit and policy events. Requires ops_activity:read.","parameters":[{"description":"Filter by source: audit, policy","in":"query","name":"source","schema":{"type":"string"}},{"description":"Filter by event type(s), comma-separated","in":"query","name":"event_type","schema":{"type":"string"}},{"description":"Filter by resource type","in":"query","name":"resource_type","schema":{"type":"string"}},{"description":"Filter by actor email","in":"query","name":"actor","schema":{"type":"string"}},{"description":"Filter by connector ID (UUID)","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Start of time range (RFC3339). Default: 7 days ago.","in":"query","name":"since","schema":{"type":"string"}},{"description":"End of time range (RFC3339). Default: now.","in":"query","name":"until","schema":{"type":"string"}},{"description":"Page number (default: 1)","in":"query","name":"page","schema":{"type":"integer"}},{"description":"Items per page (default: 50, max: 100)","in":"query","name":"per_page","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/v1.activityResponse"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get activity feed","tags":["Ops"],"x-api-key-permission":"ops_activity:read"}},"/ops/metrics":{"get":{"description":"Get operational SLA metrics for the tenant. Requires findings:read permission.","parameters":[{"description":"Start time (RFC3339). Defaults to 30 days ago.","in":"query","name":"since","schema":{"type":"string"}},{"description":"End time (RFC3339). Defaults to now.","in":"query","name":"until","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.OpsMetrics"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get ops metrics","tags":["Ops"],"x-api-key-permission":"findings:read"}},"/playbooks":{"get":{"description":"Returns the available remediation playbooks. Requires ai_governance:read.","parameters":[{"description":"Filter by agent platform","in":"query","name":"platform","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.Playbook"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"}},"security":[{"ApiKeyAuth":[]}],"summary":"List playbooks","tags":["Remediation"],"x-api-key-permission":"ai_governance:read"}},"/playbooks/{id}":{"get":{"description":"Returns one remediation playbook. Requires ai_governance:read.","parameters":[{"description":"Playbook ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Playbook"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a playbook","tags":["Remediation"],"x-api-key-permission":"ai_governance:read"}},"/playbooks/{id}/preview":{"post":{"description":"Shows which of the listed AI agents a playbook would act on, without running it. Requires ai_governance:write.","parameters":[{"description":"Playbook ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.PreviewPlaybookRequest"}}},"description":"Agent IDs to preview","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.PlaybookPreviewResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Preview a playbook","tags":["Remediation"],"x-api-key-permission":"ai_governance:write"}},"/policies":{"get":{"description":"List all policies with optional filters, pagination, and sorting.","parameters":[{"description":"Filter by connector type","in":"query","name":"connector_type","schema":{"enum":["okta","cloudflare","gcp","workspace","openai","m365","github","gitlab","aws","atlassian","anthropic","zoom","teams","notion","salesforce"],"type":"string"}},{"description":"Filter by resource type","in":"query","name":"resource_type","schema":{"type":"string"}},{"description":"Filter by policy category","in":"query","name":"category","schema":{"type":"string"}},{"description":"Only policies with at least one open finding","in":"query","name":"has_findings","schema":{"type":"boolean"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Sort column","in":"query","name":"sort_by","schema":{"enum":["created_at","name","severity","connector_type"],"type":"string"}},{"description":"Sort direction","in":"query","name":"sort_order","schema":{"enum":["asc","desc"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.PolicyPagedResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List policies","tags":["Policies"],"x-api-key-permission":"policies:read"}},"/policies/test":{"post":{"description":"Compile and evaluate Rego source against sample input without persisting.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.TestPolicyRequest"}}},"description":"Rego source and sample input","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.PolicyTestResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Test a policy (dry-run)","tags":["Policies"],"x-api-key-permission":"policies:write"}},"/policies/{id}":{"get":{"description":"Get a policy by its ID.","parameters":[{"description":"Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Policy"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a policy","tags":["Policies"],"x-api-key-permission":"policies:read"}},"/policies/{id}/events":{"get":{"description":"List events for a policy timeline with optional filters.","parameters":[{"description":"Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by event type (comma-separated)","in":"query","name":"event_type","schema":{"enum":["findings_detected","findings_resolved","findings_reopened","exception_granted","exception_expired","exception_revoked","finding_status_changed","policy_created","policy_updated","policy_enabled","policy_disabled","policy_deleted"],"type":"string"}},{"description":"Start time (RFC3339)","in":"query","name":"since","schema":{"type":"string"}},{"description":"End time (RFC3339)","in":"query","name":"until","schema":{"type":"string"}},{"description":"Max results per page","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Pagination offset","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.PolicyEventPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List policy events","tags":["Policies"],"x-api-key-permission":"policies:read"}},"/policies/{id}/versions":{"get":{"description":"List version history for a policy.","parameters":[{"description":"Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.PolicyVersionPagedResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List policy versions","tags":["Policies"],"x-api-key-permission":"policies:read"}},"/policy-overrides":{"get":{"description":"List all per-tenant default policy overrides for the current tenant.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.TenantPolicyOverride"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List policy overrides","tags":["Policy Overrides"],"x-api-key-permission":"policies:read"}},"/policy-overrides/{id}":{"delete":{"description":"Remove a per-tenant override for a default policy, restoring the default behavior. Requires admin role.","parameters":[{"description":"Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Remove a policy override","tags":["Policy Overrides"],"x-api-key-permission":"policies:write"},"put":{"description":"Enable or disable a default policy for the current tenant. Requires admin role.","parameters":[{"description":"Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.SetPolicyOverrideRequest"}}},"description":"Override configuration","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Set a policy override","tags":["Policy Overrides"],"x-api-key-permission":"policies:write"}},"/remediation/runs":{"get":{"description":"Returns a page of AI agent remediation runs. Requires ai_governance:read.","parameters":[{"description":"Filter by run status","in":"query","name":"status","schema":{"type":"string"}},{"description":"Items per page","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.RemediationRunPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List remediation runs","tags":["Remediation"],"x-api-key-permission":"ai_governance:read"}},"/remediation/runs/{id}":{"get":{"description":"Returns one remediation run. Requires ai_governance:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.RemediationRun"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a remediation run","tags":["Remediation"],"x-api-key-permission":"ai_governance:read"}},"/report-schedules":{"get":{"description":"List all report schedules for the current tenant. Answers on every plan.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ReportSchedule"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List report schedules","tags":["ReportSchedules"],"x-api-key-permission":"reports:read"},"post":{"description":"Create a recurring report generation schedule. Requires reports:write permission.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateReportScheduleRequest"}}},"description":"Report schedule configuration","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ReportSchedule"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create a report schedule","tags":["ReportSchedules"],"x-api-key-permission":"reports:write"}},"/report-schedules/{id}":{"delete":{"description":"Delete a report schedule by its ID. Requires reports:write permission. Answers on every plan.","parameters":[{"description":"Report Schedule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Delete a report schedule","tags":["ReportSchedules"],"x-api-key-permission":"reports:write"},"get":{"description":"Get a report schedule by its ID. Answers on every plan.","parameters":[{"description":"Report Schedule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ReportSchedule"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a report schedule","tags":["ReportSchedules"],"x-api-key-permission":"reports:read"},"put":{"description":"Update an existing report schedule. Requires reports:write permission.","parameters":[{"description":"Report Schedule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateReportScheduleRequest"}}},"description":"Updated schedule fields","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update a report schedule","tags":["ReportSchedules"],"x-api-key-permission":"reports:write"}},"/reports":{"get":{"description":"List all reports with optional filters. Requires the reports:read permission.","parameters":[{"description":"Filter by report status","in":"query","name":"status","schema":{"enum":["pending","processing","completed","failed"],"type":"string"}},{"description":"Only reports created by the caller","in":"query","name":"mine","schema":{"type":"boolean"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.Report"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List reports","tags":["Reports"],"x-api-key-permission":"reports:read"},"post":{"description":"Create a new async report generation job. Requires the reports:generate permission. API keys cannot generate access-review evidence reports (format access_review): they get 403 api_key_not_allowed. A 429 concurrent_report_limit has no Retry-After header: retry once a running report finishes.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateReportRequest"}}},"description":"Report parameters","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Report"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create a report","tags":["Reports"],"x-api-key-permission":"reports:generate"}},"/reports/{id}":{"get":{"description":"Get a report by its ID. Requires the reports:read permission.","parameters":[{"description":"Report ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Report"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a report","tags":["Reports"],"x-api-key-permission":"reports:read"}},"/reports/{id}/download":{"get":{"description":"Download a completed report file. Requires the reports:read permission.","parameters":[{"description":"Report ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/octet-stream":{"schema":{"format":"binary","type":"string"}}},"description":"OK"},"400":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Download a report","tags":["Reports"],"x-api-key-permission":"reports:read"}},"/resources":{"get":{"description":"List discovered SaaS resources from the asset inventory.","parameters":[{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by connector type (e.g. okta, slack)","in":"query","name":"connector_type","schema":{"type":"string"}},{"description":"Filter by resource type; comma-separated for multiple types (e.g. api_token,personal_access_token)","in":"query","name":"resource_type","schema":{"type":"string"}},{"description":"Resource status filter","in":"query","name":"status","schema":{"default":"active","enum":["active","stale","all"],"type":"string"}},{"description":"Search by resource name","in":"query","name":"query","schema":{"type":"string"}},{"description":"Filter by owner email","in":"query","name":"owner_email","schema":{"type":"string"}},{"description":"Filter externally shared (true/false)","in":"query","name":"is_externally_shared","schema":{"type":"string"}},{"description":"Filter resources with open findings (true/false)","in":"query","name":"has_findings","schema":{"type":"string"}},{"description":"Resources last seen before this timestamp (RFC3339)","in":"query","name":"last_seen_before","schema":{"type":"string"}},{"description":"Resources last seen after this timestamp (RFC3339)","in":"query","name":"last_seen_after","schema":{"type":"string"}},{"description":"Resources first discovered after this timestamp (RFC3339)","in":"query","name":"first_discovered_after","schema":{"type":"string"}},{"description":"Include aggregate facets in response","in":"query","name":"include_facets","schema":{"type":"boolean"}},{"description":"Max owner emails in facet (default 10, max 50)","in":"query","name":"facet_owner_limit","schema":{"type":"integer"}},{"description":"Filter by max finding severity","in":"query","name":"max_severity","schema":{"enum":["critical","high","medium","low","info"],"type":"string"}},{"description":"Filter by minimum priority score","in":"query","name":"risk_score_min","schema":{"type":"number"}},{"description":"Sort field","in":"query","name":"sort_by","schema":{"default":"last_seen_at","enum":["resource_name","last_seen_at","first_discovered_at","last_changed_at"],"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Opaque keyset cursor for the next page (omit for first page)","in":"query","name":"cursor","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ResourceCursorListResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List resources","tags":["Resources"],"x-api-key-permission":"resources:read"}},"/resources/bulk-disposition":{"post":{"description":"Sets the same triage disposition on up to 500 identities or resources. Requires identities:write for identities and resources:write for resources.","requestBody":{"$ref":"#/components/requestBodies/request.BulkSetDispositionRequest"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.BulkAppUpdateResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk-set triage disposition","tags":["dispositions"],"x-api-key-permission":"resources:write"}},"/resources/dispositions/batch":{"post":{"description":"Returns the triage dispositions of up to 500 identities or resources, keyed by ID. Requires identities:read for identities and resources:read for resources.","requestBody":{"$ref":"#/components/requestBodies/request.BatchDispositionRequest"},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"dispositions":{"additionalProperties":{"$ref":"#/components/schemas/entity.Disposition"},"type":"object"}},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Batch-read triage dispositions","tags":["dispositions"],"x-api-key-permission":"resources:read"}},"/resources/summary":{"get":{"description":"Aggregate resource counts: total, by type, externally shared, with open findings.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ResourceSummary"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get resource summary","tags":["Resources"],"x-api-key-permission":"resources:read"}},"/resources/{id}":{"get":{"description":"Get a discovered resource by its ID, including open finding count.","parameters":[{"description":"Resource ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ResourceRecord"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a resource","tags":["Resources"],"x-api-key-permission":"resources:read"}},"/resources/{id}/activity":{"get":{"description":"Get the activity timeline for a resource (property changes, scan events).","parameters":[{"description":"Resource ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ResourceActivityPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get resource activity","tags":["Resources"],"x-api-key-permission":"resources:read"}},"/resources/{id}/disposition":{"patch":{"description":"Sets the triage disposition of one identity or resource. Requires identities:write for identities and resources:write for resources. Returns 409 version_conflict when the disposition changed since the supplied version.","parameters":[{"description":"Identity or resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"$ref":"#/components/requestBodies/request.SetDispositionRequest"},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.Disposition"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Set the triage disposition of an inventory item","tags":["dispositions"],"x-api-key-permission":"resources:write"}},"/resources/{id}/identities":{"get":{"description":"List identities linked to a resource via SaaS account mappings or ownership.","parameters":[{"description":"Resource ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ResourceIdentityLink"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List resource identities","tags":["Resources"],"x-api-key-permission":"identities:read"}},"/scan-schedules":{"get":{"description":"List all scan schedules with optional filters.","parameters":[{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by enabled status","in":"query","name":"enabled","schema":{"enum":["true","false"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ScanSchedule"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List scan schedules","tags":["ScanSchedules"],"x-api-key-permission":"scan_schedules:read"},"post":{"description":"Create a recurring scan schedule for a connector. Requires admin role.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateScanScheduleRequest"}}},"description":"Schedule configuration","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ScanSchedule"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create a scan schedule","tags":["ScanSchedules"],"x-api-key-permission":"scan_schedules:write"}},"/scan-schedules/{id}":{"delete":{"description":"Delete a scan schedule by its ID. Requires admin role.","parameters":[{"description":"Scan Schedule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Delete a scan schedule","tags":["ScanSchedules"],"x-api-key-permission":"scan_schedules:write"},"get":{"description":"Get a scan schedule by its ID.","parameters":[{"description":"Scan Schedule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ScanSchedule"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a scan schedule","tags":["ScanSchedules"],"x-api-key-permission":"scan_schedules:read"},"put":{"description":"Update an existing scan schedule. Requires admin role.","parameters":[{"description":"Scan Schedule ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateScanScheduleRequest"}}},"description":"Updated schedule fields","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update a scan schedule","tags":["ScanSchedules"],"x-api-key-permission":"scan_schedules:write"}},"/scans":{"get":{"description":"List all scans with optional filters.","parameters":[{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by scan status","in":"query","name":"status","schema":{"enum":["pending","running","completed","failed"],"type":"string"}},{"description":"Comma-separated status list (any-of). Takes precedence over status.","in":"query","name":"statuses","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.ScanPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List scans","tags":["Scans"],"x-api-key-permission":"scans:read"},"post":{"description":"Start a new security scan for a connector. Requires analyst or admin role.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.StartScanRequest"}}},"description":"Scan parameters","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.ScanResponse"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Start a scan","tags":["Scans"],"x-api-key-permission":"scans:execute"}},"/scans/bulk-cancel":{"post":{"description":"Cancel multiple scans in a single request.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BulkCancelScanRequest"}}},"description":"Scan IDs to cancel","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.CancelResult"},"type":"array"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk cancel scans","tags":["Scans"],"x-api-key-permission":"scans:execute"}},"/scans/bulk-start":{"post":{"description":"Start scans for multiple connectors at once.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BulkStartScanRequest"}}},"description":"Connector IDs and optional resource types","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/response.BulkScanResult"},"type":"array"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk start scans","tags":["Scans"],"x-api-key-permission":"scans:execute"}},"/scans/compare":{"get":{"description":"Compare two scans of one connector from their per-scan detail. The older scan by created_at\nis the baseline, whatever order a and b are given in. Each scan's set is the findings it\nobserved: new = only the newer scan's, unchanged = both, resolved = only the older scan's.\ncounts gives every bucket's size; items is one page of the requested bucket, ranked by\nseverity at scan time, each with the newer scan's at-scan fields when it observed the\nfinding (new, unchanged), else the older scan's (resolved). Under the plan's visible window\nitems is one page of only the bucket's visible findings, total counts them, and withheld the others.","parameters":[{"description":"Scan ID","in":"query","name":"a","required":true,"schema":{"type":"string"}},{"description":"Scan ID of the same connector","in":"query","name":"b","required":true,"schema":{"type":"string"}},{"description":"Bucket to list","in":"query","name":"bucket","schema":{"default":"new","enum":["new","unchanged","resolved"],"type":"string"}},{"description":"Page size (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Offset (default 0)","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ScanCompareResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Unknown scan, or another tenant's"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"per_scan_detail_unavailable: a scan from before per-scan tracking or older than 30 days"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"scans_not_comparable: the scans are not comparable: they must be two completed, full (non-delta) scans of the same connector that observed the same resource types"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Compare two scans","tags":["Scans"],"x-api-key-permission":"scans:read"}},"/scans/{id}":{"get":{"description":"Get a scan by its ID.","parameters":[{"description":"Scan ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.ScanResponse"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a scan","tags":["Scans"],"x-api-key-permission":"scans:read"}},"/scans/{id}/cancel":{"post":{"description":"Cancel a pending, running, or fetching_edge scan. Returns 409 if the scan is already in a terminal state.","parameters":[{"description":"Scan ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.ScanResponse"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Cancel a scan","tags":["Scans"],"x-api-key-permission":"scans:execute"}},"/scans/{id}/progress":{"get":{"description":"Live per-resource-type fetch progress. Items are populated only for edge scans during the fetching_edge phase.","parameters":[{"description":"Scan ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ScanProgress"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get scan progress","tags":["Scans"],"x-api-key-permission":"scans:read"}},"/scans/{scan_id}/findings":{"get":{"description":"Get paginated findings for a specific scan. When per_scan_detail_available is true\n(a scan run since per-scan tracking, less than 30 days old) the items are the findings\nthe scan observed, ranked by their severity at scan time: each carries\nseverity_at_scan, status_at_scan (as the scan evaluated them), change and observed_at\nnext to its current fields, and total matches the scan's total_findings when no chunk\nfailed. Otherwise the items are the findings whose latest scan it is, without the at-scan\nfields. withheld is set only when the plan's visible window applies.","parameters":[{"description":"Scan ID","in":"path","name":"scan_id","required":true,"schema":{"type":"string"}},{"description":"Page size (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Offset (default 0)","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ScanFindingsPage"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get findings by scan","tags":["Scans"],"x-api-key-permission":"findings:read"}},"/setup/guides":{"get":{"description":"List setup guides for all supported connector types.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ConnectorGuide"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List connector setup guides","tags":["Setup"],"x-api-key-permission":"connectors:read"}},"/setup/integration-guides":{"get":{"description":"List step-by-step setup guides for platform integrations (e.g. Slack alerts, email).","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.IntegrationGuide"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List integration setup guides","tags":["Setup"],"x-api-key-permission":"connectors:read"}},"/setup/status":{"get":{"description":"Get the onboarding setup status for the current tenant.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.SetupStatus"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get setup status","tags":["Setup"],"x-api-key-permission":"connectors:read"}},"/severity-overrides":{"get":{"description":"Returns a page of severity overrides, newest first. Requires policies:read.","parameters":[{"description":"Filter by scope (policy or finding)","in":"query","name":"scope","schema":{"type":"string"}},{"description":"Filter by status","in":"query","name":"status","schema":{"type":"string"}},{"description":"Filter by target ID (UUID)","in":"query","name":"target_id","schema":{"type":"string"}},{"description":"Items per page","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.SeverityOverridePagedResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List severity overrides","tags":["Severity Overrides"],"x-api-key-permission":"policies:read"},"post":{"description":"Requests a change to the severity of a policy or finding. Requires policies:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateSeverityOverrideRequest"}}},"description":"Override scope, target, severity and justification","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.SeverityOverride"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create a severity override","tags":["Severity Overrides"],"x-api-key-permission":"policies:write"}},"/severity-overrides/{id}":{"get":{"description":"Returns one severity override. Requires policies:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.SeverityOverride"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a severity override","tags":["Severity Overrides"],"x-api-key-permission":"policies:read"}},"/severity-overrides/{id}/approvals":{"get":{"description":"Returns the approval decisions recorded for one severity override. Requires policies:read.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.ExceptionApproval"},"type":"array"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List severity override approvals","tags":["Severity Overrides"],"x-api-key-permission":"policies:read"}},"/severity-overrides/{id}/revoke":{"post":{"description":"Revokes an active or pending severity override. Requires policies:write.","parameters":[{"description":"Resource ID (UUID)","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.RevokeSeverityOverrideRequest"}}},"description":"Optional revocation reason","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Revoke a severity override","tags":["Severity Overrides"],"x-api-key-permission":"policies:write"}},"/sla-policies":{"get":{"description":"List all SLA policies for the tenant. Requires sla_policies:read permission.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.SLAPolicy"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List SLA policies","tags":["SLA Policies"],"x-api-key-permission":"sla_policies:read"},"post":{"description":"Create a new SLA policy. Requires sla_policies:write permission.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateSLAPolicyRequest"}}},"description":"SLA policy definition","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.SLAPolicy"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create an SLA policy","tags":["SLA Policies"],"x-api-key-permission":"sla_policies:write"}},"/sla-policies/{id}":{"delete":{"description":"Delete an SLA policy by ID. Requires sla_policies:write permission.","parameters":[{"description":"SLA Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"409":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Delete an SLA policy","tags":["SLA Policies"],"x-api-key-permission":"sla_policies:write"},"get":{"description":"Get a single SLA policy by ID. Requires sla_policies:read permission.","parameters":[{"description":"SLA Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.SLAPolicy"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get an SLA policy","tags":["SLA Policies"],"x-api-key-permission":"sla_policies:read"},"put":{"description":"Update an SLA policy by ID. Requires sla_policies:write permission.","parameters":[{"description":"SLA Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateSLAPolicyRequest"}}},"description":"SLA policy update","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.SLAPolicy"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update an SLA policy","tags":["SLA Policies"],"x-api-key-permission":"sla_policies:write"}},"/sla-policies/{id}/activate":{"put":{"description":"Activate an SLA policy by ID, deactivating the previously active policy. Requires sla_policies:write permission.","parameters":[{"description":"SLA Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"*/*":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Activate an SLA policy","tags":["SLA Policies"],"x-api-key-permission":"sla_policies:write"}},"/tenant-policies":{"get":{"description":"List all tenant policies with optional filters, pagination, and sorting.","parameters":[{"description":"Filter by connector type","in":"query","name":"connector_type","schema":{"enum":["okta","cloudflare","gcp","workspace"],"type":"string"}},{"description":"Filter by resource type","in":"query","name":"resource_type","schema":{"type":"string"}},{"description":"Only tenant policies with at least one open finding","in":"query","name":"has_findings","schema":{"type":"boolean"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Sort column","in":"query","name":"sort_by","schema":{"enum":["created_at","name","severity","connector_type"],"type":"string"}},{"description":"Sort direction","in":"query","name":"sort_order","schema":{"enum":["asc","desc"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.PolicyPagedResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List tenant policies","tags":["Tenant Policies"],"x-api-key-permission":"policies:read"},"post":{"description":"Create a new tenant-scoped custom security policy. Requires admin role.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateTenantPolicyRequest"}}},"description":"Tenant policy definition","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.TenantPolicy"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"409":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Conflict"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create a tenant policy","tags":["Tenant Policies"],"x-api-key-permission":"policies:write"}},"/tenant-policies/{id}":{"delete":{"description":"Delete a tenant policy by its ID. Requires admin role.","parameters":[{"description":"Tenant Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Delete a tenant policy","tags":["Tenant Policies"],"x-api-key-permission":"policies:write"},"get":{"description":"Get a tenant policy by its ID.","parameters":[{"description":"Tenant Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.TenantPolicy"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a tenant policy","tags":["Tenant Policies"],"x-api-key-permission":"policies:read"},"put":{"description":"Update an existing tenant policy. Requires admin role.","parameters":[{"description":"Tenant Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateTenantPolicyRequest"}}},"description":"Updated tenant policy fields","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update a tenant policy","tags":["Tenant Policies"],"x-api-key-permission":"policies:write"}},"/tenant-policies/{id}/events":{"get":{"description":"List events for a tenant policy timeline with optional filters.","parameters":[{"description":"Tenant Policy ID","in":"path","name":"id","required":true,"schema":{"type":"string"}},{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by event type (comma-separated)","in":"query","name":"event_type","schema":{"enum":["findings_detected","findings_resolved","findings_reopened","exception_granted","exception_expired","exception_revoked","finding_status_changed","policy_created","policy_updated","policy_enabled","policy_disabled","policy_deleted"],"type":"string"}},{"description":"Start time (RFC3339)","in":"query","name":"since","schema":{"type":"string"}},{"description":"End time (RFC3339)","in":"query","name":"until","schema":{"type":"string"}},{"description":"Max results per page","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Pagination offset","in":"query","name":"offset","schema":{"type":"integer"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.PolicyEventPagedResult"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List tenant policy events","tags":["Tenant Policies"],"x-api-key-permission":"policies:read"}},"/third-party-apps":{"get":{"description":"List OAuth and third-party app integrations discovered across connected SaaS platforms.","parameters":[{"description":"Filter by connector ID","in":"query","name":"connector_id","schema":{"type":"string"}},{"description":"Filter by connector type","in":"query","name":"connector_type","schema":{"type":"string"}},{"description":"Filter by risk level","in":"query","name":"risk","schema":{"enum":["critical","high","medium","low","unknown"],"type":"string"}},{"description":"Filter by status","in":"query","name":"status","schema":{"enum":["discovered","approved","flagged","blocked"],"type":"string"}},{"description":"Filter to AI-detected apps only","in":"query","name":"is_ai_app","schema":{"type":"boolean"}},{"description":"Filter by AI subcategory","in":"query","name":"ai_subcategory","schema":{"enum":["chatbot","code_generation","image_generation","writing","transcription","data_analysis","search","design","video","audio","meeting","sales_marketing","productivity"],"type":"string"}},{"description":"Filter by AI trains-on-data flag","in":"query","name":"ai_trains_on_data","schema":{"enum":["yes","no","unknown"],"type":"string"}},{"description":"Filter by AI tier source","in":"query","name":"ai_source","schema":{"enum":["catalog","heuristic"],"type":"string"}},{"description":"Items per page (default 100, max 1000)","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Number of items to skip","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Sort column","in":"query","name":"sort_by","schema":{"enum":["last_seen_at","first_seen_at","risk","name","user_count","reach_score"],"type":"string"}},{"description":"Sort direction","in":"query","name":"sort_order","schema":{"enum":["asc","desc"],"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ThirdPartyAppPagedResult"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"List third-party apps","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:read"}},"/third-party-apps/ai-data-exposure":{"get":{"description":"Shows which AI apps have access to which data scopes and how many users granted that access.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.AIDataExposure"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get AI data exposure map","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:read"}},"/third-party-apps/bulk-revocation":{"post":{"description":"Request revocation of multiple third-party apps. Requires third_party_apps:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BulkRequestRevocationRequest"}}},"description":"App IDs for revocation","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{"type":"integer"},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk request app revocation","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:write"}},"/third-party-apps/bulk-status":{"post":{"description":"Update the review status of multiple third-party apps at once. Requires third_party_apps:write.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.BulkUpdateThirdPartyAppStatusRequest"}}},"description":"App IDs and new status","required":true},"responses":{"200":{"content":{"application/json":{"schema":{"additionalProperties":{"type":"integer"},"type":"object"}}},"description":"OK"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Bulk update third-party app status","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:write"}},"/third-party-apps/coverage":{"get":{"description":"Returns per-connector app discovery statistics showing which connectors support OAuth app discovery and how many apps have been found.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.DiscoveryCoverage"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get OAuth discovery coverage","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:read"}},"/third-party-apps/export":{"post":{"description":"Create an async CSV or NDJSON export of third-party apps. Requires third_party_apps:read permission. A 429 concurrent_export_limit has no Retry-After header: retry once a running export finishes.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.CreateThirdPartyAppExportRequest"}}},"description":"Export format and filters","required":true},"responses":{"201":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ThirdPartyAppExport"}}},"description":"Created"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Create third-party app export","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:read"}},"/third-party-apps/export/{id}":{"get":{"description":"Get the status of a third-party app export job. Requires third_party_apps:read permission.","parameters":[{"description":"Export ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ThirdPartyAppExport"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get third-party app export status","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:read"}},"/third-party-apps/export/{id}/download":{"get":{"description":"Download a completed third-party app export file. Requires third_party_apps:read permission.","parameters":[{"description":"Export ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/octet-stream":{"schema":{"format":"binary","type":"string"}}},"description":"OK"},"400":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"},"503":{"content":{"application/octet-stream":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Service Unavailable"}},"security":[{"ApiKeyAuth":[]}],"summary":"Download third-party app export","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:read"}},"/third-party-apps/summary":{"get":{"description":"Get aggregated counts of third-party apps by risk level and status.","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ThirdPartyAppSummary"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get third-party app summary","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:read"}},"/third-party-apps/{id}":{"get":{"description":"Get a third-party app by its ID.","parameters":[{"description":"Third-party app ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.ThirdPartyApp"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get a third-party app","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:read"}},"/third-party-apps/{id}/blast-radius":{"get":{"description":"One-hop token-theft reach graph (data categories, authorizer cohort, reachable people, findings) for an integration.","parameters":[{"description":"Third-party app ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/entity.BlastRadiusGraph"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Get integration blast-radius graph","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:read"}},"/third-party-apps/{id}/request-revocation":{"post":{"description":"Request revocation of a third-party app's OAuth grant. Requires third_party_apps:write.","parameters":[{"description":"Third-party app ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"No Content"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Request app revocation","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:write"}},"/third-party-apps/{id}/status":{"patch":{"description":"Update the review status of a third-party app. Requires third_party_apps:write permission.","parameters":[{"description":"Third-party app ID","in":"path","name":"id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/request.UpdateThirdPartyAppStatusRequest"}}},"description":"New status","required":true},"responses":{"204":{"description":"No Content"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Bad Request"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Update third-party app status","tags":["Third-Party Apps"],"x-api-key-permission":"third_party_apps:write"}},"/ticketing/issue-types":{"get":{"description":"List available issue types from the external ticketing system.","responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.TicketIssueType"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Fetch ticketing issue types","tags":["Ticketing"],"x-api-key-permission":"ticketing:write"}},"/ticketing/users":{"get":{"description":"Search for assignable users in the external ticketing system.","parameters":[{"description":"Search query for user lookup","in":"query","name":"query","schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/entity.TicketUser"},"type":"array"}}},"description":"OK"},"401":{"$ref":"#/components/responses/APIKeyUnauthorized"},"403":{"$ref":"#/components/responses/APIKeyForbidden"},"404":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Not Found"},"429":{"$ref":"#/components/responses/APIKeyRateLimited"},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/response.Error"}}},"description":"Internal Server Error"}},"security":[{"ApiKeyAuth":[]}],"summary":"Fetch ticketing users","tags":["Ticketing"],"x-api-key-permission":"ticketing:write"}}},"servers":[{"description":"Production","url":"https://api.blackcatsecurity.fr/v1"}]}