{"schemaVersion":1,"catalogId":"moco","title":"Moco API contracts","branding":{"displayName":"","logoSrc":"","logoAlt":"","logoHomeHref":"","faviconHref":""},"defaultDocumentKey":"public","profileId":"strict-v1","searchChild":"search/directory.json","documents":[{"key":"internal","sourcePath":"internal.yaml","title":"Mocó Internal Operations API","apiVersion":"0.9.0","branding":{"displayName":"","logoSrc":"","logoAlt":"","logoHomeHref":"","faviconHref":""},"overview":{"anchor":"overview","href":"?selected=overview#overview","headingId":"overview-heading","heading":"Mocó Internal Operations API","headingLevel":2,"description":"Process probes, deployment-scoped authorization administration, and a\nrestricted request audit ledger for security observability. The audit\noperation is not a reconciliation/change feed; controllers and operators\nuse the public watch endpoint and relist contract for convergence. A\nbounded local retention operation removes events before an operator-supplied\ncutoff without changing public resource history.\nThe encryption operations report the shared root-key state and perform\nbounded online rewraps of vault data keys under the configured active\nroot-key era; key material is supplied only by deployment configuration and\nis never accepted or returned by this API.\nAdministrative operations are intended for a restricted deployment origin;\nthey never expose bearer token digests or request payloads.\n","termsOfService":"","specDownloadFilename":"internal.yaml","contact":{"name":"AraiHu","url":"https://github.com/araihu/moco","email":""},"license":{"name":"","url":"","identifier":""},"servers":[{"ordinal":0,"id":"server-0ed6a4449f076ffab47ae3a3e5ab027725d2fc310ec7eac41f75457052b219b0","url":"/","description":"Direct deployment origin, normally restricted by network policy.","variables":[]}]},"sourceChild":"sources/internal.yaml","schemaNodeShards":[{"path":"schema-nodes/internal/4d9e705d1857d8dc6deb8e5ec2572bbca4fa034e160e663f0fcb03282cb055ce.json","firstOrdinal":0,"lastOrdinal":77,"records":78,"length":58246,"sha256":"4d9e705d1857d8dc6deb8e5ec2572bbca4fa034e160e663f0fcb03282cb055ce"}],"operations":[{"detailId":"detail-sha256-3e63e545264f0a0c02346c8ef6271e3c32e122859439b0d9a627ea46f1c9f40c","operationId":"listAuditEvents","method":"GET","path":"/internal/v1/audit","title":"List request audit events","description":"Returns request metadata in ascending durable sequence order for security observability. Successful mutations and their event commit in one SQLite transaction before the success response; failed audit or commit rolls back the mutation. Startup metadata initialization uses a synthetic STARTUP event with route /internal/startup and principal system:startup. Read-only and rejected attempts are recorded independently after their response and may be missing on audit failure. This is not a reconciliation or change-feed operation; controllers and operators must use the public watch endpoint and relist contract for convergence. Query strings, request bodies, bearer credentials, and plaintext logical secret paths are never returned; secret paths are represented only by keyed HMAC-SHA-256 digests. Reads from this endpoint are not themselves recorded, so a tailing client cannot create self-events. The endpoint is internal and requires an explicit authorization policy for its exact path.","href":"documents/internal/?selected=detail-sha256-3e63e545264f0a0c02346c8ef6271e3c32e122859439b0d9a627ea46f1c9f40c#detail-sha256-3e63e545264f0a0c02346c8ef6271e3c32e122859439b0d9a627ea46f1c9f40c","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","deprecated":false,"tags":["Audit"],"facets":[]},{"detailId":"detail-sha256-6a074f721fb29e07985dc47ff85f4c9e76bac2f252d588ea4b34471168b26cb3","operationId":"purgeAuditEvents","method":"POST","path":"/internal/v1/audit/retention","title":"Purge one bounded audit-retention page","description":"Deletes at most 200 audit events strictly older than the required cutoff; destructive requests require a cutoff at least one hour old. This is local deployment maintenance, not a public resource mutation. Set dryRun=true to preview the current matching count without deleting anything, including with a more recent past cutoff; a dry-run result is informational, not a convergence loop. For a delete, repeat the same cutoff until complete is true and remaining is zero; the count is not a snapshot and newly inserted events can change it. Sequence numbers remain monotonic, the public resource-watch revision is unchanged, and event contents, credentials, plaintext secret paths, and key material are never accepted or returned. The endpoint requires an explicit exact-path POST policy and should be restricted to a deployment origin.","href":"documents/internal/?selected=detail-sha256-6a074f721fb29e07985dc47ff85f4c9e76bac2f252d588ea4b34471168b26cb3#detail-sha256-6a074f721fb29e07985dc47ff85f4c9e76bac2f252d588ea4b34471168b26cb3","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","deprecated":false,"tags":["Audit"],"facets":[]},{"detailId":"detail-sha256-fd12f67945f8cd7ff18f0fe753b0a30c09e3ce2d9ac0565909b114197fe28113","operationId":"getAuthorizationSnapshot","method":"GET","path":"/internal/v1/authorization","title":"Read the persisted authorization snapshot","description":"Returns the complete role-binding and policy snapshot without token digests. The ETag is the authoritative snapshot revision. A policy's optional secretPathPrefix narrows the decoded logical path or prefix query value for a secret item, metadata, or collection route and is a literal prefix match.","href":"documents/internal/?selected=detail-sha256-fd12f67945f8cd7ff18f0fe753b0a30c09e3ce2d9ac0565909b114197fe28113#detail-sha256-fd12f67945f8cd7ff18f0fe753b0a30c09e3ce2d9ac0565909b114197fe28113","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","deprecated":false,"tags":["Authorization"],"facets":[]},{"detailId":"detail-sha256-3cafa1426d640b94ab0ef67c87ecbf3a335ce4a4523573d1d64177fc387206c5","operationId":"replaceAuthorizationSnapshot","method":"PUT","path":"/internal/v1/authorization","title":"Replace the persisted authorization snapshot","description":"Atomically replaces all role bindings and policies when If-Match identifies the revision observed by the writer. A committed change signals local reloaders and is discovered by shared-store polling in other processes. Set secretPathPrefix only on a policy for a canonical secret operation route; policies without it remain vault-scoped.","href":"documents/internal/?selected=detail-sha256-3cafa1426d640b94ab0ef67c87ecbf3a335ce4a4523573d1d64177fc387206c5#detail-sha256-3cafa1426d640b94ab0ef67c87ecbf3a335ce4a4523573d1d64177fc387206c5","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","deprecated":false,"tags":["Authorization"],"facets":[]},{"detailId":"detail-sha256-5d5c60540aa0953b4443f2bfa72c762185b57d49789b140b61e83c4f90c1b6cf","operationId":"rotateEncryptionKeys","method":"POST","path":"/internal/v1/encryption/rotation","title":"Rewrap one bounded page of vault data keys","description":"Rewraps persisted vault data keys whose root key ID is not the configured active era. The active and previous root keys are loaded from deployment configuration; this operation never accepts, returns, or logs key material. Repeating a page is safe. Use both returned keyset checkpoints to continue when hasMore is true, then run a fresh sweep until complete is true and remainingOldKeys is zero. The server persists an encryption-key epoch and rejects stale processes; the expected active ID and epoch are revalidated atomically in each key replacement, so all writers must start with the current epoch before maintenance. Rotation changes only wrapped-key bytes, not secret ciphertext, resource versions, or API representations, and may be run concurrently by workers in the same epoch.","href":"documents/internal/?selected=detail-sha256-5d5c60540aa0953b4443f2bfa72c762185b57d49789b140b61e83c4f90c1b6cf#detail-sha256-5d5c60540aa0953b4443f2bfa72c762185b57d49789b140b61e83c4f90c1b6cf","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","deprecated":false,"tags":["Encryption"],"facets":[]},{"detailId":"detail-sha256-abe4a63ca7fa8173a0751ecfcfa2cf5205399442cd042be7057c9a16dfba7530","operationId":"getEncryptionStatus","method":"GET","path":"/internal/v1/encryption/status","title":"Read root-key rotation status","description":"Reads the current shared root-key era, deployment epoch, and count of vault keys still using an older era. The result is a point-in-time diagnostic, not a lock or a snapshot; it never accepts or returns key material, plaintext, ciphertext, or secret paths. Use it to coordinate bounded POST /internal/v1/encryption/rotation pages and remove an old deployment key only after a fresh sweep reports complete=true and remainingOldKeys=0. A concurrent writer or rotation worker can change the result immediately.","href":"documents/internal/?selected=detail-sha256-abe4a63ca7fa8173a0751ecfcfa2cf5205399442cd042be7057c9a16dfba7530#detail-sha256-abe4a63ca7fa8173a0751ecfcfa2cf5205399442cd042be7057c9a16dfba7530","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","deprecated":false,"tags":["Encryption"],"facets":[]},{"detailId":"detail-sha256-ca727aa951b148cc011d6d480cc51285955eee3805ab733d843019f3891d1b2a","operationId":"getLiveness","method":"GET","path":"/livez","title":"Check process liveness","description":"Returns 200 while the server process can handle HTTP requests.","href":"documents/internal/?selected=detail-sha256-ca727aa951b148cc011d6d480cc51285955eee3805ab733d843019f3891d1b2a#detail-sha256-ca727aa951b148cc011d6d480cc51285955eee3805ab733d843019f3891d1b2a","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","deprecated":false,"tags":["Health"],"facets":[]},{"detailId":"detail-sha256-e2ee950cd7f8d693837cebd113f42bbaaaa63b59510398931029854b0000af23","operationId":"getReadiness","method":"GET","path":"/readyz","title":"Check traffic readiness","description":"Returns 200 when the instance can serve product traffic and 503 otherwise.\nThe body deliberately omits dependency and configuration details.\n","href":"documents/internal/?selected=detail-sha256-e2ee950cd7f8d693837cebd113f42bbaaaa63b59510398931029854b0000af23#detail-sha256-e2ee950cd7f8d693837cebd113f42bbaaaa63b59510398931029854b0000af23","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","deprecated":false,"tags":["Health"],"facets":[]}],"schemas":[{"detailId":"detail-sha256-7a7419ccddd53fabc88030b82d8c65caeac4c3500b881edcebf6f6b0e45df06c","name":"audit-event","description":"Request audit metadata without request bodies, query strings, credentials, or plaintext secret paths.","href":"documents/internal/?selected=detail-sha256-7a7419ccddd53fabc88030b82d8c65caeac4c3500b881edcebf6f6b0e45df06c#detail-sha256-7a7419ccddd53fabc88030b82d8c65caeac4c3500b881edcebf6f6b0e45df06c","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"2b48ffc28dd2148f1e57736e6d28ca4036e5ef26416c24807053990428f5b42a","projectionSHA256":"a80daedd4a4fdbb587b30e2ecfd48f40310aef80731c58e6c06466056a7d03a4"},{"detailId":"detail-sha256-f05715a028579803d7bc8a21a28df55868557f9147faa5a0d28416b6f43cadbd","name":"audit-event-list","description":"Ordered page from the append-only audit ledger.","href":"documents/internal/?selected=detail-sha256-f05715a028579803d7bc8a21a28df55868557f9147faa5a0d28416b6f43cadbd#detail-sha256-f05715a028579803d7bc8a21a28df55868557f9147faa5a0d28416b6f43cadbd","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"67be71c7aa30d458cf252f77153a1cf4e16e24618fc231614c078f454934919d","projectionSHA256":"4b72f81700d4f5f1444cec4cb0be06ee8737556033509d011ad327b1ca9d1025"},{"detailId":"detail-sha256-f7f5abee967bf271faac94ec1a75b332fa069a62cf3504a9c5c6b1f8a7660b93","name":"audit-retention-result","description":"Bounded local audit retention result. It contains no event contents; remaining is a current diagnostic rather than a historical snapshot.","href":"documents/internal/?selected=detail-sha256-f7f5abee967bf271faac94ec1a75b332fa069a62cf3504a9c5c6b1f8a7660b93#detail-sha256-f7f5abee967bf271faac94ec1a75b332fa069a62cf3504a9c5c6b1f8a7660b93","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"8796bd84c6ccb2a57b63b24fa05354c4a682226e017b518f05bccaafc46fd12e","projectionSHA256":"17a53b629e7b8b8d9474f2aadf277717078bf48d3be9ed59795f454ea76309ab"},{"detailId":"detail-sha256-26dd225103a1272e919d7e0609daa727b52bb14770bb96e15263029f887503c1","name":"authorization-policy","description":"Allow policy for a role or principal, domain, path pattern, and HTTP method. Secret operation policies may additionally narrow access to a literal logical secret path prefix.","href":"documents/internal/?selected=detail-sha256-26dd225103a1272e919d7e0609daa727b52bb14770bb96e15263029f887503c1#detail-sha256-26dd225103a1272e919d7e0609daa727b52bb14770bb96e15263029f887503c1","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"7a62ba5d30129c0236ed259b6f59961d8c28d278bcc958b82f71324d260d1608","projectionSHA256":"6ca8c83c20330577f14a31128f2b4990e51bd029e3d659ac899b873308a18871"},{"detailId":"detail-sha256-db80c3cdd697f1419fdfad9d787b310039be2280edd7bf9c9a3ce19a3ce18d82","name":"authorization-role-binding","description":"Principal-to-role binding scoped to one authorization domain.","href":"documents/internal/?selected=detail-sha256-db80c3cdd697f1419fdfad9d787b310039be2280edd7bf9c9a3ce19a3ce18d82#detail-sha256-db80c3cdd697f1419fdfad9d787b310039be2280edd7bf9c9a3ce19a3ce18d82","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"4a235627e147a86af56f8e4dadb0eeb990c2818af1f83d932877a25b3ec7bbd5","projectionSHA256":"2fec688137369bd87017e43957b1277fd8e55f8704f12f39dcf8af3d1a91c7bf"},{"detailId":"detail-sha256-0d75ac26890e4546cb5bbcb7b269b548f066e96a68a2faad5d1f5995cbd36e3c","name":"authorization-snapshot","description":"Persisted authorization state; token digests are intentionally omitted.","href":"documents/internal/?selected=detail-sha256-0d75ac26890e4546cb5bbcb7b269b548f066e96a68a2faad5d1f5995cbd36e3c#detail-sha256-0d75ac26890e4546cb5bbcb7b269b548f066e96a68a2faad5d1f5995cbd36e3c","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"4c9316ff69ad96efdc72eb40345cfa3a15e5858b02d313c309baa5d65ead0596","projectionSHA256":"5172334b81043dddbaf244fd0921cbab5c49fb1e8671670fb9526bb11cce5745"},{"detailId":"detail-sha256-f39d973a51b7c9e8dd4fa737c998640c134d27c5445d13ca532b46051708c3a1","name":"authorization-snapshot-input","description":"Complete replacement snapshot; empty arrays intentionally mean default-deny.","href":"documents/internal/?selected=detail-sha256-f39d973a51b7c9e8dd4fa737c998640c134d27c5445d13ca532b46051708c3a1#detail-sha256-f39d973a51b7c9e8dd4fa737c998640c134d27c5445d13ca532b46051708c3a1","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"3a5f2274a29a479cc70fa7b57e5e2c109f6acb12e616ea6f0c175c6ae7b30d83","projectionSHA256":"3111d6961a91fc5d8508fba6fe4dd526ea0c546f7b20166359ea47b545e4c30d"},{"detailId":"detail-sha256-730dfacb1c72c05906582efdfba89193b11f7b3b5e7824be54ec56119c02e5de","name":"encryption-rotation-result","description":"Bounded root-key rewrap result. It contains counts and a keyset checkpoint only; no key material or secret data is returned.","href":"documents/internal/?selected=detail-sha256-730dfacb1c72c05906582efdfba89193b11f7b3b5e7824be54ec56119c02e5de#detail-sha256-730dfacb1c72c05906582efdfba89193b11f7b3b5e7824be54ec56119c02e5de","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"9dd93c16f661863b19eef3cf370b48d6ec8be2563a97c84bf55b6500356316ef","projectionSHA256":"d9a267a339dd1ffaf090d7e7aa5766b1c7469bc488532f4877239e83d4a556a1"},{"detailId":"detail-sha256-9f307314aa8cbf4a88f21ffa518ce0d71dd4d2d25acddc85c900542affe2d3f0","name":"encryption-rotation-status","description":"Current shared root-key rotation state. Counts are point-in-time diagnostics, not a lock or a snapshot; no key material is returned.","href":"documents/internal/?selected=detail-sha256-9f307314aa8cbf4a88f21ffa518ce0d71dd4d2d25acddc85c900542affe2d3f0#detail-sha256-9f307314aa8cbf4a88f21ffa518ce0d71dd4d2d25acddc85c900542affe2d3f0","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"9aa8be3c57a88639c8add3d54490c78f94eebadfc5a73ef6c80b78165deb2e2a","projectionSHA256":"22eb666c1aa5790c2e1467e4b5b096d9d2687d44ad4671927ea3da04711fcaba"},{"detailId":"detail-sha256-7b3eee7eaed213d81e60cb00894586ee4e09c903fa894b968665699697edc467","name":"health-status","description":"Minimal probe result with no deployment details.","href":"documents/internal/?selected=detail-sha256-7b3eee7eaed213d81e60cb00894586ee4e09c903fa894b968665699697edc467#detail-sha256-7b3eee7eaed213d81e60cb00894586ee4e09c903fa894b968665699697edc467","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"a54e4ee9450bd7255ca45174b7e4b9157553707e1ea7023793a60e7dff904656","projectionSHA256":"a3a15a6aab456c24280ceab0b8cd848ce398b5e256cc673382f76666db502cdb"},{"detailId":"detail-sha256-32c5f38aa3f3d4dc064b1d4a1b1a731dc3568c3e43f9c6bcddcbb643709ff156","name":"problem","description":"Problem Details response compatible with RFC 9457.","href":"documents/internal/?selected=detail-sha256-32c5f38aa3f3d4dc064b1d4a1b1a731dc3568c3e43f9c6bcddcbb643709ff156#detail-sha256-32c5f38aa3f3d4dc064b1d4a1b1a731dc3568c3e43f9c6bcddcbb643709ff156","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"493b3a767d41e892ba1b859b1b5556502593eb5de66d4a170561a0246ffeb204","projectionSHA256":"607c36c5d0ea5bf9b34ff74a4965436ad5dfcd8ac4bd43f5472115f8f5f3ad27"},{"detailId":"detail-sha256-cd49d017d6a9aa82fd15fd4b37d5fb43476b2d15514a336f5f7099248c79f363","name":"problem-error","description":"Field-specific validation failure safe to expose to clients.","href":"documents/internal/?selected=detail-sha256-cd49d017d6a9aa82fd15fd4b37d5fb43476b2d15514a336f5f7099248c79f363#detail-sha256-cd49d017d6a9aa82fd15fd4b37d5fb43476b2d15514a336f5f7099248c79f363","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"2c480456a51780e46f9b799a861f7e1e9a0d86f8a27d2c042547e98059c4d197","projectionSHA256":"ad21bfff93537b1d1f9deb7bb953db3c452da7d27ec3bb9f3e15c03841987e2a"},{"detailId":"detail-sha256-281126c52946bc7e9e5810da7849fa8da0fd2b6a3fbe68a97c2f820ce24c6c7d","name":"unavailable-status","description":"Minimal readiness failure with no dependency details.","href":"documents/internal/?selected=detail-sha256-281126c52946bc7e9e5810da7849fa8da0fd2b6a3fbe68a97c2f820ce24c6c7d#detail-sha256-281126c52946bc7e9e5810da7849fa8da0fd2b6a3fbe68a97c2f820ce24c6c7d","detailChild":"details/internal/8526314cd3eefda130681a4ac3559ff6cc7fa446da787bce7f209ad3f6c7b7a8.json","canonicalSHA256":"f2e76e4969170c137ea4098e8df7e6ef8ad341825aadbe506a58b5b6b558e88d","projectionSHA256":"500be7ca7a74ba76fc9a437c833620a94af40310c489948359c18414aea13d30"}],"securitySchemes":[{"name":"bearerAuth","anchor":"security-scheme-c41694373770a9cd","type":"http","description":"Deployment-issued bearer credential for restricted operations.","scheme":"bearer"}]},{"key":"public","sourcePath":"public.yaml","title":"Mocó Public API","apiVersion":"0.2.0","branding":{"displayName":"","logoSrc":"","logoAlt":"","logoHomeHref":"","faviconHref":""},"overview":{"anchor":"overview","href":"?selected=overview#overview","headingId":"overview-heading","heading":"Mocó Public API","headingLevel":2,"description":"Tenant-isolated, path-based secret management for interactive and\nautomated clients. The contract makes no network-topology assumptions:\nclients can run inside or outside the Mocó Kubernetes cluster.\n","termsOfService":"","specDownloadFilename":"public.yaml","contact":{"name":"AraiHu","url":"https://github.com/araihu/moco","email":""},"license":{"name":"","url":"","identifier":""},"servers":[{"ordinal":0,"id":"server-0ed6a4449f076ffab47ae3a3e5ab027725d2fc310ec7eac41f75457052b219b0","url":"/","description":"Current deployment origin. Production deployments use TLS.","variables":[]}]},"sourceChild":"sources/public.yaml","schemaNodeShards":[{"path":"schema-nodes/public/e215ec44bc88bbc40e20ee6e1f03b6075a4cfb4a3e971adb5dd4f1bb76b23e61.json","firstOrdinal":0,"lastOrdinal":97,"records":98,"length":72587,"sha256":"e215ec44bc88bbc40e20ee6e1f03b6075a4cfb4a3e971adb5dd4f1bb76b23e61"}],"operations":[{"detailId":"detail-sha256-08014d7440299ed3f2cb4bba798f3e5a8ad652accabde80ac8fb11fa3ec6c1c4","operationId":"getServiceInfo","method":"GET","path":"/api/v1","title":"Get API compatibility information","description":"Returns server and API versions plus stable capability identifiers.","href":"documents/public/?selected=detail-sha256-08014d7440299ed3f2cb4bba798f3e5a8ad652accabde80ac8fb11fa3ec6c1c4#detail-sha256-08014d7440299ed3f2cb4bba798f3e5a8ad652accabde80ac8fb11fa3ec6c1c4","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Service"],"facets":[]},{"detailId":"detail-sha256-154fa7b76e6ddbf880c54cbc7caf37bbafdfe19a60b3c3adda5ec8bbc498f125","operationId":"listTenants","method":"GET","path":"/api/v1/tenants","title":"List tenants","description":"Lists tenants in the caller's collection authorization scope. The first\nrequest creates a sequence-bounded snapshot; follow `nextCursor` until\n`hasMore` is false. If a cursor expires, restart without one. Name and\nexternalId filters are exact and may be combined. For deterministic\nadoption, controllers should use an exact immutable `externalId` filter\nbefore creating a tenant.\n","href":"documents/public/?selected=detail-sha256-154fa7b76e6ddbf880c54cbc7caf37bbafdfe19a60b3c3adda5ec8bbc498f125#detail-sha256-154fa7b76e6ddbf880c54cbc7caf37bbafdfe19a60b3c3adda5ec8bbc498f125","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Tenants"],"facets":[]},{"detailId":"detail-sha256-08d401bf18181071e1454a0ca28c82c40e67ad0c504204a95af2317939c6d7f5","operationId":"createTenant","method":"POST","path":"/api/v1/tenants","title":"Create a tenant","description":"Creates a tenant. Name and externalId are independently unique. Automation\nshould supply an externalId and Idempotency-Key. A uniqueness conflict\nreturns the existing resourceId when safe, allowing an atomic adoption\nhandshake. Repeating an identical request with the same Idempotency-Key\nreturns the original result; reusing that key with another body returns 409.\n","href":"documents/public/?selected=detail-sha256-08d401bf18181071e1454a0ca28c82c40e67ad0c504204a95af2317939c6d7f5#detail-sha256-08d401bf18181071e1454a0ca28c82c40e67ad0c504204a95af2317939c6d7f5","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Tenants"],"facets":[]},{"detailId":"detail-sha256-48d29952ef6c6cfb27ddab6ca54285669cbcf7c5f4028583b4008da8f96040b0","operationId":"deleteTenant","method":"DELETE","path":"/api/v1/tenants/{tenantId}","title":"Delete a tenant","description":"Deletes an empty tenant. With cascade=true, also deletes all child vaults\nand secrets. A missing tenant returns 404; reconcilers may treat it as\nsuccess. If-Match is optional, but recommended for retries that must not\ndelete a newer revision.\n","href":"documents/public/?selected=detail-sha256-48d29952ef6c6cfb27ddab6ca54285669cbcf7c5f4028583b4008da8f96040b0#detail-sha256-48d29952ef6c6cfb27ddab6ca54285669cbcf7c5f4028583b4008da8f96040b0","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Tenants"],"facets":[]},{"detailId":"detail-sha256-d637ac9553361d77b7251ffbbd4a6296ad629dbd82f73ca7f30e8c32d786f761","operationId":"getTenant","method":"GET","path":"/api/v1/tenants/{tenantId}","title":"Get a tenant","description":"Returns one tenant by its stable ID.","href":"documents/public/?selected=detail-sha256-d637ac9553361d77b7251ffbbd4a6296ad629dbd82f73ca7f30e8c32d786f761#detail-sha256-d637ac9553361d77b7251ffbbd4a6296ad629dbd82f73ca7f30e8c32d786f761","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Tenants"],"facets":[]},{"detailId":"detail-sha256-3aec0ff721b6a6e879f0dcf7dd7e0dce784cb8e43027c17da5a1489ad55d8f87","operationId":"updateTenant","method":"PUT","path":"/api/v1/tenants/{tenantId}","title":"Update a tenant","description":"Replaces all mutable fields. externalId and server fields are immutable.\nIf-Match is optional; omit it only for an intentionally unconditional\nmutation. Retrying clients should read the representation and use its ETag.\n","href":"documents/public/?selected=detail-sha256-3aec0ff721b6a6e879f0dcf7dd7e0dce784cb8e43027c17da5a1489ad55d8f87#detail-sha256-3aec0ff721b6a6e879f0dcf7dd7e0dce784cb8e43027c17da5a1489ad55d8f87","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Tenants"],"facets":[]},{"detailId":"detail-sha256-ff949d013794d7813787cc98110a6df91aa0a302e26284e9e2f481a659919e8b","operationId":"listVaults","method":"GET","path":"/api/v1/tenants/{tenantId}/vaults","title":"List vaults","description":"Lists vaults in the caller's tenant authorization scope. The first request\ncreates a sequence-bounded snapshot; follow `nextCursor` until `hasMore` is\nfalse. If a cursor expires, restart without one. Name and externalId filters\nare exact and may be combined. For deterministic adoption, controllers\nshould use an exact immutable `externalId` filter before creating a vault.\n","href":"documents/public/?selected=detail-sha256-ff949d013794d7813787cc98110a6df91aa0a302e26284e9e2f481a659919e8b#detail-sha256-ff949d013794d7813787cc98110a6df91aa0a302e26284e9e2f481a659919e8b","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Vaults"],"facets":[]},{"detailId":"detail-sha256-cad7bacbebf7824fba2cc6b2f8f6640212e04f0284f72a853767a8a257f38c68","operationId":"createVault","method":"POST","path":"/api/v1/tenants/{tenantId}/vaults","title":"Create a vault","description":"Creates a tenant-scoped vault. Name and externalId are independently unique\nwithin the tenant. Automation should supply an externalId and\nIdempotency-Key. A uniqueness conflict returns the existing resourceId when\nsafe, allowing an atomic adoption handshake. Repeating an identical request\nwith the same Idempotency-Key returns the original result.\n","href":"documents/public/?selected=detail-sha256-cad7bacbebf7824fba2cc6b2f8f6640212e04f0284f72a853767a8a257f38c68#detail-sha256-cad7bacbebf7824fba2cc6b2f8f6640212e04f0284f72a853767a8a257f38c68","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Vaults"],"facets":[]},{"detailId":"detail-sha256-87b6ea8619c4082fd21e23de9f3d81afc6f0388d80bbdb6d62abe65421eb364c","operationId":"deleteVault","method":"DELETE","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}","title":"Delete a vault","description":"Deletes an empty vault. With cascade=true, also deletes all stored secrets.\nA missing vault returns 404; reconcilers may treat it as success. If-Match\nis optional, but recommended for retries that must not delete a newer revision.\n","href":"documents/public/?selected=detail-sha256-87b6ea8619c4082fd21e23de9f3d81afc6f0388d80bbdb6d62abe65421eb364c#detail-sha256-87b6ea8619c4082fd21e23de9f3d81afc6f0388d80bbdb6d62abe65421eb364c","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Vaults"],"facets":[]},{"detailId":"detail-sha256-2979b128008d15fbcc3be067c97c74504e0e89391a1dd6184319edf2ba04446d","operationId":"getVault","method":"GET","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}","title":"Get a vault","description":"Returns one vault by stable tenant-scoped ID.","href":"documents/public/?selected=detail-sha256-2979b128008d15fbcc3be067c97c74504e0e89391a1dd6184319edf2ba04446d#detail-sha256-2979b128008d15fbcc3be067c97c74504e0e89391a1dd6184319edf2ba04446d","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Vaults"],"facets":[]},{"detailId":"detail-sha256-c824e2d15c3113873634a3aba607510a9ba850844116ad77d4c53f5c6522fae5","operationId":"updateVault","method":"PUT","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}","title":"Update a vault","description":"Replaces all mutable fields. externalId and server fields are immutable.\nIf-Match is optional; omit it only for an intentionally unconditional\nmutation. Retrying clients should read the representation and use its ETag.\n","href":"documents/public/?selected=detail-sha256-c824e2d15c3113873634a3aba607510a9ba850844116ad77d4c53f5c6522fae5#detail-sha256-c824e2d15c3113873634a3aba607510a9ba850844116ad77d4c53f5c6522fae5","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Vaults"],"facets":[]},{"detailId":"detail-sha256-27759688532fc281245bc30ae6c57d2a90dd8ef2ab18e25acefe22ef6e6da482","operationId":"deleteSecret","method":"DELETE","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}/secret","title":"Delete a secret","description":"Deletes the value at path. A missing secret returns 404; reconcilers may\ntreat that response as successful convergence.\n","href":"documents/public/?selected=detail-sha256-27759688532fc281245bc30ae6c57d2a90dd8ef2ab18e25acefe22ef6e6da482#detail-sha256-27759688532fc281245bc30ae6c57d2a90dd8ef2ab18e25acefe22ef6e6da482","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Secrets"],"facets":[]},{"detailId":"detail-sha256-a44c676d0341bd13190dc7e9b043572534e79f980ff033e330f3cc56e436f7bc","operationId":"getSecret","method":"GET","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}/secret","title":"Read a secret","description":"Returns one secret including its base64-encoded value. Clients must keep the\nresponse out of logs, status fields, events, metrics, traces, and caches.\nAuthorization is evaluated at vault granularity unless the deployment's\ninternal authorization policy sets `secretPathPrefix` for this route. When\npresent, the decoded logical `path` must begin with that literal prefix.\nUse a dedicated vault when a secret needs an independent policy scope.\n","href":"documents/public/?selected=detail-sha256-a44c676d0341bd13190dc7e9b043572534e79f980ff033e330f3cc56e436f7bc#detail-sha256-a44c676d0341bd13190dc7e9b043572534e79f980ff033e330f3cc56e436f7bc","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Secrets"],"facets":[]},{"detailId":"detail-sha256-8d5fc75c8c5f35b7fc5a1b59b7f08f8aea957e63bef2a9a7368b6885fc8b2157","operationId":"putSecret","method":"PUT","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}/secret","title":"Create or replace a secret","description":"Creates or replaces the value at path. `If-None-Match: *` makes the request\ncreate-only; `If-Match` makes it replace-only at a known ETag. Sending both\nheaders returns 400. Without either header the operation is an unconditional,\nidempotent upsert. The response contains metadata, never the submitted value.\nAuthorization remains vault-scoped for policies without a path prefix. A\ndeployment may narrow this operation with `secretPathPrefix` on its\ninternal authorization snapshot; the requested `path` must be within the\nconfigured prefix.\n","href":"documents/public/?selected=detail-sha256-8d5fc75c8c5f35b7fc5a1b59b7f08f8aea957e63bef2a9a7368b6885fc8b2157#detail-sha256-8d5fc75c8c5f35b7fc5a1b59b7f08f8aea957e63bef2a9a7368b6885fc8b2157","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Secrets"],"facets":[]},{"detailId":"detail-sha256-ba3a120215c2475ba42ddb3974fd14649d11f6af2dd2e07ce6ce0c56387efd44","operationId":"getSecretMetadata","method":"GET","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}/secret/metadata","title":"Inspect secret state without reading its value","description":"Returns metadata only. Controllers should prefer this operation for drift\nchecks that do not require plaintext. When a deployment configures\n`secretPathPrefix`, the decoded `path` must begin with that literal prefix.\n","href":"documents/public/?selected=detail-sha256-ba3a120215c2475ba42ddb3974fd14649d11f6af2dd2e07ce6ce0c56387efd44#detail-sha256-ba3a120215c2475ba42ddb3974fd14649d11f6af2dd2e07ce6ce0c56387efd44","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Secrets"],"facets":[]},{"detailId":"detail-sha256-ec6c7af5e5d038ad2fc587a3e4fc5b3833e8770823fa9581b44ec236a086dacb","operationId":"listSecrets","method":"GET","path":"/api/v1/tenants/{tenantId}/vaults/{vaultId}/secrets","title":"List secret metadata","description":"Lists metadata only; values are never returned. The first request creates a\nsequence-bounded snapshot. Follow `nextCursor` until `hasMore` is false. If\nthe cursor expires, restart without one. Omit `prefix` to list the complete\nvault only when the authorization policy is vault-scoped. A path-scoped\npolicy requires a non-empty `prefix` within its configured\n`secretPathPrefix`. Use `GET /api/v1/watch` as a full-resync signal after\nmutations, including deletions.\n","href":"documents/public/?selected=detail-sha256-ec6c7af5e5d038ad2fc587a3e4fc5b3833e8770823fa9581b44ec236a086dacb#detail-sha256-ec6c7af5e5d038ad2fc587a3e4fc5b3833e8770823fa9581b44ec236a086dacb","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Secrets"],"facets":[]},{"detailId":"detail-sha256-d5f084f7ae74cba60ab11854d194aad1e6471dcb7c864754d1a6d85b20ef1d3c","operationId":"watchTenantChanges","method":"GET","path":"/api/v1/tenants/{tenantId}/watch","title":"Wait for changes within one tenant","description":"Returns a durable resource checkpoint scoped to the tenant. With no\n`resourceVersion`, the endpoint returns the current checkpoint immediately.\nWith a checkpoint, it returns immediately when that checkpoint is stale or\nwaits up to `timeoutSeconds` for a newer tenant, vault, or secret mutation.\nA true `changed` result is only a signal to relist the collections the\ncaller is authorized to manage; this endpoint does not expose payloads,\nordering, or tombstones. The checkpoint survives tenant deletion as a\ntombstone, so a watcher that already knows the tenant can observe its final\nmutation. A tenant that has never existed returns 404.\n","href":"documents/public/?selected=detail-sha256-d5f084f7ae74cba60ab11854d194aad1e6471dcb7c864754d1a6d85b20ef1d3c#detail-sha256-d5f084f7ae74cba60ab11854d194aad1e6471dcb7c864754d1a6d85b20ef1d3c","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Service"],"facets":[]},{"detailId":"detail-sha256-1d63622407b1c2319f15602cf01429f85c822c683c6fb7a0103251fd09885639","operationId":"watchChanges","method":"GET","path":"/api/v1/watch","title":"Wait for persisted resource changes","description":"Returns a durable, process-wide resource version. With no\n`resourceVersion`, the endpoint returns the current checkpoint immediately.\nWith a checkpoint, it returns immediately when the checkpoint is stale or\nwaits up to `timeoutSeconds` for a newer revision. A true `changed` result\nis a signal to resync the tenant, vault, and secret collections; this\nendpoint does not expose payloads, ordering, or tombstones. The checkpoint\nis process-wide, so this operation requires an explicit cluster-wide watch\npermission (`domain: \"*\"`); a tenant-scoped policy cannot authorize it.\nDeployments that need least privilege can use\n`GET /api/v1/tenants/{tenantId}/watch`, whose checkpoint is scoped to one\ntenant and accepts a literal tenant-domain policy.\n","href":"documents/public/?selected=detail-sha256-1d63622407b1c2319f15602cf01429f85c822c683c6fb7a0103251fd09885639#detail-sha256-1d63622407b1c2319f15602cf01429f85c822c683c6fb7a0103251fd09885639","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","deprecated":false,"tags":["Service"],"facets":[]}],"schemas":[{"detailId":"detail-sha256-3d4e25c3c0092c1323a8724923e5761e467c15c0abc6dcf40e675c6cc668ae58","name":"labels","description":"Client-defined metadata used for organization and ownership hints.","href":"documents/public/?selected=detail-sha256-3d4e25c3c0092c1323a8724923e5761e467c15c0abc6dcf40e675c6cc668ae58#detail-sha256-3d4e25c3c0092c1323a8724923e5761e467c15c0abc6dcf40e675c6cc668ae58","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"a74f53c89cd66731be5c4ec9c8b50deeb54079a419bf45e65237db85cc0f6f6b","projectionSHA256":"9f2853e987ad2b1f063c1302dfa12563ee284640946ecb642a565f618b25689e"},{"detailId":"detail-sha256-b7cc9a3f77f54b8d3d9205545a11b4fe80ac1c05239f5a334c71eb6181787b34","name":"page-info","description":"Cursor state for one collection snapshot. Items are returned in ascending\nimmutable insertion-sequence order. If `hasMore` is true, `nextCursor` is\nnon-null and must be used to continue the same snapshot; if `hasMore` is\nfalse, `nextCursor` is null.\n","href":"documents/public/?selected=detail-sha256-b7cc9a3f77f54b8d3d9205545a11b4fe80ac1c05239f5a334c71eb6181787b34#detail-sha256-b7cc9a3f77f54b8d3d9205545a11b4fe80ac1c05239f5a334c71eb6181787b34","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"327461aacb7a77753679bd3c86669dd8e3dbdd01f142a829f80ea3cdaf2cbc49","projectionSHA256":"40d65d90c004c1e6931943c810e3556a51a2a1adfdeb75036beb422f438d4368"},{"detailId":"detail-sha256-ce8f02dc5820a1a0dd3ea256e206c6b74781439d69f636cdc37c871756c144b7","name":"problem","description":"Problem Details response compatible with RFC 9457.","href":"documents/public/?selected=detail-sha256-ce8f02dc5820a1a0dd3ea256e206c6b74781439d69f636cdc37c871756c144b7#detail-sha256-ce8f02dc5820a1a0dd3ea256e206c6b74781439d69f636cdc37c871756c144b7","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"493b3a767d41e892ba1b859b1b5556502593eb5de66d4a170561a0246ffeb204","projectionSHA256":"607c36c5d0ea5bf9b34ff74a4965436ad5dfcd8ac4bd43f5472115f8f5f3ad27"},{"detailId":"detail-sha256-8b50d6cf9d4890ddde6d3fb867bb67e891b308fb84aef7ad54cde67cd61927fe","name":"problem-error","description":"Field-specific validation failure safe to expose to clients.","href":"documents/public/?selected=detail-sha256-8b50d6cf9d4890ddde6d3fb867bb67e891b308fb84aef7ad54cde67cd61927fe#detail-sha256-8b50d6cf9d4890ddde6d3fb867bb67e891b308fb84aef7ad54cde67cd61927fe","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"2c480456a51780e46f9b799a861f7e1e9a0d86f8a27d2c042547e98059c4d197","projectionSHA256":"ad21bfff93537b1d1f9deb7bb953db3c452da7d27ec3bb9f3e15c03841987e2a"},{"detailId":"detail-sha256-d203726d083579b1c433f89ccb4e23324348df4859a9e2732ab9afaee943e88e","name":"secret","description":"Secret metadata and value. Consumers must never log this object.","href":"documents/public/?selected=detail-sha256-d203726d083579b1c433f89ccb4e23324348df4859a9e2732ab9afaee943e88e#detail-sha256-d203726d083579b1c433f89ccb4e23324348df4859a9e2732ab9afaee943e88e","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"7747c6649f732f201d3c1ff0b5e5886fef0448faf28fd7acd1427a7acf708ad3","projectionSHA256":"bbdad589c1be309e683afb3a55a95875a5ca11340769e41bc4de307861075444"},{"detailId":"detail-sha256-29a85dbf6e9df4d1d2f5d7fae04680a8ff73e2078970a970ed5494ff3bfe2b98","name":"secret-list","description":"One page of secret metadata ordered by immutable insertion sequence; values are omitted.","href":"documents/public/?selected=detail-sha256-29a85dbf6e9df4d1d2f5d7fae04680a8ff73e2078970a970ed5494ff3bfe2b98#detail-sha256-29a85dbf6e9df4d1d2f5d7fae04680a8ff73e2078970a970ed5494ff3bfe2b98","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"da4d30f4af797ebea14f28ced847cb4fa6f640c9b21658151297d57034ecd3d6","projectionSHA256":"2757be692c60646794dbf68ba0fc2854d090910231ede68ab1a4b8a3140574fa"},{"detailId":"detail-sha256-558db2a00cf042d1ed243e077bfffbd856a48e0ec8c49710aaefe2c9866c5aaf","name":"secret-metadata","description":"Secret identity and lifecycle metadata without its value.","href":"documents/public/?selected=detail-sha256-558db2a00cf042d1ed243e077bfffbd856a48e0ec8c49710aaefe2c9866c5aaf#detail-sha256-558db2a00cf042d1ed243e077bfffbd856a48e0ec8c49710aaefe2c9866c5aaf","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"077bc05d34185591a4b6a523bc402f82d0e3d6b64389e8ac965e197e6c9dd91d","projectionSHA256":"1ff032106604bf5cd1bedb77398d0566060a50e600af4f23bd677c91cf90d79c"},{"detailId":"detail-sha256-ebdf93cda142aba3bfef911c1373b23512bc7293d61bb38f83b05aa56750630b","name":"secret-write","description":"Secret value and media type accepted for storage.","href":"documents/public/?selected=detail-sha256-ebdf93cda142aba3bfef911c1373b23512bc7293d61bb38f83b05aa56750630b#detail-sha256-ebdf93cda142aba3bfef911c1373b23512bc7293d61bb38f83b05aa56750630b","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"d64dc03f5ebede1a2ec5d63fbb14fbf8fe0c3f57068dc2179c7e98acb4f082dc","projectionSHA256":"fa44fea84a196c5868811704653ae89157e6bcaabad38476c43a9800c84b7cf3"},{"detailId":"detail-sha256-54577d35e07b4484f910f59328e45f8721317cb93e4295d6cac2549918728a9e","name":"service-info","description":"Server identity and compatibility information.","href":"documents/public/?selected=detail-sha256-54577d35e07b4484f910f59328e45f8721317cb93e4295d6cac2549918728a9e#detail-sha256-54577d35e07b4484f910f59328e45f8721317cb93e4295d6cac2549918728a9e","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"6a3249d27ba3c91788ef90ea9b5acd83488724a110a5a4da988798d2132f7782","projectionSHA256":"e3fc5b90d701878bd43a66178f0a3680ee6d051a4dc49ebac5a8eaa898dd508d"},{"detailId":"detail-sha256-e46a0bf5993bf3f922604302de3396519f449acd6bd34ab4a64cdd485a3f25cd","name":"tenant","description":"Tenant identity, automation metadata, and lifecycle state.","href":"documents/public/?selected=detail-sha256-e46a0bf5993bf3f922604302de3396519f449acd6bd34ab4a64cdd485a3f25cd#detail-sha256-e46a0bf5993bf3f922604302de3396519f449acd6bd34ab4a64cdd485a3f25cd","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"7b4f81074c5b6cbde1eb32160095e287de38aaf3e34365bdfcd49b2db0c0b7ae","projectionSHA256":"0eeaab918ddf7fb380954dfc2352554ee52b24fa9cc6c4969041a3ae5316752e"},{"detailId":"detail-sha256-37ab3b05a7928ccddef368c9e5d2131bade4c0b57b8b034ec8c41201969630b6","name":"tenant-create","description":"Fields accepted when creating a tenant.","href":"documents/public/?selected=detail-sha256-37ab3b05a7928ccddef368c9e5d2131bade4c0b57b8b034ec8c41201969630b6#detail-sha256-37ab3b05a7928ccddef368c9e5d2131bade4c0b57b8b034ec8c41201969630b6","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"1f4e438b6ad6025b745cbdf3806869d959c3a23a9f031471d3dac98763766242","projectionSHA256":"372be2453e49fda0d9a3d6f487406fc5017256193e3d3ffd85e49de47e3101a0"},{"detailId":"detail-sha256-c4b9a104a3935b3ddbb17934907520feed2b165c204235cef6c3d9cca66058fc","name":"tenant-list","description":"One page from a stable tenant snapshot.","href":"documents/public/?selected=detail-sha256-c4b9a104a3935b3ddbb17934907520feed2b165c204235cef6c3d9cca66058fc#detail-sha256-c4b9a104a3935b3ddbb17934907520feed2b165c204235cef6c3d9cca66058fc","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"ad7eac9a84c86705a21129827a58cdde0360bfe30196f10150c24a597e050d9f","projectionSHA256":"e405d836dde55d15bc3766d62406a1ec86d6cba53376b9a7b132568b2851f720"},{"detailId":"detail-sha256-7c012f817dd16dec966c07705d2ad80224065134aeb8a03cf89bd11f3f29c6dd","name":"tenant-resource-version","description":"Opaque durable resource checkpoint scoped to one tenant.","href":"documents/public/?selected=detail-sha256-7c012f817dd16dec966c07705d2ad80224065134aeb8a03cf89bd11f3f29c6dd#detail-sha256-7c012f817dd16dec966c07705d2ad80224065134aeb8a03cf89bd11f3f29c6dd","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"1079638f47e26e44519c67db049e5d07fd155b1e1117a714e9811b73ea5a7ab6","projectionSHA256":"b1974b18c902a28e5c525556dbb149638be19527448d50f2693ab89b4a8d81d0"},{"detailId":"detail-sha256-7803f8352d39082ac4a8903dffab86eb9385826a1185f803b6b1642538be54c2","name":"tenant-update","description":"Complete mutable tenant state used for replacement updates.","href":"documents/public/?selected=detail-sha256-7803f8352d39082ac4a8903dffab86eb9385826a1185f803b6b1642538be54c2#detail-sha256-7803f8352d39082ac4a8903dffab86eb9385826a1185f803b6b1642538be54c2","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"7134a804fcbe117dab17a9de688036731384869bae11327aea8dca943df3066c","projectionSHA256":"beed261dd7c1f8ff7faeef4960d66e40f83e1d26d0041dcf15530c2a4efdd815"},{"detailId":"detail-sha256-6b9253479fe64fc1d299fd91e9e5db0501ec1a26901ec61ae53367157ac3d311","name":"tenant-watch-result","description":"Durable tenant-scoped resource-version checkpoint returned by a watch poll.","href":"documents/public/?selected=detail-sha256-6b9253479fe64fc1d299fd91e9e5db0501ec1a26901ec61ae53367157ac3d311#detail-sha256-6b9253479fe64fc1d299fd91e9e5db0501ec1a26901ec61ae53367157ac3d311","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"f7ae6c51d4c5c23be998c4b005f4aa57111be904ef37cdaf98c06d5f860d662c","projectionSHA256":"2a9f6aa7f586126398a8406c8df9481c6344b81b46ee55801a385b434b02f81e"},{"detailId":"detail-sha256-062e3f8935692180e9631b5db761b226fece99ffb80b8a491ce9347fa8c2191f","name":"vault","description":"Tenant-scoped vault identity, automation metadata, and lifecycle state.","href":"documents/public/?selected=detail-sha256-062e3f8935692180e9631b5db761b226fece99ffb80b8a491ce9347fa8c2191f#detail-sha256-062e3f8935692180e9631b5db761b226fece99ffb80b8a491ce9347fa8c2191f","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"0809748382cce2c7f2c336240062c60687fbff1d7413c3bdbd82cc78d9ca1ff5","projectionSHA256":"930e52b081bed3d229ae0da3fb6185c5e444c46fd8064acf4bcfd891458917e9"},{"detailId":"detail-sha256-5fc387a94d1a5c300c5d555efb5ab74a303979888febe168e392c6c5f18f5c49","name":"vault-create","description":"Fields accepted when creating a vault.","href":"documents/public/?selected=detail-sha256-5fc387a94d1a5c300c5d555efb5ab74a303979888febe168e392c6c5f18f5c49#detail-sha256-5fc387a94d1a5c300c5d555efb5ab74a303979888febe168e392c6c5f18f5c49","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"c5c30ea809b0a89f630ffee9e6294daf0c304ffb0a6d49700eb71897200526db","projectionSHA256":"4a33072381348a5b7bf9268d4de4f0ef6f62fa057a6377036ce6a1ac532b18ef"},{"detailId":"detail-sha256-28c35ba84ffe9006506fb4a965e701839b3915f4a3d853455d9eb11bf4b40799","name":"vault-list","description":"One page from a stable vault snapshot.","href":"documents/public/?selected=detail-sha256-28c35ba84ffe9006506fb4a965e701839b3915f4a3d853455d9eb11bf4b40799#detail-sha256-28c35ba84ffe9006506fb4a965e701839b3915f4a3d853455d9eb11bf4b40799","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"8b7dd92083589d21678e1bc3974e9e3eaa9a7ebf16daa28d0a826295a92faae7","projectionSHA256":"2af506815f6f81b630bad9ef53b21fc38d2dcf03727c92b0c37656e560fff0b6"},{"detailId":"detail-sha256-7e3f7ec68e9e5d83243d3dedec67e1636e0b2b6899d2def45f47b4d50e444d9b","name":"vault-update","description":"Complete mutable vault state used for replacement updates.","href":"documents/public/?selected=detail-sha256-7e3f7ec68e9e5d83243d3dedec67e1636e0b2b6899d2def45f47b4d50e444d9b#detail-sha256-7e3f7ec68e9e5d83243d3dedec67e1636e0b2b6899d2def45f47b4d50e444d9b","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"c992551997b653ac7fcabe77951b586dda9a38551f7f365c8d551c63a47f53d6","projectionSHA256":"9442ab9485486e0f72cacd2b3616c41b0e99d5c36ea7a501787528036928071b"},{"detailId":"detail-sha256-0149a95d32909f80d5f98337de278b2cc07cb655b0fa71f21b82bb3b77786474","name":"watch-result","description":"Durable resource-version checkpoint returned by a watch poll.","href":"documents/public/?selected=detail-sha256-0149a95d32909f80d5f98337de278b2cc07cb655b0fa71f21b82bb3b77786474#detail-sha256-0149a95d32909f80d5f98337de278b2cc07cb655b0fa71f21b82bb3b77786474","detailChild":"details/public/385c215b89594442617d17435edf3110161e0f76064ff49f23a29e1a7c6b5540.json","canonicalSHA256":"cb5b3145055b34158899bf5c728b988e1e18cfe029e64a44c892ec1571336a0e","projectionSHA256":"14ed744ae2c7b6f20bdebf48976582c993e456fae9754bfa0a2cee0e5b8d4e06"}],"securitySchemes":[{"name":"bearerAuth","anchor":"security-scheme-c41694373770a9cd","type":"http","description":"Deployment-issued bearer credential sent in the Authorization header.\nTokens may be opaque; clients must not assume JWT structure.\n","scheme":"bearer"}]}]}