{ "openapi": "3.1.0", "info": { "title": "Log Salad private evaluation console", "version": "console-v1", "description": "Curated public projection of implemented console-v1 routes. Not a general-availability or deployment qualification claim. Response objects are extensible partial shapes, not full provider/OCSF schemas. Error statuses describe the common envelope, not a guarantee that every route emits every status." }, "servers": [ { "url": "/", "description": "Your separately deployed private console origin, NOT this static documentation server" } ], "x-source-revision": "23fdccfaa88f69e858769f1dad70f82739e2740f", "x-source-contract": "console-v1", "paths": { "/health": { "get": { "operationId": "get_health", "summary": "Health", "description": "Public state-database reachability; not end-to-end pipeline qualification.", "security": [], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Health" } } } }, "503": { "description": "State database unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Health" } } } } }, "x-authority": "public" } }, "/api/v1/session": { "post": { "operationId": "post_api_v1_session", "summary": "Sign in", "description": "Create an eight-hour opaque cookie session. Origin, CSRF and JSON required even before login.", "security": [], "parameters": [ { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Session" } } }, "headers": { "Set-Cookie": { "description": "salad_session opaque cookie; HttpOnly; SameSite=Strict; Path=/; Max-Age=28800; Secure when configured", "schema": { "type": "string" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "public", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Login" } } } } }, "get": { "operationId": "get_api_v1_session", "summary": "Current session", "description": "Resolve the server-assigned workspace and role.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CurrentSession" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" }, "delete": { "operationId": "delete_api_v1_session", "summary": "Sign out", "description": "Revoke this individual session; Origin and CSRF required.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Status" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" } }, "/api/v1/session/options": { "get": { "operationId": "get_api_v1_session_options", "summary": "Evaluation registration options", "description": "Public configuration flag, not database health or production SaaS availability.", "security": [], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SessionOptions" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "public" } }, "/api/v1/session/signup": { "post": { "operationId": "post_api_v1_session_signup", "summary": "Create isolated evaluation workspace", "description": "Disabled by default; 32-workspace cap. No caller-selected tenant/role. Generic workspace_creation_unavailable on duplicate username or cap.", "security": [], "parameters": [ { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Session" } } }, "headers": { "Set-Cookie": { "description": "salad_session opaque cookie; HttpOnly; SameSite=Strict; Path=/; Max-Age=28800; Secure when configured", "schema": { "type": "string" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "public", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Signup" } } } } } }, "/api/v1/overview": { "get": { "operationId": "get_api_v1_overview", "summary": "Workspace overview", "description": "Tenant-scoped counts and observed pipeline state. Inference is disabled.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Overview" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" } }, "/api/v1/costs": { "get": { "operationId": "get_api_v1_costs", "summary": "Read cost snapshot", "description": "Operator only. Fixed configured snapshot, maximum 1 MiB. No provider/billing API calls; unavailable is not zero.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Costs" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "operator" } }, "/api/v1/sources": { "get": { "operationId": "get_api_v1_sources", "summary": "List sources", "description": "Saved or receiving is not provider credential verification.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SourceList" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" }, "post": { "operationId": "post_api_v1_sources", "summary": "Create scoped source", "description": "Persist configuration, not a connected-provider claim.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Source" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateSource" } } } } } }, "/api/v1/sources/{id}/preflight": { "post": { "operationId": "post_api_v1_sources_id_preflight", "summary": "Inspect source readiness", "description": "Schema and canary checks. Provider transports report external_worker_required and provider_verified:false.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Preflight" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "description": "Send {} with application/json. The handler uses no body fields; the session guard still requires JSON Content-Type even when no bytes are sent. This documented client form uses an empty object rather than an ignored OpenAPI Content-Type header parameter.", "content": { "application/json": { "schema": { "type": "object", "properties": {}, "additionalProperties": false }, "example": {} } } } } }, "/api/v1/sources/{id}/token": { "post": { "operationId": "post_api_v1_sources_id_token", "summary": "Rotate source token", "description": "Operator only. Returned once; previous token revoked. This response is a secret and must not be logged.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SourceToken" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "operator", "requestBody": { "required": true, "description": "Send {} with application/json. The handler uses no body fields; the session guard still requires JSON Content-Type even when no bytes are sent. This documented client form uses an empty object rather than an ignored OpenAPI Content-Type header parameter.", "content": { "application/json": { "schema": { "type": "object", "properties": {}, "additionalProperties": false }, "example": {} } } } } }, "/api/v1/sources/{id}/ingest": { "post": { "operationId": "post_api_v1_sources_id_ingest", "summary": "Accept native records", "description": "Maximum 1000 records and 8 MiB request. HTTP 202 is durable inbox acceptance, not external sink completion. Poll operation status before acknowledging the source. CloudTrail Records wrapper is also accepted.", "security": [ { "sessionCookie": [] }, { "sourceToken": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "Origin", "in": "header", "required": false, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": false, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "202": { "description": "Durable inbox accepted; poll operation before source acknowledgement.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IngestReceipt" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "source", "requestBody": { "required": true, "content": { "application/json": { "schema": { "anyOf": [ { "$ref": "#/components/schemas/Ingest" }, { "type": "object", "properties": { "Records": { "type": "array", "items": { "type": "object" }, "minItems": 1, "maxItems": 1000 } }, "additionalProperties": true, "required": [ "Records" ] } ] } } } } } }, "/api/v1/operations/{id}": { "get": { "operationId": "get_api_v1_operations_id", "summary": "Reconcile ingestion status", "description": "Source token is limited to operations belonging to its source and tenant. Acknowledge only committed, after inspecting lane receipts.", "security": [ { "sessionCookie": [] }, { "sourceToken": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Operation" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "source" } }, "/api/v1/events/query": { "post": { "operationId": "post_api_v1_events_query", "summary": "Query hot events", "description": "Typed parameterized tenant-filtered ClickHouse; 500 rows, 31 days, five-second engine limit; no raw SQL.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HotQueryResult" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HotQuery" } } } } } }, "/api/v1/history/query": { "post": { "operationId": "post_api_v1_history_query", "summary": "Query historical events", "description": "Authorized PyIceberg path. Only time/source/limit filters. Dependency failure is explicit, never silently served from hot data.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HistoryQueryResult" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HistoryQuery" } } } } } }, "/api/v1/events/{id}": { "get": { "operationId": "get_api_v1_events_id", "summary": "Read retained evidence", "description": "Tenant-authorized OCSF and raw request bytes/provenance. Raw batch bytes can contain multiple records.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Evidence" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" } }, "/api/v1/rules": { "get": { "operationId": "get_api_v1_rules", "summary": "List and reconcile rules", "description": "May reconcile observed Arroyo job state. Running is required for enabled; saved is not running.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleList" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" }, "post": { "operationId": "post_api_v1_rules", "summary": "Create versioned rule", "description": "Persist validated rule; enabled:true additionally requests actual deployment.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rule" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleInput" } } } } } }, "/api/v1/rules/validate": { "post": { "operationId": "post_api_v1_rules_validate", "summary": "Validate strict rule subset", "description": "Unsupported rule syntax returns valid:false; validation does not deploy.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleValidation" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RuleInput" } } } } } }, "/api/v1/rules/{id}/enable": { "post": { "operationId": "post_api_v1_rules_id_enable", "summary": "Enable rule pipeline", "description": "Durable intent and ambiguous-create reconciliation. Inspect status; do not blindly repeat an unknown create.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rule" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "description": "Send {} with application/json. The handler uses no body fields; the session guard still requires JSON Content-Type even when no bytes are sent. This documented client form uses an empty object rather than an ignored OpenAPI Content-Type header parameter.", "content": { "application/json": { "schema": { "type": "object", "properties": {}, "additionalProperties": false }, "example": {} } } } } }, "/api/v1/rules/{id}/disable": { "post": { "operationId": "post_api_v1_rules_id_disable", "summary": "Checkpoint-stop rule", "description": "Pending/unknown until observed terminal job state.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Rule" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "description": "Send {} with application/json. The handler uses no body fields; the session guard still requires JSON Content-Type even when no bytes are sent. This documented client form uses an empty object rather than an ignored OpenAPI Content-Type header parameter.", "content": { "application/json": { "schema": { "type": "object", "properties": {}, "additionalProperties": false }, "example": {} } } } } }, "/api/v1/alerts": { "get": { "operationId": "get_api_v1_alerts", "summary": "List alerts", "description": "Durable rule matches, not proof of malicious activity.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AlertList" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" } }, "/api/v1/alerts/{id}": { "get": { "operationId": "get_api_v1_alerts_id", "summary": "Alert narrative and evidence", "description": "Deterministic facts, citations, uncertainty and review guidance; inference disabled.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alert" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" } }, "/api/v1/alerts/{id}/triage": { "post": { "operationId": "post_api_v1_alerts_id_triage", "summary": "Record human triage", "description": "Attribute disposition and note with audit.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Alert" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Triage" } } } } } }, "/api/v1/cases": { "get": { "operationId": "get_api_v1_cases", "summary": "List cases", "description": "Tenant-scoped local case state.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CaseList" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" } }, "/api/v1/cases/{id}": { "get": { "operationId": "get_api_v1_cases_id", "summary": "Read case revision", "description": "Read current version before editing or approving a plan.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Case" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" }, "patch": { "operationId": "patch_api_v1_cases_id", "summary": "Update case", "description": "Missing/stale expected_version returns 409. open↔investigating; open/investigating→closed; closed→open.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Case" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CasePatch" } } } } } }, "/api/v1/attack": { "get": { "operationId": "get_api_v1_attack", "summary": "Declared ATT&CK metadata", "description": "Candidate rule/alert metadata, not confirmed technique detection or full coverage.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Attack" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" } }, "/api/v1/audit": { "get": { "operationId": "get_api_v1_audit", "summary": "Read application audit", "description": "Append-only application behavior; production tamper resistance needs separate qualification.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuditList" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" } }, "/api/v1/workflows": { "get": { "operationId": "get_api_v1_workflows", "summary": "List case workflows", "description": "Local case-management workflows only.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowList" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" }, "post": { "operationId": "post_api_v1_workflows", "summary": "Create typed workflow", "description": "One to twenty steps; only assignment, priority and note. No scripts, network URLs or cloud containment.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Workflow" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkflowInput" } } } } } }, "/api/v1/workflows/{id}/preview": { "post": { "operationId": "post_api_v1_workflows_id_preview", "summary": "Preview exact case plan", "description": "No case effects. Plan expires in ten minutes and binds case/workflow/policy versions and digest.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Action" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Preview" } } } } } }, "/api/v1/actions": { "get": { "operationId": "get_api_v1_actions", "summary": "Reconcile action plans", "description": "Inspect persisted plan and receipt after ambiguity; there is no GET /actions/{id} endpoint.", "security": [ { "sessionCookie": [] } ], "parameters": [], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionList" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "session" } }, "/api/v1/actions/{id}/approve": { "post": { "operationId": "post_api_v1_actions_id_approve", "summary": "Approve exact plan", "description": "Authenticated human operator. Exact digest and case version required. Repeated identical approval does not execute twice.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Action" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "operator", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Approve" } } } } } }, "/api/v1/actions/{id}/reject": { "post": { "operationId": "post_api_v1_actions_id_reject", "summary": "Reject exact plan", "description": "Operator role required; exact digest; opposite decisions conflict.", "security": [ { "sessionCookie": [] } ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "Origin", "in": "header", "required": true, "schema": { "type": "string", "description": "Must exactly equal configured console origin, without trailing slash." }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." }, { "name": "X-Console-CSRF", "in": "header", "required": true, "schema": { "const": "1" }, "description": "Required for cookie/public session protocol; not required for source bearer ingestion." } ], "responses": { "200": { "description": "Operation result; inspect entity status before claiming completion.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Action" } } } }, "400": { "description": "Invalid input or unsupported bounds/semantics", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Authentication missing, invalid or expired", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "403": { "description": "Origin/CSRF, role or source scope denied", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Entity or route not found in authorized scope", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "409": { "description": "Stale version, digest or decision conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "413": { "description": "Request exceeds 8 MiB", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Shared authentication or query concurrency limit", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "500": { "description": "Internal/dependency failure; reconcile outcome before retry", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "State/dependency unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } }, "x-authority": "operator", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Reject" } } } } } } }, "components": { "securitySchemes": { "sessionCookie": { "type": "apiKey", "in": "cookie", "name": "salad_session", "description": "Eight-hour opaque session. Same-origin mutations require Origin, X-Console-CSRF:1 and application/json. Never give an agent a human approval session." }, "sourceToken": { "type": "http", "scheme": "bearer", "description": "Rotated by a session operator. Only own-source ingestion and own-source operation status; not session/query/action authority." } }, "schemas": { "Error": { "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" } }, "additionalProperties": true, "required": [ "error", "message" ] }, "User": { "type": "object", "properties": { "name": { "type": "string" }, "role": { "type": "string" }, "tenant_id": { "type": "string" }, "workspace_name": { "type": "string" } }, "additionalProperties": true, "required": [ "name", "role", "tenant_id", "workspace_name" ] }, "Login": { "type": "object", "properties": { "username": { "type": "string" }, "password": { "type": "string", "writeOnly": true } }, "additionalProperties": true, "required": [ "username", "password" ] }, "Signup": { "type": "object", "properties": { "workspace_name": { "type": "string", "minLength": 1, "description": "Nonblank; no control characters; maximum 128 UTF-8 bytes. Names need not be unique." }, "username": { "type": "string", "pattern": "^[A-Za-z0-9_.@+\\-]{3,64}$", "description": "ASCII, globally unique, normalized to lowercase; no email verification." }, "password": { "type": "string", "writeOnly": true, "description": "12–128 UTF-8 bytes (not characters)." }, "password_confirmation": { "type": "string", "writeOnly": true } }, "additionalProperties": false, "required": [ "workspace_name", "username", "password" ] }, "Session": { "type": "object", "properties": { "user": { "$ref": "#/components/schemas/User" }, "expires_at": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" } }, "additionalProperties": true, "required": [ "user", "expires_at" ] }, "CurrentSession": { "type": "object", "properties": { "user": { "$ref": "#/components/schemas/User" } }, "additionalProperties": true, "required": [ "user" ] }, "SessionOptions": { "type": "object", "properties": { "signup_enabled": { "type": "boolean" }, "mode": { "enum": [ "evaluation_workspace", "disabled" ] } }, "additionalProperties": true, "required": [ "signup_enabled", "mode" ] }, "Status": { "type": "object", "properties": { "status": { "type": "string" } }, "additionalProperties": true, "required": [ "status" ] }, "Health": { "type": "object", "properties": { "status": { "enum": [ "ok", "state_unavailable" ] }, "inference": { "const": "disabled" } }, "additionalProperties": true, "required": [ "status" ] }, "SourceConfig": { "type": "object", "properties": { "transport": { "enum": [ "manual", "aws_cloudwatch", "aws_sqs_cloudtrail", "google_workspace" ] }, "log_groups": { "type": "array", "items": { "type": "string", "minLength": 1, "description": "Maximum 512 UTF-8 bytes" }, "minItems": 1, "maxItems": 10 }, "queue_url": { "type": "string" }, "application": { "enum": [ "login", "drive", "admin" ] }, "credential_reference": { "type": "string" } }, "additionalProperties": false, "description": "Transport must match source kind. CloudWatch requires log_groups even for manual import. Credential references are non-secret; do not submit credentials. Admin application selection does not imply admin event mapping coverage." }, "CreateSource": { "type": "object", "properties": { "name": { "type": "string", "description": "Nonempty; maximum 128 UTF-8 bytes" }, "kind": { "enum": [ "aws_cloudtrail", "google_workspace", "cloudwatch_sample_service" ] }, "account_id": { "type": "string", "description": "Source identity scope; maximum 256 UTF-8 bytes" }, "region": { "type": "string", "description": "Source scope; maximum 128 UTF-8 bytes" }, "config": { "$ref": "#/components/schemas/SourceConfig" } }, "additionalProperties": true, "required": [ "name", "kind", "account_id", "region" ] }, "SourceToken": { "type": "object", "properties": { "source_id": { "type": "string", "format": "uuid" }, "ingestion_token": { "type": "string", "writeOnly": false }, "scope": { "const": "source_ingest_and_operation_status" }, "shown_once": { "const": true } }, "additionalProperties": true, "required": [ "source_id", "ingestion_token", "scope", "shown_once" ] }, "Preflight": { "type": "object", "properties": { "status": { "type": "string" }, "checks": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "status": { "type": "string" }, "message": { "type": "string" } }, "additionalProperties": true, "required": [ "name", "status", "message" ] } }, "provider_verified": { "const": false }, "mapping_scope": { "type": "string" }, "transport": { "type": "string" } }, "additionalProperties": true, "required": [ "status", "checks", "provider_verified" ] }, "Ingest": { "type": "object", "properties": { "records": { "type": "array", "items": { "type": "object", "additionalProperties": true }, "minItems": 1, "maxItems": 1000 } }, "additionalProperties": true, "required": [ "records" ] }, "IngestReceipt": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "operation_id": { "type": "string", "format": "uuid" }, "source_id": { "type": "string", "format": "uuid" }, "batch_id": { "type": "string", "format": "uuid" }, "accepted": { "type": "integer", "minimum": 0 }, "replayed": { "type": "integer", "minimum": 0 }, "quarantined": { "type": "integer", "minimum": 0 }, "status": { "const": "accepted" }, "disposition": { "const": "durable_inbox" }, "created_at": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" } }, "additionalProperties": true, "required": [ "operation_id", "accepted", "replayed", "quarantined", "status" ] }, "Operation": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "operation_id": { "type": "string", "format": "uuid" }, "source_id": { "type": "string", "format": "uuid" }, "batch_id": { "type": "string", "format": "uuid" }, "accepted": { "type": "integer", "minimum": 0 }, "replayed": { "type": "integer", "minimum": 0 }, "quarantined": { "type": "integer", "minimum": 0 }, "status": { "enum": [ "pending", "committed" ] }, "lanes": { "type": "array", "items": { "type": "object", "properties": { "event_id": { "type": "string", "format": "uuid" }, "lane": { "type": "string" }, "status": { "type": "string" }, "attempts": { "type": "integer", "minimum": 0 }, "last_error": { "type": [ "string", "null" ] }, "receipt": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." } }, "additionalProperties": true, "required": [ "event_id", "lane", "status", "attempts" ] } }, "quarantine_disposition": { "const": "durable_postgresql_raw_batch_and_quarantine" }, "created_at": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" } }, "additionalProperties": true, "required": [ "operation_id", "status", "lanes" ] }, "HotQuery": { "type": "object", "properties": { "start_time_ms": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds", "minimum": 0 }, "end_time_ms": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds", "minimum": 0 }, "source_id": { "type": "string", "format": "uuid" }, "limit": { "type": "integer", "minimum": 1, "maximum": 500, "default": 100 }, "class_uid": { "type": "integer", "format": "int32" }, "status_id": { "type": "integer", "format": "int32" }, "text": { "type": "string", "description": "Maximum 256 UTF-8 bytes; case-insensitive substring of activity_name or actor only." } }, "additionalProperties": false, "description": "31-day maximum range; default last 24 hours. Reject unknown keys including sql." }, "HistoryQuery": { "type": "object", "properties": { "start_time_ms": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds", "minimum": 0 }, "end_time_ms": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds", "minimum": 0 }, "source_id": { "type": "string", "format": "uuid" }, "limit": { "type": "integer", "minimum": 1, "maximum": 500, "default": 100 } }, "additionalProperties": false, "description": "31-day maximum range. Same bounds as hot query, but class_uid/status_id/text are rejected. No hot fallback." }, "Event": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "source_id": { "type": "string", "format": "uuid" }, "source_key": { "type": "string" }, "event_time_ms": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" }, "class_uid": { "type": "integer" }, "status_id": { "type": "integer" }, "activity_name": { "type": "string" }, "actor": { "type": "string" }, "ocsf": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." }, "raw_reference": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." } }, "additionalProperties": true, "required": [ "id", "source_id", "event_time_ms", "ocsf" ] }, "Evidence": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "ocsf": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." }, "raw_reference": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." }, "raw_base64": { "type": "string", "contentEncoding": "base64", "description": "Exact retained request batch; use record ordinal/provenance to locate the native record." }, "raw_digest": { "type": "string" }, "batch_id": { "type": "string", "format": "uuid" } }, "additionalProperties": true, "required": [ "id", "ocsf", "raw_base64", "raw_digest" ] }, "HotQueryResult": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Event" }, "maxItems": 500 }, "query": { "type": "object", "properties": { "sql": { "type": "string" }, "rows": { "type": "integer", "minimum": 0 }, "elapsed_ms": { "type": "integer", "minimum": 0 } }, "additionalProperties": true, "required": [ "sql", "rows", "elapsed_ms" ] }, "scope": { "const": "hot" } }, "additionalProperties": true, "required": [ "items", "query", "scope" ] }, "HistoryQueryResult": { "type": "object", "properties": { "items": { "type": "array", "items": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." }, "maxItems": 500 }, "scope": { "const": "historical" } }, "additionalProperties": true, "required": [ "items", "scope" ] }, "RuleInput": { "type": "object", "properties": { "yaml": { "type": "string", "description": "Maximum 64 KiB UTF-8; strict stateless subset only." }, "enabled": { "type": "boolean" } }, "additionalProperties": true, "required": [ "yaml" ] }, "RuleValidation": { "type": "object", "properties": { "valid": { "type": "boolean" }, "errors": { "type": "array", "items": { "type": "string" } }, "compiled_sql": { "type": "string" }, "supported_features": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": true, "required": [ "valid", "errors", "supported_features" ] }, "Rule": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "severity": { "type": "string" }, "enabled": { "type": "boolean" }, "version": { "type": "string" }, "attack_tags": { "type": "array", "items": { "type": "string" } }, "yaml": { "type": "string" }, "pipeline_id": { "type": [ "string", "null" ] }, "status": { "type": "string" }, "last_error": { "type": [ "string", "null" ] } }, "additionalProperties": true, "required": [ "id", "title", "enabled", "version", "status" ] }, "Narrative": { "type": "object", "properties": { "summary": { "type": "string" }, "observed_facts": { "type": "array", "items": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." } }, "citations": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "timeline": { "type": "array", "items": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." } }, "uncertainty": { "type": "string" }, "suggested_review": { "type": "string" }, "inference": { "type": "object", "properties": { "status": { "const": "disabled" }, "delivery_independent": { "const": true } }, "additionalProperties": true } }, "additionalProperties": true }, "Alert": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "severity": { "type": "string" }, "status": { "type": "string" }, "rule_id": { "type": "string", "format": "uuid" }, "rule_version": { "type": "string" }, "case_id": { "type": "string", "format": "uuid" }, "created_at": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" }, "attack_tags": { "type": "array", "items": { "type": "string" } }, "narrative": { "$ref": "#/components/schemas/Narrative" }, "triage_status": { "type": "string" }, "evidence_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "evidence": { "type": "array", "items": { "$ref": "#/components/schemas/Evidence" } } }, "additionalProperties": true, "required": [ "id", "rule_id", "rule_version", "case_id", "narrative", "evidence_ids" ] }, "Triage": { "type": "object", "properties": { "disposition": { "enum": [ "new", "investigating", "true_positive", "false_positive", "benign", "insufficient_evidence", "closed" ] }, "note": { "type": "string" } }, "additionalProperties": true, "required": [ "disposition", "note" ] }, "Case": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "status": { "enum": [ "open", "investigating", "closed" ] }, "priority": { "type": "string", "enum": [ "low", "medium", "high", "critical" ] }, "assignee": { "type": [ "string", "null" ] }, "notes": { "type": "array", "items": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." } }, "alert_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "evidence_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "version": { "type": "integer" }, "created_at": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" }, "updated_at": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" } }, "additionalProperties": true, "required": [ "id", "title", "status", "version" ] }, "CasePatch": { "type": "object", "properties": { "expected_version": { "type": "integer" }, "title": { "type": "string" }, "status": { "enum": [ "open", "investigating", "closed" ] }, "assignee": { "type": "string" }, "priority": { "type": "string", "enum": [ "low", "medium", "high", "critical" ] }, "note": { "type": "string" } }, "additionalProperties": false, "required": [ "expected_version" ] }, "Definition": { "type": "object", "properties": { "steps": { "type": "array", "items": { "oneOf": [ { "type": "object", "properties": { "action": { "const": "case.assign" }, "parameters": { "type": "object", "properties": { "assignee": { "type": "string", "minLength": 1, "description": "At most 128 UTF-8 bytes" } }, "additionalProperties": false, "required": [ "assignee" ] } }, "additionalProperties": false, "required": [ "action", "parameters" ] }, { "type": "object", "properties": { "action": { "const": "case.set_priority" }, "parameters": { "type": "object", "properties": { "priority": { "type": "string", "enum": [ "low", "medium", "high", "critical" ] } }, "additionalProperties": false, "required": [ "priority" ] } }, "additionalProperties": false, "required": [ "action", "parameters" ] }, { "type": "object", "properties": { "action": { "const": "case.add_note" }, "parameters": { "type": "object", "properties": { "note": { "type": "string", "minLength": 1, "description": "At most 4096 UTF-8 bytes" } }, "additionalProperties": false, "required": [ "note" ] } }, "additionalProperties": false, "required": [ "action", "parameters" ] } ] }, "minItems": 1, "maxItems": 20 } }, "additionalProperties": false, "required": [ "steps" ] }, "WorkflowInput": { "type": "object", "properties": { "name": { "type": "string" }, "definition": { "$ref": "#/components/schemas/Definition" } }, "additionalProperties": true, "required": [ "name", "definition" ] }, "Workflow": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "definition": { "$ref": "#/components/schemas/Definition" }, "version": { "type": "integer" }, "created_at": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" } }, "additionalProperties": true, "required": [ "id", "name", "definition", "version" ] }, "Preview": { "type": "object", "properties": { "case_id": { "type": "string", "format": "uuid" } }, "additionalProperties": true, "required": [ "case_id" ] }, "Approve": { "type": "object", "properties": { "digest": { "type": "string" }, "expected_version": { "type": "integer" } }, "additionalProperties": true, "required": [ "digest", "expected_version" ] }, "Reject": { "type": "object", "properties": { "digest": { "type": "string" } }, "additionalProperties": true, "required": [ "digest" ] }, "Action": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "plan_id": { "type": "string", "format": "uuid" }, "case_id": { "type": "string", "format": "uuid" }, "workflow_id": { "type": "string", "format": "uuid" }, "workflow_version": { "type": "integer" }, "case_version": { "type": "integer" }, "policy_version": { "const": "case-actions-v1" }, "digest": { "type": "string" }, "steps": { "type": "array", "items": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." } }, "expires_at": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" }, "status": { "enum": [ "awaiting_approval", "verified", "rejected" ] }, "receipt": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." }, "requested_by": { "type": "string" }, "decided_by": { "type": "string" } }, "additionalProperties": true, "required": [ "id", "digest", "case_version", "expires_at", "status" ] }, "Audit": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "actor": { "type": "string" }, "operation": { "type": "string" }, "entity_type": { "type": "string" }, "entity_id": { "type": "string", "format": "uuid" }, "before": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." }, "after": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." }, "created_at": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" } }, "additionalProperties": true, "required": [ "id", "actor", "operation", "created_at" ] }, "Attack": { "type": "object", "properties": { "items": { "type": "array", "items": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." } }, "scope": { "const": "declared_rule_metadata_not_full_attack_coverage" } }, "additionalProperties": true, "required": [ "items", "scope" ] }, "Overview": { "type": "object", "properties": { "events": { "type": "integer", "minimum": 0 }, "alerts": { "type": "integer", "minimum": 0 }, "open_cases": { "type": "integer", "minimum": 0 }, "sources": { "type": "integer", "minimum": 0 }, "quarantine": { "type": "integer", "minimum": 0 }, "pipeline": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." }, "detection_delivery": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." }, "inference": { "type": "object", "properties": { "status": { "const": "disabled" }, "delivery_independent": { "const": true } }, "additionalProperties": true }, "version": { "type": "string" }, "profile": { "const": "bounded_private_evaluation" } }, "additionalProperties": true, "required": [ "events", "alerts", "open_cases", "sources", "quarantine", "inference" ] }, "Costs": { "type": "object", "properties": { "schema_version": { "const": "log-salad-cost-inventory-v1" }, "as_of": { "type": [ "string", "integer", "null" ] }, "clusters": { "type": "array", "items": { "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema." } }, "summary": { "type": "object", "properties": { "status": { "type": "string" } }, "additionalProperties": true }, "limitations": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": true, "required": [ "schema_version", "clusters", "summary" ] }, "Source": { "type": "object", "properties": { "name": { "type": "string", "description": "Nonempty; maximum 128 UTF-8 bytes" }, "kind": { "enum": [ "aws_cloudtrail", "google_workspace", "cloudwatch_sample_service" ] }, "account_id": { "type": "string", "description": "Source identity scope; maximum 256 UTF-8 bytes" }, "region": { "type": "string", "description": "Source scope; maximum 128 UTF-8 bytes" }, "config": { "$ref": "#/components/schemas/SourceConfig" }, "id": { "type": "string", "format": "uuid" }, "status": { "type": "string" }, "last_event_at": { "type": [ "integer", "null" ] }, "event_count": { "type": "integer", "minimum": 0 }, "last_error": { "type": [ "string", "null" ] }, "created_at": { "type": "integer", "format": "int64", "description": "Unix epoch milliseconds" } }, "additionalProperties": true, "required": [ "id", "name", "kind", "status" ] }, "SourceList": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Source" } } }, "additionalProperties": true, "required": [ "items" ] }, "RuleList": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Rule" } } }, "additionalProperties": true, "required": [ "items" ] }, "AlertList": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Alert" } } }, "additionalProperties": true, "required": [ "items" ] }, "CaseList": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Case" } } }, "additionalProperties": true, "required": [ "items" ] }, "WorkflowList": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Workflow" } } }, "additionalProperties": true, "required": [ "items" ] }, "ActionList": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Action" } } }, "additionalProperties": true, "required": [ "items" ] }, "AuditList": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Audit" } } }, "additionalProperties": true, "required": [ "items" ] } } } }