["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] c6:I[3409,["8005","static/chunks/8005-b7d065272b9b58b2.js","534","static/chunks/534-e93db2123952508f.js","7870","static/chunks/app/docs/%5B%5B...slug%5D%5D/page-af80157ca7da7d32.js"],"DocsPage"] c7:I[3409,["8005","static/chunks/8005-b7d065272b9b58b2.js","534","static/chunks/534-e93db2123952508f.js","7870","static/chunks/app/docs/%5B%5B...slug%5D%5D/page-af80157ca7da7d32.js"],"DocsTitle"] c8:I[3409,["8005","static/chunks/8005-b7d065272b9b58b2.js","534","static/chunks/534-e93db2123952508f.js","7870","static/chunks/app/docs/%5B%5B...slug%5D%5D/page-af80157ca7da7d32.js"],"DocsBody"] c9:I[89130,["8005","static/chunks/8005-b7d065272b9b58b2.js","534","static/chunks/534-e93db2123952508f.js","7870","static/chunks/app/docs/%5B%5B...slug%5D%5D/page-af80157ca7da7d32.js"],"OpenAPIPage"] d6:I[10634,[],"IconMark"] 19:["`POST /alerts/{id}/resolutions` — resolve an alert."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 1a:["`GET /alerts/system-destinations` — where this org's system alerts\ndeliver. Empty until an admin sets it."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 1b:["`PUT /alerts/system-destinations` — replace the stored destination ids.\nThe stored setting comes back."," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] 1c:["`POST /apps` — provision a fresh app and\nissue its first key in a single round trip."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 1d:["`DELETE /apps/{id}` — soft-delete + cascade revoke\nevery key the app holds. The row stays for audit; the extractor\nrejects api-key auth against revoked keys, and the app's\n`status = \"inactive\"` is the operator-visible state in the admin\nUI."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 1e:["`GET /apps/{id}` — detail + live active-key count."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 1f:["`GET /apps` — the apps this caller may see (ADR-0050 §6)."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 20:["`PATCH /apps/{id}` — update mutable fields. Role\nwrites are gated by [`validate_app_role`] (no admin/owner). Status\nflip to `\"inactive\"` here doesn't cascade-revoke keys; that's\n`DELETE`'s job and the admin-UI distinction."," ",["$","span",null,{"className":"font-mono font-medium text-orange-600 dark:text-orange-400 ms-auto text-xs text-nowrap","children":"PATCH"}]] 21:["Artifact_create"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 22:["Artifact_delete"," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 23:["Artifact_get"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 24:["Artifact_list"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 25:["Artifact_update"," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] 26:["Auth_get_config"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 27:["Auth_list_public_idps"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 28:["`POST /auth/logout` — expire the session cookies, and revoke the session row\nwhen the caller could be authenticated."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 2a:["`POST /auth/refresh` — renew the access token from the refresh cookie."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 2b:["`POST /auth/session` — exchange browser-minted Cognito tokens for the\nsession cookies. The **only** route that issues them."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 2d:["`POST /auth/webauthn/finish` — answer the challenge with the browser's\nassertion and, on success, issue the session exactly as `/auth/session`\ndoes ([`establish_session`]) minus the MFA gate: a user-verified WebAuthn\nsign-in is the strong factor."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 2e:["`POST /auth/webauthn/start` — begin a passkey / security-key sign-in\n(`rh-kk6vbu`). Anonymous; the server runs Cognito's `USER_AUTH` flow with\n`PREFERRED_CHALLENGE=WEB_AUTHN` on the org's app client."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 2f:["`POST /billing/setup-intent` — start adding a card. **Owner-only** (financial\nroot-of-trust). Provisions the org's Stripe customer on first use, then returns\na SetupIntent `client_secret` the browser confirms with Stripe Elements (the\ncard is vaulted + attached client-side; raw card never touches us)."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 30:["`DELETE /billing/payment-methods/{id}` — detach a saved card from Stripe.\n**Owner-only**."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 31:["`GET /billing` — fetch the org's billing settings."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 32:["`GET /billing/invoices` — the org's Stripe invoice history (every billing\nperiod since the subscription started), newest first, each with a\nStripe-hosted page + downloadable PDF link. Served through the management\nAPI, which holds the org's Stripe customer. Empty (not an error) when the org\nhas never had a Stripe customer; a management API that does not answer is a\n`503`, never an empty list."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 33:["`GET /billing/payment-methods` — the org's saved cards from Stripe. Any admin\nmay view (masked display fields only); empty when the org has never had a\nStripe customer. A management API that does not answer is a `503`, never an\nempty list."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 34:["`PATCH /billing` — update billing settings."," ",["$","span",null,{"className":"font-mono font-medium text-orange-600 dark:text-orange-400 ms-auto text-xs text-nowrap","children":"PATCH"}]] 35:["`GET /billing/plans` — the public plan catalog. **Unauthenticated**\n(the signup page reads it before an org exists) and stateless: composed from\nthe compiled-in `plan-defaults` / `pricing-defaults` codegen + the\nhand-written plan-catalog labels/features. The single wire source that\nreplaces the frontend's `PRICING_PLANS` constant."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 36:["`POST /billing/payment-methods/{id}/default` — make a saved card the default\n(what top-up charges hit). **Owner-only**."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 37:["`GET /billing/top-up` — the top-up pack (per-dimension headroom + price) + the\norg's current packs/spend/cap, for the purchase UI's cost preview. Admin-read."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 38:["`POST /billing/top-up` — buy prepaid top-up packs."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 39:["`POST /clients` — mint a client credential + return its one-time secret."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 3a:["`DELETE /clients/{id}` — remove the credential."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 3b:["`GET /clients/{id}` — one client, gated on `clients:read`."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 3c:["`PATCH /clients/{id}` — update name / scopes. A scopes change\nre-runs the owning app's subset cap."," ",["$","span",null,{"className":"font-mono font-medium text-orange-600 dark:text-orange-400 ms-auto text-xs text-nowrap","children":"PATCH"}]] 3d:["`GET /installations/{id}/clients` — the credentials one installation\nissued, gated on `clients:read`."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 3e:["`GET /domains/availability` — check whether a domain is already registered in the org."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 3f:["`POST /domains` — register a domain."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 40:["`DELETE /domains/{id}` — remove a domain."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 41:["`GET /domains/{id}` — fetch a single domain."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 42:["`GET /domains` — list all domains in the org."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 43:["`PUT /domains/{id}` — update a domain."," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] 44:["`POST /domains/{id}/verifications` — perform domain verification."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 45:["`DELETE /exports/{id}` — cancel an in-flight (or queued) export."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 46:["`POST /exports` — create an export of a query's result table."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 47:["`GET /exports/{id}` — fetch an export's status. Polled by the\nUI until `status ∈ {completed, failed, cancelled}`."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 48:["`POST /org-exports` — create a data export."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 49:["`DELETE /org-exports/{id}` — cancel an export."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 4a:["`POST /org-exports/estimates` — estimate the size, cost, and duration of\nan export before the customer commits to it."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 4b:["`GET /org-exports/{id}` — fetch a single export."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 4c:["`GET /org-exports` — list all data exports for the org."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 4d:["Folder_create"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 4e:["Folder_delete"," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 4f:["Folder_duplicate"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 50:["Folder_get"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 51:["Folder_list"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 52:["Folder_update"," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] 53:["`POST /grants` — issue a scope grant (admin; owner-reserved scopes need owner)."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 54:["`DELETE /grants/{id}` — revoke a grant."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 55:["`GET /grants` — list the org's scope grants, with optional filters."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 56:["Identity_provider_create"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 57:["Identity_provider_delete"," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 58:["Identity_provider_get"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 59:["Identity_provider_list"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 5a:["Identity_provider_patch"," ",["$","span",null,{"className":"font-mono font-medium text-orange-600 dark:text-orange-400 ms-auto text-xs text-nowrap","children":"PATCH"}]] 5b:["`POST /identity-providers/{id}/scim/bearer-tokens` — issue a fresh\nSCIM bearer for this IdpRecord."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 5c:["Identity_provider_sync"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 5d:["Identity_provider_test_connection"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 5e:["Identity_provider_update"," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] 5f:["`GET /installations` — every installation held by a team the caller belongs\nto (ADR-0050 §6)."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 60:["Investigation_create"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 61:["Investigation_delete"," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 62:["Investigation_duplicate"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 63:["Investigation_get"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 64:["Investigation_list"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 65:["Investigation_update"," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] 66:["Invitation_cancel"," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 67:["`POST /invitations/bulk` — bulk invitation import."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 68:["Invitation_create"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 69:["Invitation_list"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 6a:["Invitation_lookup_by_token"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 6b:["Invitation_redeem"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 6c:["`DELETE /organizations/{id}` — request de-boarding of the org(closes).\nAdmin of the org only, and the path id must match the caller's own org."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 6d:["`GET /organizations/{id}` — fetch a single organisation."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 6e:["`GET /organizations` — list organisations visible to the caller."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 6f:["`PUT /organizations/{id}` — update an organisation. Slug + plan-tier\nchanges are permitted; `data_lake_bucket` is system-managed and\nremains untouched by this endpoint."," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] 70:["`POST /queries/compile` — compile VFQL and return the SQL or the diagnostics."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 71:["`POST /queries` — submit a new query for execution. Returns the\nunified `QueryResponse` shape every other query endpoint emits."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 72:["`DELETE /queries/{id}` — cancel a running query."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 73:["`GET /queries/{id}/results` — fetch query result rows."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 74:["`GET /queries/{id}` — fetch a query's lifecycle state. Returns the\nunified `QueryResponse` shape."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 75:["`GET /queries` — list queries for the org."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 76:["`POST /rules/{id}/runs` — trigger a rule run."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 77:["`POST /rules` — create a rule."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 78:["`DELETE /rules/{id}` — remove a rule."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 79:["`POST /rules/{id}/copies` — duplicate a rule."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 7a:["`GET /rules/{id}` — fetch a single rule."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 7b:["`GET /rules/{id}/runs` — list runs for a rule."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 7c:["`GET /rules` — list all rules in the org."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 7d:["`PATCH /rules/{id}` — partially update a rule."," ",["$","span",null,{"className":"font-mono font-medium text-orange-600 dark:text-orange-400 ms-auto text-xs text-nowrap","children":"PATCH"}]] 7e:["`PUT /rules/{id}` — replace a rule's fields."," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] 7f:["SCIM `POST /Groups` — materialises a SCIM Group as a `TeamItem`\nwith `source = \"scim\"` + `external_idp_id = `."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 80:["SCIM `DELETE /Groups/{id}` — hard-deletes the team row. Group\nrows don't carry historical state we need to retain, so deletion\nis fine; users keep their other team memberships."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 81:["SCIM `GET /Groups/{id}` — returns the group only if this IdP owns it."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 82:["SCIM `GET /Groups` — list groups this IdP provisioned. Filter\nsubset: `displayName eq` and `externalId eq`."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 83:["SCIM `PATCH /Groups/{id}` — accepts the common Okta + Entra\npatterns: replace displayName, replace/add/remove members."," ",["$","span",null,{"className":"font-mono font-medium text-orange-600 dark:text-orange-400 ms-auto text-xs text-nowrap","children":"PATCH"}]] 84:["`GET /scim/v2/ResourceTypes` — RFC 7644 §4 listing of resource\ntypes the server exposes (Users + Groups). Unauthenticated."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 85:["`GET /scim/v2/Schemas` — RFC 7644 §4 listing of schemas the server\nsupports. Unauthenticated."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 86:["`GET /scim/v2/ServiceProviderConfig` — RFC 7644 §4 discovery\ndocument describing what this SCIM server supports (filter\noperators, auth schemes, bulk/patch/etag policy). Unauthenticated."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 87:["SCIM `POST /Users` — JIT-provisions a `UserItem` tagged with\n`provisionedBy = `. Email domain must be on the IdpRecord's\nbound domains."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 88:["SCIM `DELETE /Users/{id}` — soft-delete via `status = inactive`.\nRow is kept for audit; session revocation hangs off #317."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 89:["SCIM `GET /Users/{id}` — returns the user only if this IdP owns it."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 8a:["SCIM `GET /Users` — list users this IdP provisioned. Supports the\neq-only filter subset (see `scim::filter`)."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 8b:["SCIM `PATCH /Users/{id}` — accepts `op = replace` / `add` on\n`active` and `displayName`. Wider RFC 7644 §3.5.2 path expressions\nare out of scope."," ",["$","span",null,{"className":"font-mono font-medium text-orange-600 dark:text-orange-400 ms-auto text-xs text-nowrap","children":"PATCH"}]] 8c:["Bulk_iam_templates"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 8d:["Source_apply_upgrade"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 8e:["Source_attach"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 8f:["Source_create"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 90:["Source_delete"," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 91:["Source_detach"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 92:["Source_freshness"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 93:["Source_get_eventbridge_setup"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 94:["Source_get_iam_template"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 95:["Source_get_upgrade"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 96:["Source_get"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 97:["Source_list"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 98:["Source_metrics"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 99:["Source_replay"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 9a:["Source_update"," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] 9b:["Source_verify"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] 9c:["`DELETE /storage-key` — clear the org's storage key (reverts to the\nVigilfield-owned per-org default key)."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] 9d:["`GET /storage-key` — the org's storage key, or 404 when unset (the org then\nuses its Vigilfield-owned per-org default key)."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 9e:["`GET /storage-key/iam-template` — the four ADR-0066 deployment artifacts\n(role template, key-policy statement in two forms, OIDC snippet), rendered\nfor the requested account. A pure read: no storage-key row, no AWS call.\nAdmin gating stays in the logic layer, like every sibling here."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] 9f:["`PUT /storage-key` — set or replace the org's storage key."," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] a0:["Table_create"," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] a1:["Table_delete"," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] a2:["Table_get"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] a3:["⚠️ The parameter is spelled **inline** rather than by deriving `ToSchema` on\n`ListTablesQuery`: a query struct no body or component reference names would\nadd an orphan schema to `openapi.json`. Same shape as `routes/grant.rs`."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] a4:["Table_update"," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] a5:["Table_versions"," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] a6:["`POST /teams/{id}/users` — add a user to a team."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] a7:["`POST /teams` — create a team."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] a8:["`DELETE /teams/{id}` — remove a team."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] a9:["`GET /teams/{id}` — fetch a single team."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] aa:["`GET /teams` — list all teams in the org."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] ab:["`DELETE /teams/{id}/users/{userId}` — remove a user from a team."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] ac:["`PUT /teams/{id}` — update a team."," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] ad:["`GET /templates/{id}` — fetch one template by id. 404 on unknown."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] ae:["`GET /ingestion/deserializers` — the general-purpose deserializers a\ntemplate-less **custom** source may pick (ADR-0023). Derived from the\nstage catalog so the list can't drift; authenticated + scope-free like the\ntemplates."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] af:["`GET /templates` — list all built-in templates in registry order.\nAuthenticated (any valid session) but **scope-free**: the static built-in\ncatalog carries no tenant data, so it takes `AuthContext` to require a login\nand performs no grant/scope check."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] b0:["`POST /users` — create a user in the org."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] b1:["`DELETE /users/{id}` — remove a user from the org."," ",["$","span",null,{"className":"font-mono font-medium text-red-600 dark:text-red-400 ms-auto text-xs text-nowrap","children":"DELETE"}]] b2:["`GET /users/me` — the authenticated caller's own row."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] b3:["`GET /users/{id}` — fetch a single user."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] b4:["`GET /users` — list all users in the org."," ",["$","span",null,{"className":"font-mono font-medium text-green-600 dark:text-green-400 ms-auto text-xs text-nowrap","children":"GET"}]] b5:["`PATCH /users/{id}` — partially update a user."," ",["$","span",null,{"className":"font-mono font-medium text-orange-600 dark:text-orange-400 ms-auto text-xs text-nowrap","children":"PATCH"}]] b6:["`POST /users/{id}/ownership-transfers` — transfer org ownership to this user."," ",["$","span",null,{"className":"font-mono font-medium text-blue-600 dark:text-blue-400 ms-auto text-xs text-nowrap","children":"POST"}]] b7:["`PUT /users/{id}` — replace a user's fields."," ",["$","span",null,{"className":"font-mono font-medium text-yellow-600 dark:text-yellow-400 ms-auto text-xs text-nowrap","children":"PUT"}]] b8:["$","$L2",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L3",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","forbidden":"$undefined","unauthorized":"$undefined"}] b9:["$","$1","c",{"children":[null,["$","$L2",null,{"parallelRouterKey":"children","error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L3",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","forbidden":"$undefined","unauthorized":"$undefined"}]]}] ba:["$","$1","c",{"children":["$Lbe",null,["$","$Lbf",null,{"children":["$","$c0",null,{"name":"Next.MetadataOutlet","children":"$@c1"}]}]]}] bc:["$","$1","h",{"children":[null,["$","$Lc2",null,{"children":"$Lc3"}],["$","div",null,{"hidden":true,"children":["$","$Lc4",null,{"children":["$","$c0",null,{"name":"Next.Metadata","children":"$Lc5"}]}]}],null]}] bb:C ca:T4e5,# ⚠️ It runs for a caller who cannot authenticate, and that is the fix An `HttpOnly` cookie can only be cleared by the server, so a sign-out gated on a live session is a sign-out that fails exactly when it is needed. With `SelfAuthContext` the extractor refused first and the handler never ran, so four cases left the browser holding a **refresh** token after a deliberate sign-out: an expired access cookie, an already-revoked session (the second call of an idempotent logout), an api-key caller, and a token with no `origin_jti`. [`MaybeSelfAuth`] collapses all four into one shape. **The `None` arm has authenticated nobody.** It may only do what is safe for an anonymous caller — clearing cookies is (the browser is discarding its own state), revoking a server-side session is not, and that is why the revoke hangs off `Some`. Not a forced-logout primitive: `rh-cl95c`'s CSRF layer refuses a state-changing request the browser reports as cross-site, and it keys on `Sec-Fetch-Site` rather than on a session cookie precisely so it still fires on the routes that run without one — this being the first of them. (A cookie-gated check would not have: `SameSite=Strict` withholds the cookie on the very cross-site POST being defended against.)cb:T77c,# Verification is the whole endpoint [`authenticate_bearer`] runs signature, `iss`, `exp`, `aud`, `token_use`, the closed trusted-issuer set, the org-header match and the #317 session-revocation check, with `require_cognito` — you exchange an identity-provider session for our cookies, never a self-issued OAuth token. Without it this endpoint would set a session cookie from an attacker-chosen string. `require_acting_team` is `false`: the client learns its teams *from this response*, so demanding an acting team to sign in is unsatisfiable. Same arm `GET /users/me` takes. # ⚠️ Login CSRF / session fixation, and the four things that stop it The attack is forcing a victim's browser to POST an attacker's tokens here, so the victim then works inside the attacker's session — for a log product, the victim's queries landing in the attacker's org with the audit trail naming the attacker's user. Four controls block it, and the first two are the ones a refactor could quietly remove: 1. **`Json` refuses a cross-site form post.** An HTML `

` can only send `application/x-www-form-urlencoded`, `multipart/form-data` or `text/plain`; axum's `Json` extractor answers 415 to all three. Accepting form encoding here — or hand-parsing the body — deletes this defence. `a_form_encodable_post_is_refused` is the guard; 2. **the API has no CORS layer**, so a cross-origin `fetch(..., {credentials: 'include'})` fails CORS and the browser discards this response's `Set-Cookie` (rh-jculnc); 3. **the CSRF layer** refuses this route like any other — `rh-cl95c`'s predicate keys on `Sec-Fetch-Site`, not on a session cookie, precisely so it covers the route that *creates* the session (a cookie-gated check could not, by construction); 4. **`__Host-`** means only script on the victim's own origin could plant a cookie directly, which is already game over for other reasons.cc:T468,Targets a single user identified by `(auth.org_id, path id)`, kills their existing Cognito password with a random plaintext the admin never sees, and emails a fresh setup link so the user can pick a new one. Different from `POST /account/forgot-password` in two ways: 1. The admin is the actor; the target user might not know it happened until they read the email. We therefore use a distinct email copy (`SetupFlow::AdminPasswordReset`) that tells the user their old password is dead, not "you can ignore this and keep using your old one." 2. The endpoint is admin-only and not anti-enumeration: the admin can already enumerate their own org's users via `GET /users`, so opaque error responses would add nothing. Returns: - `200 { userId, sentTo, resetAt }` on success. - `400` if the target is a federated or app user (federated → "use your IdP"; service → "no password"). - `403` if the caller is not an admin. - `404` if the target user doesn't exist in the caller's org. - `500` if the org row, Cognito pool, or signing key are missing — these are operator-visible misconfigs, not user errors.cd:T4e0,`GET /auth/config` — the four keys the sign-in page needs, and the **only** ones this endpoint can serve. ⚠️ **The type is the boundary** (`rh-r5nxr6`). This response used to be the stored `auth_config` blob copied key-for-key onto a `serde_json::Value`, on an endpoint that takes no credential — so anything that reached the column reached every visitor to the login page. Deserializing the blob into this struct drops what it does not name, which is what makes "only known keys" a property of the code rather than of whoever last wrote the row. The write half is the other half of that fix: `auth_config` is no longer a field on `UpdateOrganizationRequest`, so an org admin cannot repoint these values at a pool they control. Every field is `Option` because a row may legitimately carry no blob (the seed is conditional, `common/custom-resource/org-seed`), and answering `404` for a *present* org would be a worse lie than answering a sparse object — the sign-in page already fails closed on a missing `user_pool_id` (`app/src/hooks/useAuth.ts`, "Incomplete auth config response"). ⚠️ `issuer` is seeded by `org-stack.ts` and is deliberately **not** here: no production code reads it. Adding a field to this struct publishes it.ce:T437,One row of `GET /installations` — the stored [`InstallationItem`](crate::model::InstallationItem) minus `org_id`. ⚠️ **A distinct type from [`InstallationResponse`], deliberately.** That one is the install *receipt*, and its `permissions` field is load-bearing: an install that conferred nothing must read back as `[]`. Reusing it for the list forces one of two wrong answers — populate `permissions` per row and pay one grant Query **per installation**, which is exactly the per-row join this design drops on cost grounds; or return `[]` and tell the reader that installs which conferred plenty conferred nothing, which that field's own doc comment forbids. So the list has its own shape. **No `name`.** The row has no source for one, and the join is unnecessary: an installed App is visible, so it is already in the caller's own `GET /apps` result and the frontend's lookup resolves it. An `app_id` that names no row renders as the raw id — the honest rendering of a dangling row rather than an invented empty string (`rh-44okjb` is the bead that reconciles those).cf:T45f,Org lifecycle state as reported on the wire. Two of the five arms have a writer: * `Active` — the default. `//common/custom-resource/org-seed` writes it at provisioning, and a row with no stored status is reported `Active` too. * `Deleting` — written by `delete_organization_for` when an admin calls `DELETE /organizations/{id}`. `Suspended`, `Pending` and `Trial` are **reserved**: nothing writes them and nothing branches on them. `Suspended` in particular is not a lever an operator holds — nothing can put an org into it. The management-plane registry row carries a separate `OrgStatus` (`crates/management/org_registry/model.rs`) whose `Suspended` does have a reader, `serves_traffic`; that is a different row and a different type, and it has no production writer either. ⚠️ Nothing in the data plane branches on this field at all, `Deleting` included, so it records intent rather than enforcing it. Storage shape (`OrganizationItem.status: Option`) is unchanged — only the wire DTOs carry the typed enum. A stored value this enum does not name is reported as absent, never as `Active`.d0:T437,One row of `GET /installations` — the stored [`InstallationItem`](crate::model::InstallationItem) minus `org_id`. ⚠️ **A distinct type from [`InstallationResponse`], deliberately.** That one is the install *receipt*, and its `permissions` field is load-bearing: an install that conferred nothing must read back as `[]`. Reusing it for the list forces one of two wrong answers — populate `permissions` per row and pay one grant Query **per installation**, which is exactly the per-row join this design drops on cost grounds; or return `[]` and tell the reader that installs which conferred plenty conferred nothing, which that field's own doc comment forbids. So the list has its own shape. **No `name`.** The row has no source for one, and the join is unnecessary: an installed App is visible, so it is already in the caller's own `GET /apps` result and the frontend's lookup resolves it. An `app_id` that names no row renders as the raw id — the honest rendering of a dangling row rather than an invented empty string (`rh-44okjb` is the bead that reconciles those).d1:T5f2,`true` when the run was stopped, so these rows may be a **fragment** of the answer the query would have produced. Read it as a hedge on the whole page, not as a property of any row: no count, aggregate or "no results" conclusion drawn from a `true` page is safe. Answered by [`QueryState::results_may_be_incomplete`], so it is `true` for `Cancelling` as well as `Cancelled`. The `Cancelling` window lasts until the engine confirms — up to ECS's ~1-hour task retention — and is exactly when a caller is most likely to read a partial page. ⚠️ **Unconditionally `true` for every route to `Cancelled`**, including a run that had already succeeded when the confirm tick landed. Narrowing it would mean the row retaining the engine's terminal reason, this DTO carrying a three-valued completeness and the app branching on it — to replace a sentence that is already honest. Recorded as a non-goal (`rh-xh63q` NG-6); do not build it. Named in the positive so the field name alone states the risk: a `complete: bool` reads as "still loading" when `false`. ⚠️ **No `#[serde(default)]`, unlike several fields above.** The org API deserializes this struct out of the cell's envelope (`services/org/api/port.rs::query_results_from_json`), and a default here would resolve a *missing* field to `false` — the unhedged answer. A version skew that drops the field would then tell every caller its partial page is complete, silently. Failing the decode is the honest outcome for a safety hedge; do not add the attribute.d2:T447,A query, as it travels: the VFQL text, the grammar version to parse it under, and the values bound to its declared parameters (ADR-0058 §2). There is **no language field**: every stored and submitted query text is VFQL, and there is no spelling that means "this one is SQL" (§5). ⚠️ **It lives here, beside [`ParamValue`], and not in the wire layer.** It was `vigilfield_query::dto::QueryText` while `POST /queries/compile` was its only carrier; the table's population config now stores one (`PopulationConfig.query`, in the table crate), and a wire DTO is not a type a storage model can depend on. Putting it beside the parameter type it names is the same argument `ParamValue` already carries: this is the vocabulary of a query, and one spelling of it is the point. The crate stays pure — this names only `String`, `BTreeMap`, `serde`, a schema derive and `ParamValue`. It reaches its old consumers unchanged, on the path `ParamValue` already travels: re-exported by `vigilfield_workload_preprocessor` and then by `vigilfield_query`, so `vigilfield_query::QueryText` still resolves.d3:T49d,Response from `POST /invitation-tokens/{invitation}/redemptions`. ⚠️ **It carries no setup token, and the absence is the security property** (`rh-pv7o15`). Redemption mints a one-use token for `POST /account/passwords` and sends it to the invitee's inbox; it used to return the same token here as well. That made the invite link *alone* sufficient to reach a live `email_verified = true` account with no inbox access — and an invite link is widely held by design: bulk invites hand admins raw tokens, `redemption_url` exists for copy-link, mail gets forwarded. The email echo on redeem is no control either, since the lookup endpoint returns the invited address for the same secret. The emailed link is now the only carrier, which is what makes `CognitoAdmin::admin_mark_email_verified`'s *"clicking the link proves delivery to the inbox"* true rather than aspirational. Removed rather than set to `None`: a field that must never be populated is one a later edit repopulates, and it would still advertise the token in the published schema. `org_slug` stays — not a credential, and the recipient page uses it to reach the right tenant without an extra lookup round-trip.d4:T630,How far a rule has scanned one of its source tables: the table version it last read through, and when that version was committed. ⚠️ **`committed_at` is the address, `snapshot_id` is derived audit data.** The next run re-resolves the stored `committed_at` against the table's snapshot history (`SnapshotCatalog::current_at`), so the instant is what a bookmark *is*; the id records which concrete version the anchor resolved to when the row was written, which is what makes a run auditable six months later (REQ-012). It exists beside the instant for the same reason `committed_at` does — a bare snapshot id says nothing about *when*, and cannot be re-resolved once vacuum has dropped the version it names. ⚠️ **`snapshot_id` is a `String`, never an `i64` or a JSON number.** Iceberg snapshot ids are i64 and routinely exceed 2^53, and a JSON number is read into a JavaScript `double` — so the id the UI shows, and anything an operator copies out of it, would silently be a *different* id (REQ-012). **A `committed_at` the system's readers parse** (`parse_stored_instant`, `rules/runner.rs`): RFC 3339, or the zone-less UTC spelling the snapshot catalog may render over a zone-less `timestamp` column — a rendering no test in this repository can pin (rh-kpc2mv). It stays text, like every other timestamp on this item: nothing needs a second `serde_dynamo` round-trip or a second JSON reading, and the instant is what the UI's coverage card shows (REQ-013), what the bookmark-age alarm gauges (REQ-011) and what the dispatch-time expiry refusal decides from (REQ-005).d5:T49d,`PUT /organizations/{id}` body. `plan_tier`, `status` and `auth_config` are deliberately not settable here; a body still carrying them is ignored, not rejected. ⚠️ **`auth_config` is absent, and the absence is a security boundary** (`rh-r5nxr6`). It is the org's Cognito pool binding — `user_pool_id`, `user_pool_client_id`, `user_pool_domain`, `region` — seeded once by `org-stack.ts` and served to every visitor by the unauthenticated `GET /auth/config`, which the sign-in page signs in against. While it was a free-form `Value` on this body, `require_admin` was the only thing between a compromised admin session and repointing the whole org's login at an attacker-controlled pool: a credential-harvesting redirect hiding inside a generic org update. Removed rather than guarded, because nothing legitimately writes it: `updateOrganization` has no production caller in the app, every reader consumes only the four seeded keys, and IdP configuration lives in the `identity_provider` resource rather than in this blob. A field a caller must not set is better absent than rejected — there is no guard to forget, and the published schema stops advertising the primitive.be:["$","$Lc6",null,{"full":true,"children":[["$","$Lc7",null,{"children":"Source_verify"}],["$","$Lc8",null,{"children":["$","$Lc9",null,{"payload":{"bundled":{"openapi":"3.2.0","info":{"title":"Vigilfield API","description":"Control-plane API for Vigilfield, the security lakehouse with a VFQL interface.","version":"0.0.0"},"paths":{"/access":{"get":{"tags":["access"],"summary":"`GET /access` — who can access a resource (teams + actions), plus whether a\nresource policy applies. Admin-gated.","operationId":"access_who_can_access","parameters":[{"name":"resource_type","in":"query","description":"ResourceKind token (tables, databases, …)","required":true,"schema":{"type":"string"}},{"name":"resource_id","in":"query","description":"The resource id","required":true,"schema":{"type":"string"}},{"name":"owner_team_id","in":"query","description":"The resource's owning team, if any","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Effective access","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WhoCanAccessResponse"}}}}}}},"/account/forgot-password":{"post":{"tags":["account"],"summary":"`POST /account/forgot-password`. Unauthenticated. Always\nreturns 202 — the response shape is identical whether the email\nmatches a real user, matches a federated user, or matches nothing.\nAnti-enumeration is the whole point: callers learn nothing from\nthe response except \"we accepted your request\".","description":"When the email matches a non-federated user, we generate a fresh\nsetup token (the same machinery signup and invitation use) and\nemail the user a `./set-password#` link. Since\nrh-j4af1x the user's row is **not** touched: this request proves\nnothing about who sent it, and `POST /account/passwords` accepts\nthe token on the token row rather than on the user's status.\n\nFederated users (`provisioned_by.is_some()`) never get a token —\ntheir credentials live in their IdP, not in Cognito. Auditing\ndistinguishes every outcome (`sent` / `skipped_federated` /\n`skipped_unknown` / …) so operators can spot enumeration attempts.","operationId":"account_forgot_password","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForgotPasswordRequest"}}},"required":true},"responses":{"202":{"description":"Request accepted. Returned regardless of whether the email matched a real user — clients learn nothing about user existence from the response."},"400":{"description":"Missing email or slug in the request body"}}}},"/account/passwords":{"post":{"tags":["account"],"operationId":"account_set_password","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetPasswordRequest"}}},"required":true},"responses":{"200":{"description":"Password set; user is now active","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetPasswordResponse"}}}},"400":{"description":"Validation error"},"403":{"description":"Invalid, expired, or already-used setup token"}}}},"/alert-destinations":{"get":{"tags":["alert-destination"],"summary":"`GET /alert-destinations`","operationId":"alert_destination_list","responses":{"200":{"description":"The caller's destinations","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AlertDestinationResponse"}}}}}}},"post":{"tags":["alert-destination"],"summary":"`POST /alert-destinations`","operationId":"alert_destination_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAlertDestinationRequest"}}},"required":true},"responses":{"200":{"description":"Created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertDestinationResponse"}}}},"400":{"description":"Invalid config for the kind"}}}},"/alert-destinations/{id}":{"get":{"tags":["alert-destination"],"summary":"`GET /alert-destinations/{id}`","operationId":"alert_destination_get","parameters":[{"name":"id","in":"path","description":"Destination id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The destination","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertDestinationResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["alert-destination"],"summary":"`PUT /alert-destinations/{id}`","operationId":"alert_destination_update","parameters":[{"name":"id","in":"path","description":"Destination id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAlertDestinationRequest"}}},"required":true},"responses":{"200":{"description":"Updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertDestinationResponse"}}}},"400":{"description":"Invalid config for the kind"},"404":{"description":"Not found"}}},"delete":{"tags":["alert-destination"],"summary":"`DELETE /alert-destinations/{id}` — 409 naming every rule whose\n`alerting.destination_ids` still names the destination (REQ-008).","operationId":"alert_destination_delete","parameters":[{"name":"id","in":"path","description":"Destination id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Deleted"},"404":{"description":"Not found"},"409":{"description":"Still referenced by rules — the message lists them"}}}},"/alert-destinations/{id}/iam-template":{"get":{"tags":["alert-destination"],"summary":"`GET /alert-destinations/{id}/iam-template` — the derived role's template\n(SNS only; a webhook is a 400 naming why — G-6).","operationId":"alert_destination_iam_template","parameters":[{"name":"id","in":"path","description":"Destination id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The role template","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertDestinationIamTemplateResponse"}}}},"400":{"description":"Webhook destinations have no AWS role"},"404":{"description":"Not found"}}}},"/alert-destinations/{id}/verifications":{"post":{"tags":["alert-destination"],"summary":"`POST /alert-destinations/{id}/verifications` — Verify: publish the test\nmessage (SNS) or send the signed test request (webhook). Stateless — the\noutcome is the response, not stored state (G-4).","operationId":"alert_destination_verify","parameters":[{"name":"id","in":"path","description":"Destination id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The typed outcome","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertDestinationVerificationResponse"}}}},"404":{"description":"Not found"},"503":{"description":"Verify not configured"}}}},"/alerts":{"get":{"tags":["alerts"],"summary":"`GET /alerts` — the alerts you may see.","description":"Newest first by the time each alert opened. Only alerts you may see. A page\nmay hold fewer than `limit` alerts, even none, while `next_cursor` is set:\nfollow it until it is null. There is no total.","operationId":"alert_list","parameters":[{"name":"status","in":"query","description":"Comma-separated: one or more of open, acknowledged, resolved","required":false,"schema":{"type":"string"}},{"name":"severity","in":"query","description":"One of informational, low, medium, high, critical","required":false,"schema":{"type":"string"}},{"name":"origin","in":"query","description":"rule or system, or one origin: rule: or system:","required":false,"schema":{"type":"string"}},{"name":"cursor","in":"query","description":"The previous page's next_cursor","required":false,"schema":{"type":"string"}},{"name":"limit","in":"query","description":"A whole number; 50 when absent, at most 100","required":false,"schema":{"type":"integer","format":"int32","minimum":0}}],"responses":{"200":{"description":"A page of alerts, newest first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertListResponse"}}}},"400":{"description":"A filter, cursor or limit this API does not accept"},"403":{"description":"alerts:read required"}}}},"/alerts/system-destinations":{"get":{"tags":["alerts"],"summary":"`GET /alerts/system-destinations` — where this org's system alerts\ndeliver. Empty until an admin sets it.","operationId":"alert_system_destinations_get","responses":{"200":{"description":"The stored destination ids","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemAlertDestinationsResponse"}}}},"403":{"description":"Admins and owners only; installations are refused"}}},"put":{"tags":["alerts"],"summary":"`PUT /alerts/system-destinations` — replace the stored destination ids.\nThe stored setting comes back.","operationId":"alert_system_destinations_update","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemAlertDestinationsRequest"}}},"required":true},"responses":{"200":{"description":"The stored destination ids","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemAlertDestinationsResponse"}}}},"400":{"description":"A malformed id: empty, duplicated, or more than 32 ids"},"403":{"description":"Admins and owners only; installations are refused"}}}},"/alerts/unopened":{"get":{"tags":["alerts"],"summary":"`GET /alerts/unopened` — the bell.","description":"System alerts you have not opened, among the 50 newest system alerts; newest\nfirst; no cursor. Empty unless you are an org admin.","operationId":"alert_list_unopened","responses":{"200":{"description":"Unopened system alerts; next_cursor is always null","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertListResponse"}}}},"403":{"description":"alerts:read required"}}}},"/alerts/{id}":{"get":{"tags":["alerts"],"summary":"`GET /alerts/{id}` — one alert. Reading it does not mark it opened.","operationId":"alert_get","parameters":[{"name":"id","in":"path","description":"Alert id (`alr_…`)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The alert","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertResponse"}}}},"403":{"description":"alerts:read required"},"404":{"description":"No such alert, or not one you may see"}}}},"/alerts/{id}/acknowledgements":{"post":{"tags":["alerts"],"summary":"`POST /alerts/{id}/acknowledgements` — acknowledge an alert.","description":"The alert's id and resulting status. A repeat succeeds. Acknowledging a\nresolved alert is a 409.","operationId":"alert_acknowledge","parameters":[{"name":"id","in":"path","description":"Alert id (`alr_…`)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The alert's id and resulting status","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertTransitionResponse"}}}},"403":{"description":"alerts:write required, or you may read this alert but not act on it"},"404":{"description":"No such alert, or not one you may see"},"409":{"description":"The alert is resolved"}}}},"/alerts/{id}/opened":{"post":{"tags":["alerts"],"summary":"`POST /alerts/{id}/opened` — take a system alert off your own bell.","description":"Changes nothing anyone else sees, so it needs `alerts:read`. A repeat\nsucceeds; on a rule alert it does nothing.","operationId":"alert_mark_opened","parameters":[{"name":"id","in":"path","description":"Alert id (`alr_…`)","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Marked opened for you"},"403":{"description":"alerts:read required"},"404":{"description":"No such alert, or not one you may see"}}}},"/alerts/{id}/resolutions":{"post":{"tags":["alerts"],"summary":"`POST /alerts/{id}/resolutions` — resolve an alert.","description":"The alert's id and resulting status. A repeat succeeds. The next hit on the\nsame key opens a new alert.","operationId":"alert_resolve","parameters":[{"name":"id","in":"path","description":"Alert id (`alr_…`)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The alert's id and resulting status","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertTransitionResponse"}}}},"403":{"description":"alerts:write required, or you may read this alert but not act on it"},"404":{"description":"No such alert, or not one you may see"}}}},"/apps":{"get":{"tags":["apps"],"summary":"`GET /apps` — the apps this caller may see (ADR-0050 §6).","description":"⚠️ **No longer the org-wide roster.** A caller receives the published\ncatalog, the apps on their own teams, and the ones their teams\ninstalled; a governance principal (owner/admin) still receives the org. The\nnarrowing is real and visible in the console: a non-admin now sees fewer\nrows on `/admin/apps`.","operationId":"app_list","parameters":[{"name":"filter","in":"query","description":"authored | catalog | installed; absent means the caller's whole visible set","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"App list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_AppResponse"}}}},"400":{"description":"Unknown filter value"},"403":{"description":"apps:read required"}}},"post":{"tags":["apps"],"summary":"`POST /apps` — provision a fresh app and\nissue its first key in a single round trip.","operationId":"app_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAppRequest"}}},"required":true},"responses":{"201":{"description":"App created with initial key","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAppResponse"}}}},"400":{"description":"Validation error"},"403":{"description":"apps:write required, or a named team is not one of yours"}}}},"/apps/{id}":{"get":{"tags":["apps"],"summary":"`GET /apps/{id}` — detail + live active-key count.","operationId":"app_get","parameters":[{"name":"id","in":"path","description":"App id (`app_…`)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"App found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppResponse"}}}},"403":{"description":"apps:read or clients:read required"},"404":{"description":"Not found"}}},"delete":{"tags":["apps"],"summary":"`DELETE /apps/{id}` — soft-delete + cascade revoke\nevery key the app holds. The row stays for audit; the extractor\nrejects api-key auth against revoked keys, and the app's\n`status = \"inactive\"` is the operator-visible state in the admin\nUI.","operationId":"app_delete","parameters":[{"name":"id","in":"path","description":"App id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"App soft-deleted"},"403":{"description":"apps:write required, or the app's teams are not yours"},"404":{"description":"Not found"}}},"patch":{"tags":["apps"],"summary":"`PATCH /apps/{id}` — update mutable fields. Role\nwrites are gated by [`validate_app_role`] (no admin/owner). Status\nflip to `\"inactive\"` here doesn't cascade-revoke keys; that's\n`DELETE`'s job and the admin-UI distinction.","operationId":"app_patch","parameters":[{"name":"id","in":"path","description":"App id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PatchAppRequest"}}},"required":true},"responses":{"200":{"description":"App updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AppResponse"}}}},"400":{"description":"Validation error"},"403":{"description":"apps:write required, or the app's teams are not yours"},"404":{"description":"Not found"}}}},"/auth/config":{"get":{"tags":["auth"],"operationId":"auth_get_config","parameters":[{"name":"org_id","in":"query","description":"Org id (alternative to slug)","required":false,"schema":{"type":"string"}},{"name":"slug","in":"query","description":"Org subdomain slug","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Public auth config for the org's login page","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthConfigResponse"}}}},"404":{"description":"Org not found"}}}},"/auth/idps":{"get":{"tags":["auth"],"operationId":"auth_list_public_idps","parameters":[{"name":"slug","in":"query","description":"Org subdomain slug","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Public IdP list for the org's login page","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicIdpListResponse"}}}},"400":{"description":"slug is required"}}}},"/auth/logout":{"post":{"tags":["auth"],"summary":"`POST /auth/logout` — expire the session cookies, and revoke the session row\nwhen the caller could be authenticated.","description":"$ca","operationId":"auth_logout","responses":{"204":{"description":"Session cookies expired; session revoked where there was one"}}}},"/auth/refresh":{"post":{"tags":["auth"],"summary":"`POST /auth/refresh` — renew the access token from the refresh cookie.","description":"The credential arrives in `__Host-vf_refresh`, not in the body: page script\ncannot read an `HttpOnly` cookie, so it cannot put the token there any more.\nThis handler reads the jar and builds the port's [`RefreshInput`] from\n`{cookie, body.slug}` — the port and `refresh_for` are untouched, and know\nnothing about cookies.\n\n⚠️ **Only `vf_session` and `vf_expires_at` are re-set.** Cognito's\n`REFRESH_TOKEN_AUTH` returns no new refresh token, so there is nothing to\nre-emit; the browser keeps the `vf_refresh` it has and a second renewal\nworks. Re-setting it from `RefreshInput.refresh_token` would work too, but\nonly by accident — it would write the same value back, and the first time\nCognito *did* rotate, a handler that re-set the old value would pin the\nsession to a dead credential.\n\nA missing cookie is the same uniform 401 as a bad one. #314's\nanti-enumeration property is that every probe-able failure is\nindistinguishable, and \"you sent no cookie\" is exactly such a probe.","operationId":"auth_refresh","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RefreshRequest"}}},"required":true},"responses":{"200":{"description":"Session renewed; new cookies in Set-Cookie","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RefreshResponse"}}}},"401":{"description":"Refresh token missing, invalid, expired, or revoked"}}}},"/auth/session":{"post":{"tags":["auth"],"summary":"`POST /auth/session` — exchange browser-minted Cognito tokens for the\nsession cookies. The **only** route that issues them.","description":"$cb","operationId":"auth_session_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionRequest"}}},"required":true},"responses":{"200":{"description":"Session established; cookies in Set-Cookie","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionResponse"}}}},"401":{"description":"The access token is not valid for a live principal"},"403":{"description":"A native user's sign-in lacks the required second factor; `mfa` says whether to enrol one (`enroll`) or present a passkey / security key (`second_factor`)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MfaRequiredResponse"}}}}}}},"/auth/webauthn/finish":{"post":{"tags":["auth"],"summary":"`POST /auth/webauthn/finish` — answer the challenge with the browser's\nassertion and, on success, issue the session exactly as `/auth/session`\ndoes ([`establish_session`]) minus the MFA gate: a user-verified WebAuthn\nsign-in is the strong factor.","description":"All four of `/auth/session`'s login-CSRF controls apply unchanged — `Json`\nonly, no CORS layer, the `Sec-Fetch-Site` CSRF layer and `__Host-` cookies —\nand the tokens are minted server-side, so a caller cannot choose them.","operationId":"auth_webauthn_finish","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebAuthnFinishRequest"}}},"required":true},"responses":{"200":{"description":"Session established; cookies in Set-Cookie","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionResponse"}}}},"401":{"description":"The assertion could not be verified"},"403":{"description":"An administrator reset this account's MFA; sign in with the password to set it up again"}}}},"/auth/webauthn/start":{"post":{"tags":["auth"],"summary":"`POST /auth/webauthn/start` — begin a passkey / security-key sign-in\n(`rh-kk6vbu`). Anonymous; the server runs Cognito's `USER_AUTH` flow with\n`PREFERRED_CHALLENGE=WEB_AUTHN` on the org's app client.","description":"Every \"no challenge\" outcome — no key registered, unknown user, unknown org —\nis one 400 with one sentence, so this is no better an account oracle than\nthe pool's `preventUserExistenceErrors` already allows.\n\n`Json` only, like `/auth/session` and for the same login-CSRF reason: a form\npost is a 415 before the handler runs.","operationId":"auth_webauthn_start","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebAuthnStartRequest"}}},"required":true},"responses":{"200":{"description":"WebAuthn challenge issued","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WebAuthnStartResponse"}}}},"400":{"description":"No passkey or security key is set up for this account"}}}},"/billing":{"get":{"tags":["billing"],"summary":"`GET /billing` — fetch the org's billing settings.","operationId":"billing_get","responses":{"200":{"description":"Billing settings","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BillingResponse"}}}}}},"patch":{"tags":["billing"],"summary":"`PATCH /billing` — update billing settings.","operationId":"billing_patch","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PatchBillingRequest"}}},"required":true},"responses":{"200":{"description":"Billing settings updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BillingResponse"}}}}}}},"/billing/invoices":{"get":{"tags":["billing"],"summary":"`GET /billing/invoices` — the org's Stripe invoice history (every billing\nperiod since the subscription started), newest first, each with a\nStripe-hosted page + downloadable PDF link. Served through the management\nAPI, which holds the org's Stripe customer. Empty (not an error) when the org\nhas never had a Stripe customer; a management API that does not answer is a\n`503`, never an empty list.","operationId":"billing_list_invoices","responses":{"200":{"description":"Stripe invoice history","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_InvoiceResponse"}}}}}}},"/billing/payment-methods":{"get":{"tags":["billing"],"summary":"`GET /billing/payment-methods` — the org's saved cards from Stripe. Any admin\nmay view (masked display fields only); empty when the org has never had a\nStripe customer. A management API that does not answer is a `503`, never an\nempty list.","operationId":"billing_list_payment_methods","responses":{"200":{"description":"Payment method list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_PaymentMethodResponse"}}}}}}},"/billing/payment-methods/{id}":{"delete":{"tags":["billing"],"summary":"`DELETE /billing/payment-methods/{id}` — detach a saved card from Stripe.\n**Owner-only**.","operationId":"billing_delete_payment_method","parameters":[{"name":"id","in":"path","description":"Stripe payment method id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Payment method detached"},"400":{"description":"Unknown payment method for this org"}}}},"/billing/payment-methods/{id}/default":{"post":{"tags":["billing"],"summary":"`POST /billing/payment-methods/{id}/default` — make a saved card the default\n(what top-up charges hit). **Owner-only**.","operationId":"billing_set_default_payment_method","parameters":[{"name":"id","in":"path","description":"Stripe payment method id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Default payment method set"},"400":{"description":"Unknown payment method for this org"}}}},"/billing/plans":{"get":{"tags":["billing"],"summary":"`GET /billing/plans` — the public plan catalog. **Unauthenticated**\n(the signup page reads it before an org exists) and stateless: composed from\nthe compiled-in `plan-defaults` / `pricing-defaults` codegen + the\nhand-written plan-catalog labels/features. The single wire source that\nreplaces the frontend's `PRICING_PLANS` constant.","operationId":"billing_plans","responses":{"200":{"description":"Plan catalog (tiers, prices, limits, features)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlanCatalogResponse"}}}}}}},"/billing/setup-intent":{"post":{"tags":["billing"],"summary":"`POST /billing/setup-intent` — start adding a card. **Owner-only** (financial\nroot-of-trust). Provisions the org's Stripe customer on first use, then returns\na SetupIntent `client_secret` the browser confirms with Stripe Elements (the\ncard is vaulted + attached client-side; raw card never touches us).","operationId":"billing_create_setup_intent","responses":{"200":{"description":"SetupIntent client secret","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupIntentResponse"}}}},"503":{"description":"Billing not configured (no Stripe key)"}}}},"/billing/top-up":{"get":{"tags":["billing"],"summary":"`GET /billing/top-up` — the top-up pack (per-dimension headroom + price) + the\norg's current packs/spend/cap, for the purchase UI's cost preview. Admin-read.","operationId":"billing_top_up_info","responses":{"200":{"description":"Top-up pack pricing + the org's period state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TopUpInfoResponse"}}}}}},"post":{"tags":["billing"],"summary":"`POST /billing/top-up` — buy prepaid top-up packs.","operationId":"billing_top_up","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TopUpRequest"}}},"required":true},"responses":{"200":{"description":"Updated top-up pack count for the period","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TopUpResponse"}}}}}}},"/clients":{"post":{"tags":["clients"],"summary":"`POST /clients` — mint a client credential + return its one-time secret.","operationId":"client_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateClientRequest"}}},"required":true},"responses":{"201":{"description":"Client created with one-time secret","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateClientResponse"}}}},"400":{"description":"Validation error"},"403":{"description":"Declared scopes exceed the owning app's authority, or clients:write required"},"409":{"description":"The installation already holds the maximum number of clients; delete the one being replaced to free its slot"}}}},"/clients/{id}":{"get":{"tags":["clients"],"summary":"`GET /clients/{id}` — one client, gated on `clients:read`.","operationId":"client_get","parameters":[{"name":"id","in":"path","description":"Client id (`.client-…`)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Client found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["clients"],"summary":"`DELETE /clients/{id}` — remove the credential.","operationId":"client_delete","parameters":[{"name":"id","in":"path","description":"Client id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Client deleted"},"404":{"description":"Not found"}}},"patch":{"tags":["clients"],"summary":"`PATCH /clients/{id}` — update name / scopes. A scopes change\nre-runs the owning app's subset cap.","operationId":"client_patch","parameters":[{"name":"id","in":"path","description":"Client id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PatchClientRequest"}}},"required":true},"responses":{"200":{"description":"Client updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientResponse"}}}},"400":{"description":"Validation error"},"403":{"description":"Declared scopes exceed the owning app's authority"},"404":{"description":"Not found"}}}},"/domains":{"get":{"tags":["domains"],"summary":"`GET /domains` — list all domains in the org.","operationId":"domain_list","parameters":[{"name":"domain","in":"query","description":"Exact-match filter on the domain name; used by availability lookups","required":false,"schema":{"type":"string"}},{"name":"includeUnverified","in":"query","description":"Include domains without a `verified_at` timestamp; defaults to false","required":false,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"Domain list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_DomainResponse"}}}}}},"post":{"tags":["domains"],"summary":"`POST /domains` — register a domain.","operationId":"domain_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDomainRequest"}}},"required":true},"responses":{"201":{"description":"Domain created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainResponse"}}}},"400":{"description":"Validation error"}}}},"/domains/availability":{"get":{"tags":["domains"],"summary":"`GET /domains/availability` — check whether a domain is already registered in the org.","operationId":"domain_availability","parameters":[{"name":"domain","in":"query","description":"Domain name to check","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Domain availability","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainAvailabilityResponse"}}}}}}},"/domains/{id}":{"get":{"tags":["domains"],"summary":"`GET /domains/{id}` — fetch a single domain.","operationId":"domain_get","parameters":[{"name":"id","in":"path","description":"Domain id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Domain found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["domains"],"summary":"`PUT /domains/{id}` — update a domain.","operationId":"domain_update","parameters":[{"name":"id","in":"path","description":"Domain id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDomainRequest"}}},"required":true},"responses":{"200":{"description":"Domain updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["domains"],"summary":"`DELETE /domains/{id}` — remove a domain.","operationId":"domain_delete","parameters":[{"name":"id","in":"path","description":"Domain id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Domain deleted"},"404":{"description":"Not found"}}}},"/domains/{id}/verifications":{"post":{"tags":["domains"],"summary":"`POST /domains/{id}/verifications` — perform domain verification.","description":"Looks up the TXT record at `_vigilfield-verification.` and\nmatches it against the per-domain `verification_token` from the\nrow. The lookup is synchronous: success transitions the row to\n`verified` with `verified_at = now()`; failure leaves the row's\nexisting verification state intact and returns 4xx.\n\nThree outcomes from the resolver map onto three response shapes:\n\n- `Matched` → 200, row updated.\n- `NotFound` → 403 with `domain verification failed` (anti-\n enumeration: same body whether the record is\n absent or carries a wrong token).\n- `ResolverError` → 503 so the caller knows to retry rather than\n surfacing \"verification failed\" to the user\n when DNS itself is the problem.","operationId":"domain_verify","parameters":[{"name":"id","in":"path","description":"Domain id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Verification succeeded","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainResponse"}}}},"403":{"description":"Verification failed (record absent or token mismatch)"},"404":{"description":"Domain not found"},"503":{"description":"DNS resolver unavailable; client should retry"}}}},"/exports":{"post":{"tags":["exports"],"summary":"`POST /exports` — create an export of a query's result table.","description":"Routes through `preprocessor.submit_export`, which:\n - Verifies the source query exists and reached terminal `Succeeded`.\n - Re-runs the source query's table-level grants — the caller\n must be able to access every table the query touched.\n - Validates the export-shape fields (format / delivery\n configuration) + compiles `filterExpression` for syntax.\n - Dispatches to `Scheduler::submit_export`, which persists an\n Export-kind workload (`status: \"pending\"`).\n\nThe exporter ECS service picks up Queued Export workloads from\nthe scheduler tick and drives them through Running → terminal.","operationId":"export_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateExportRequest"}}},"required":true},"responses":{"201":{"description":"Export created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportResponse"}}}},"400":{"description":"Invalid request"},"404":{"description":"Source query not found / not accessible"}}}},"/exports/{id}":{"get":{"tags":["exports"],"summary":"`GET /exports/{id}` — fetch an export's status. Polled by the\nUI until `status ∈ {completed, failed, cancelled}`.","operationId":"export_get","parameters":[{"name":"id","in":"path","description":"Export id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Export status","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["exports"],"summary":"`DELETE /exports/{id}` — cancel an in-flight (or queued) export.","description":"Idempotent: cancelling an already-terminal export returns the\nrow's current state. Routes through `preprocessor.cancel_export`\n→ `scheduler::cancel_export`, which signals the exporter to halt\nany in-flight encode task at the next milestone, then flips the\nworkload to terminal `Cancelled`. The FE sees the new state on\nthe next poll.","operationId":"export_cancel","parameters":[{"name":"id","in":"path","description":"Export id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Cancelled (or already terminal)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportResponse"}}}},"404":{"description":"Not found"}}}},"/folders":{"get":{"tags":["folders"],"operationId":"folder_list","responses":{"200":{"description":"Folder list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_FolderResponse"}}}}}},"post":{"tags":["folders"],"operationId":"folder_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateFolderRequest"}}},"required":true},"responses":{"201":{"description":"Folder created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FolderResponse"}}}},"400":{"description":"Validation error"}}}},"/folders/{id}":{"get":{"tags":["folders"],"operationId":"folder_get","parameters":[{"name":"id","in":"path","description":"Folder id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Folder found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FolderResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["folders"],"operationId":"folder_update","parameters":[{"name":"id","in":"path","description":"Folder id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateFolderRequest"}}},"required":true},"responses":{"200":{"description":"Folder updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FolderResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["folders"],"operationId":"folder_delete","parameters":[{"name":"id","in":"path","description":"Folder id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Folder deleted"},"404":{"description":"Not found"}}}},"/folders/{id}/copies":{"post":{"tags":["folders"],"operationId":"folder_duplicate","parameters":[{"name":"id","in":"path","description":"Folder id","required":true,"schema":{"type":"string"}}],"responses":{"201":{"description":"Folder duplicated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FolderResponse"}}}},"404":{"description":"Not found"}}}},"/grants":{"get":{"tags":["grants"],"summary":"`GET /grants` — list the org's scope grants, with optional filters.","operationId":"grant_list","parameters":[{"name":"subject_type","in":"query","description":"Filter by subject kind (user, team, app)","required":false,"schema":{"type":"string"}},{"name":"subject_id","in":"query","description":"Filter by subject id","required":false,"schema":{"type":"string"}},{"name":"resource_id","in":"query","description":"Filter to grants whose target is this resource id","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Grant list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_GrantResponse"}}}}}},"post":{"tags":["grants"],"summary":"`POST /grants` — issue a scope grant (admin; owner-reserved scopes need owner).","operationId":"grant_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateGrantRequest"}}},"required":true},"responses":{"201":{"description":"Grant issued","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GrantResponse"}}}}}}},"/grants/{id}":{"delete":{"tags":["grants"],"summary":"`DELETE /grants/{id}` — revoke a grant.","operationId":"grant_delete","parameters":[{"name":"id","in":"path","description":"Grant id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Grant revoked"},"404":{"description":"Not found"}}}},"/iam-templates":{"post":{"tags":["sources"],"operationId":"bulk_iam_templates","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkIamTemplatesRequest"}}},"required":true},"responses":{"200":{"description":"One template pair per AWS account, plus the resources the selection skipped","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkIamTemplatesResponse"}}}},"400":{"description":"The selection yields zero roles, naming why"},"403":{"description":"A named id is not readable by the caller"},"404":{"description":"A named id does not exist"},"503":{"description":"Federation issuer not configured"}}}},"/identity-providers":{"get":{"tags":["identity-providers"],"operationId":"identity_provider_list","responses":{"200":{"description":"Identity provider list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_IdentityProviderResponse"}}}}}},"post":{"tags":["identity-providers"],"operationId":"identity_provider_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateIdentityProviderRequest"}}},"required":true},"responses":{"201":{"description":"Identity provider created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProviderResponse"}}}},"400":{"description":"Validation error"}}}},"/identity-providers/{id}":{"get":{"tags":["identity-providers"],"operationId":"identity_provider_get","parameters":[{"name":"id","in":"path","description":"Identity provider id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Identity provider found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProviderResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["identity-providers"],"operationId":"identity_provider_update","parameters":[{"name":"id","in":"path","description":"Identity provider id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateIdentityProviderRequest"}}},"required":true},"responses":{"200":{"description":"Identity provider updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProviderResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["identity-providers"],"operationId":"identity_provider_delete","parameters":[{"name":"id","in":"path","description":"Identity provider id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Identity provider deleted"},"404":{"description":"Not found"}}},"patch":{"tags":["identity-providers"],"operationId":"identity_provider_patch","parameters":[{"name":"id","in":"path","description":"Identity provider id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PatchIdentityProviderRequest"}}},"required":true},"responses":{"200":{"description":"Identity provider patched","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProviderResponse"}}}},"404":{"description":"Not found"}}}},"/identity-providers/{id}/connection-tests":{"post":{"tags":["identity-providers"],"operationId":"identity_provider_test_connection","parameters":[{"name":"id","in":"path","description":"Identity provider id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Connection test result","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdpConnectionTestResponse"}}}}}}},"/identity-providers/{id}/scim/bearer-tokens":{"post":{"tags":["identity-providers"],"summary":"`POST /identity-providers/{id}/scim/bearer-tokens` — issue a fresh\nSCIM bearer for this IdpRecord.","description":"First-time issuance and rotation are the same operation: every\ncall replaces `scim_bearer_token_hash` with the hash of a freshly-\ngenerated 64-hex-char plaintext, and returns the plaintext to the\nadmin once in the response. Subsequent IdpRecord reads never echo\nit.\n\nReturns:\n- `201` with `{ bearerToken, rotatedAt }` on success.\n- `404` if the IdpRecord doesn't exist at `(org_id, id)`.\n- `404` if it exists but has no `scim_config` configured — admin\n must enable SCIM via the regular update path before issuing a\n token. (Anti-enum: same 404 as \"not found at all\" so the\n endpoint doesn't leak whether the IdpRecord exists.)\n- `403` if the caller is not an admin.\n\n## Atomic invalidation\n\nThe `scim-bearer-hash-index` GSI is what the SCIM auth extractor\nuses to authenticate every inbound request. Replacing the hash in\na single `PutItem` means the old hash is no longer findable after\nthis returns — concurrent SCIM calls with the old bearer 401 on\ntheir next request. No grace window.","operationId":"identity_provider_rotate_scim_bearer","parameters":[{"name":"id","in":"path","description":"Identity provider id","required":true,"schema":{"type":"string"}}],"responses":{"201":{"description":"Rotated SCIM bearer","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimBearerRotationResponse"}}}},"403":{"description":"Caller is not an admin"},"404":{"description":"IdpRecord not found, or SCIM not configured on the IdpRecord"}}}},"/identity-providers/{id}/syncs":{"post":{"tags":["identity-providers"],"operationId":"identity_provider_sync","parameters":[{"name":"id","in":"path","description":"Identity provider id","required":true,"schema":{"type":"string"}}],"responses":{"202":{"description":"Sync accepted","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IdentityProviderResponse"}}}},"404":{"description":"Not found"}}}},"/ingestion/deserializers":{"get":{"tags":["templates"],"summary":"`GET /ingestion/deserializers` — the general-purpose deserializers a\ntemplate-less **custom** source may pick (ADR-0023). Derived from the\nstage catalog so the list can't drift; authenticated + scope-free like the\ntemplates.","operationId":"template_list_deserializers","responses":{"200":{"description":"Custom-selectable deserializers","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DeserializerResponse"}}}}}}}},"/installations":{"get":{"tags":["installations"],"summary":"`GET /installations` — every installation held by a team the caller belongs\nto (ADR-0050 §6).","description":"**No team parameter, deliberately.** The set is `auth.team_ids`, so a caller\ncannot name a team they are not on — the bound is the permission scope\nrather than an argument to be validated. A caller on two teams gets the\nunion of both.\n\nOne synthetic page, like every list on this surface: the cost scales with\nthe caller's team count rather than the org's install count, because there\nis no per-row join.","operationId":"installation_list","responses":{"200":{"description":"The caller's teams' installations","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_InstallationSummary"}}}},"403":{"description":"apps:read required"}}}},"/installations/{id}/clients":{"get":{"tags":["clients"],"summary":"`GET /installations/{id}/clients` — the credentials one installation\nissued, gated on `clients:read`.","description":"A credential is a sub-resource of its **installation** (ADR-0050 §5), so\nthis is one Query on that partition. An installation whose App the caller\ncannot see answers `404`, like an absent one.\n\nIt takes **no page parameters**: `MAX_CLIENTS_PER_INSTALLATION` bounds it.\nThe `PaginatedResponse` envelope is kept for wire compatibility with every\nother list on this surface.","operationId":"installation_client_list","parameters":[{"name":"id","in":"path","description":"Installation id (`inst-…`)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The installation's clients","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_ClientResponse"}}}},"403":{"description":"clients:read required"},"404":{"description":"No such installation"}}}},"/investigations":{"get":{"tags":["investigations"],"operationId":"investigation_list","parameters":[{"name":"folderId","in":"query","description":"Filter by folder id","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Investigation list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_InvestigationResponse"}}}}}},"post":{"tags":["investigations"],"operationId":"investigation_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateInvestigationRequest"}}},"required":true},"responses":{"201":{"description":"Investigation created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvestigationResponse"}}}}}}},"/investigations/{id}":{"get":{"tags":["investigations"],"operationId":"investigation_get","parameters":[{"name":"id","in":"path","description":"Investigation id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Investigation found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvestigationResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["investigations"],"operationId":"investigation_update","parameters":[{"name":"id","in":"path","description":"Investigation id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateInvestigationRequest"}}},"required":true},"responses":{"200":{"description":"Investigation updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvestigationResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["investigations"],"operationId":"investigation_delete","parameters":[{"name":"id","in":"path","description":"Investigation id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Investigation deleted"},"404":{"description":"Not found"}}}},"/investigations/{id}/copies":{"post":{"tags":["investigations"],"operationId":"investigation_duplicate","parameters":[{"name":"id","in":"path","description":"Investigation id","required":true,"schema":{"type":"string"}}],"responses":{"201":{"description":"Investigation duplicated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvestigationResponse"}}}},"404":{"description":"Not found"}}}},"/investigations/{investigationId}/artifacts":{"get":{"tags":["artifacts"],"operationId":"artifact_list","parameters":[{"name":"investigationId","in":"path","description":"Investigation id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Artifact list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_ArtifactResponse"}}}}}},"post":{"tags":["artifacts"],"operationId":"artifact_create","parameters":[{"name":"investigationId","in":"path","description":"Investigation id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateArtifactRequest"}}},"required":true},"responses":{"201":{"description":"Artifact created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactResponse"}}}},"400":{"description":"Validation error"}}}},"/investigations/{investigationId}/artifacts/{id}":{"get":{"tags":["artifacts"],"operationId":"artifact_get","parameters":[{"name":"investigationId","in":"path","description":"Investigation id","required":true,"schema":{"type":"string"}},{"name":"id","in":"path","description":"Artifact id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Artifact found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["artifacts"],"operationId":"artifact_update","parameters":[{"name":"investigationId","in":"path","description":"Investigation id","required":true,"schema":{"type":"string"}},{"name":"id","in":"path","description":"Artifact id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateArtifactRequest"}}},"required":true},"responses":{"200":{"description":"Artifact updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["artifacts"],"operationId":"artifact_delete","parameters":[{"name":"investigationId","in":"path","description":"Investigation id","required":true,"schema":{"type":"string"}},{"name":"id","in":"path","description":"Artifact id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Artifact deleted"},"404":{"description":"Not found"}}}},"/invitation-tokens/{invitation}/lookups":{"post":{"tags":["invitations"],"operationId":"invitation_lookup_by_token","parameters":[{"name":"invitation","in":"path","description":"Invitation locator `.`. NOT a credential — the secret rides the body.","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationLookupRequest"}}},"required":true},"responses":{"200":{"description":"Invitation found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvitationLookupResponse"}}}},"403":{"description":"Invitation is no longer valid (uniform anti-enumeration response)"}}}},"/invitation-tokens/{invitation}/redemptions":{"post":{"tags":["invitations"],"operationId":"invitation_redeem","parameters":[{"name":"invitation","in":"path","description":"Invitation locator `.`. NOT a credential — the secret rides the body.","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RedeemInvitationRequest"}}},"required":true},"responses":{"200":{"description":"Invitation redeemed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RedeemedInvitationResponse"}}}},"403":{"description":"Invitation is no longer valid (uniform anti-enumeration response)"}}}},"/invitations":{"get":{"tags":["invitations"],"operationId":"invitation_list","responses":{"200":{"description":"Invitation list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_InvitationResponse"}}}},"403":{"description":"Caller is not an org admin / owner"}}},"post":{"tags":["invitations"],"operationId":"invitation_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateInvitationRequest"}}},"required":true},"responses":{"201":{"description":"Invitation created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreatedInvitationResponse"}}}},"400":{"description":"Validation error"},"403":{"description":"Caller is not an org admin / owner"}}}},"/invitations/bulk":{"post":{"tags":["invitations"],"summary":"`POST /invitations/bulk` — bulk invitation import.","description":"Iterates rows independently. Each row goes through the same\nper-row checks the single-create endpoint runs (email validation,\npolicy, role, team existence, throttle); per-row outcomes ride back\nin `BulkCreateInvitationResponse.results` so the admin sees partial\nsuccess without scraping the audit log.\n\nAnti-enumeration doesn't constrain this surface — the\nendpoint requires admin auth on the calling org, so per-row\noutcomes don't leak across tenants.","operationId":"invitation_create_bulk","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkCreateInvitationRequest"}}},"required":true},"responses":{"200":{"description":"Multi-status; per-row outcomes inside body","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkCreateInvitationResponse"}}}},"400":{"description":"Empty rows or above BULK_MAX_ROWS"},"403":{"description":"Caller is not an org admin / owner"}}}},"/invitations/{id}":{"delete":{"tags":["invitations"],"operationId":"invitation_cancel","parameters":[{"name":"id","in":"path","description":"Invitation id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Invitation cancelled"},"404":{"description":"Not found"},"409":{"description":"Invitation is no longer pending"}}}},"/org-exports":{"get":{"tags":["exports"],"summary":"`GET /org-exports` — list all data exports for the org.","operationId":"org_export_list","responses":{"200":{"description":"Export list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_OrgExportResponse"}}}}}},"post":{"tags":["exports"],"summary":"`POST /org-exports` — create a data export.","operationId":"org_export_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateOrgExportRequest"}}},"required":true},"responses":{"201":{"description":"Export created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrgExportResponse"}}}}}}},"/org-exports/estimates":{"post":{"tags":["exports"],"summary":"`POST /org-exports/estimates` — estimate the size, cost, and duration of\nan export before the customer commits to it.","description":"Real estimation requires walking the org's iceberg manifests; until\nthat pipeline lands, the handler reflects the request shape back\nwith zeroed numerics so the UI has a real-typed payload to render\nagainst. The breakdown carries per-table rows even when empty so\nthe UI's table picker doesn't need a separate \"no estimate yet\" path.","operationId":"org_export_estimate","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EstimateExportRequest"}}},"required":true},"responses":{"200":{"description":"Estimate","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportEstimateResponse"}}}}}}},"/org-exports/{id}":{"get":{"tags":["exports"],"summary":"`GET /org-exports/{id}` — fetch a single export.","operationId":"org_export_get","parameters":[{"name":"id","in":"path","description":"Export id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Export found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrgExportResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["exports"],"summary":"`DELETE /org-exports/{id}` — cancel an export.","operationId":"org_export_delete","parameters":[{"name":"id","in":"path","description":"Export id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Export cancelled"},"404":{"description":"Not found"}}}},"/organizations":{"get":{"tags":["organizations"],"summary":"`GET /organizations` — list organisations visible to the caller.","operationId":"organization_list","responses":{"200":{"description":"Organization list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_OrganizationResponse"}}}}}}},"/organizations/{id}":{"get":{"tags":["organizations"],"summary":"`GET /organizations/{id}` — fetch a single organisation.","operationId":"organization_get","parameters":[{"name":"id","in":"path","description":"Organization id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Organization found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["organizations"],"summary":"`PUT /organizations/{id}` — update an organisation. Slug + plan-tier\nchanges are permitted; `data_lake_bucket` is system-managed and\nremains untouched by this endpoint.","operationId":"organization_update","parameters":[{"name":"id","in":"path","description":"Organization id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateOrganizationRequest"}}},"required":true},"responses":{"200":{"description":"Organization updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrganizationResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["organizations"],"summary":"`DELETE /organizations/{id}` — request de-boarding of the org(closes).\nAdmin of the org only, and the path id must match the caller's own org.","description":"**Records the request; it tears nothing down.** The org row is flipped to\n`deleting` and the request is raised to an operator, who completes it out of\nband. Nothing branches on that marker, so **the org keeps serving** until\nthey do. Teardown deletes the account's own stack and returns the account to\nthe pool (ADR-0043 churn), which only the management plane can do, so no\ntenant request runs it. `202` is accepted-for-processing, not\nscheduled.","operationId":"organization_delete","parameters":[{"name":"id","in":"path","description":"Organization id","required":true,"schema":{"type":"string"}}],"responses":{"202":{"description":"De-board requested and recorded for an operator to complete; the org keeps serving until then"}}}},"/queries":{"get":{"tags":["queries"],"summary":"`GET /queries` — list queries for the org.","operationId":"query_list","parameters":[{"name":"source","in":"query","description":"Filter by source","required":false,"schema":{"type":"string"}},{"name":"status","in":"query","description":"Filter by status","required":false,"schema":{"type":"string"}},{"name":"artifactId","in":"query","description":"Filter by artifact id","required":false,"schema":{"type":"string"}},{"name":"ruleId","in":"query","description":"Filter by rule id","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Query list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_QueryResponse"}}}}}},"post":{"tags":["queries"],"summary":"`POST /queries` — submit a new query for execution. Returns the\nunified `QueryResponse` shape every other query endpoint emits.","description":"The body is the **same [`QueryText`] `POST /queries/compile` takes**\n(ADR-0058 §5), so text that compiled is text that submits.\n\n⚠️ **A refused compile is a 400 here, where compile answers 200.** Compile\nwas asked whether the text is valid and said; this was asked to *run* the\nquery and did not. The body carries the same `diagnostics` array, and an\nunknown `vfql_version` is a 400 with no `diagnostics` key at all (R6).","operationId":"query_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SubmitQueryRequest"}}},"required":true},"responses":{"201":{"description":"Query submitted","content":{"application/json":{"schema":{"$ref":"#/components/schemas/QueryResponse"}}}},"400":{"description":"VFQL diagnostics, an unknown grammar version, or an unsupported statement shape"}}}},"/queries/compile":{"post":{"tags":["queries"],"summary":"`POST /queries/compile` — compile VFQL and return the SQL or the diagnostics.","description":"**Creates nothing** (R4): no run, no scheduler dispatch, no credit movement.\n\nA refused compile is a **200** carrying `diagnostics` and no `sql` — the\nrequest asked \"is this valid, and where is it wrong?\" and got its answer. The\n**400** is for an unknown `vfql_version`, which is a fact about the request\nwith no place in the text to point at, and it carries no `diagnostics` key at\nall (R6).\n\n⚠️ **No `?as_admin=` parameter, unlike every other route in this cluster.**\nThis endpoint's job is to report catalog facts back to the caller, so an\noverride here would be an unaudited catalog-disclosure surface; the catalog\nis always computed for the acting team with no admin clause\n(`vigilfield_query::compile_query_for`).","operationId":"query_compile","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/QueryText"}}},"required":true},"responses":{"200":{"description":"Compiled, or refused with diagnostics","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompileQueryResponse"}}}},"400":{"description":"Unknown VFQL grammar version"}}}},"/queries/{id}":{"get":{"tags":["queries"],"summary":"`GET /queries/{id}` — fetch a query's lifecycle state. Returns the\nunified `QueryResponse` shape.","operationId":"query_get","parameters":[{"name":"id","in":"path","description":"Query id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Query found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/QueryResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["queries"],"summary":"`DELETE /queries/{id}` — cancel a running query.","operationId":"query_delete","parameters":[{"name":"id","in":"path","description":"Query id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Query cancelled"},"404":{"description":"Not found"}}}},"/queries/{id}/results":{"get":{"tags":["queries"],"summary":"`GET /queries/{id}/results` — fetch query result rows.","operationId":"query_get_results","parameters":[{"name":"id","in":"path","description":"Query id","required":true,"schema":{"type":"string"}},{"name":"page","in":"query","description":"Zero-based page index (default 0)","required":false,"schema":{"type":"integer","format":"int32","minimum":0}},{"name":"pageSize","in":"query","description":"Rows per page (default 100, max 1000)","required":false,"schema":{"type":"integer","format":"int32","minimum":0}}],"responses":{"200":{"description":"Query results","content":{"application/json":{"schema":{"$ref":"#/components/schemas/QueryResultsResponse"}}}}}}},"/rules":{"get":{"tags":["rules"],"summary":"`GET /rules` — list all rules in the org.","operationId":"rule_list","responses":{"200":{"description":"Rule list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_RuleResponse"}}}}}},"post":{"tags":["rules"],"summary":"`POST /rules` — create a rule.","operationId":"rule_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateRuleRequest"}}},"required":true},"responses":{"201":{"description":"Rule created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleResponse"}}}},"400":{"description":"Validation error"}}}},"/rules/{id}":{"get":{"tags":["rules"],"summary":"`GET /rules/{id}` — fetch a single rule.","operationId":"rule_get","parameters":[{"name":"id","in":"path","description":"Rule id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Rule found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["rules"],"summary":"`PUT /rules/{id}` — replace a rule's fields.","operationId":"rule_update","parameters":[{"name":"id","in":"path","description":"Rule id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateRuleRequest"}}},"required":true},"responses":{"200":{"description":"Rule updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["rules"],"summary":"`DELETE /rules/{id}` — remove a rule.","operationId":"rule_delete","parameters":[{"name":"id","in":"path","description":"Rule id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Rule deleted"},"404":{"description":"Not found"}}},"patch":{"tags":["rules"],"summary":"`PATCH /rules/{id}` — partially update a rule.","operationId":"rule_patch","parameters":[{"name":"id","in":"path","description":"Rule id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PatchRuleRequest"}}},"required":true},"responses":{"200":{"description":"Rule patched","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleResponse"}}}},"404":{"description":"Not found"}}}},"/rules/{id}/copies":{"post":{"tags":["rules"],"summary":"`POST /rules/{id}/copies` — duplicate a rule.","operationId":"rule_duplicate","parameters":[{"name":"id","in":"path","description":"Rule id","required":true,"schema":{"type":"string"}}],"responses":{"201":{"description":"Rule duplicated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleResponse"}}}},"404":{"description":"Not found"}}}},"/rules/{id}/runs":{"get":{"tags":["rules"],"summary":"`GET /rules/{id}/runs` — list runs for a rule.","operationId":"rule_list_runs","parameters":[{"name":"id","in":"path","description":"Rule id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Rule run list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_RuleRunResponse"}}}},"404":{"description":"Not found"}}},"post":{"tags":["rules"],"summary":"`POST /rules/{id}/runs` — trigger a rule run.","operationId":"rule_create_run","parameters":[{"name":"id","in":"path","description":"Rule id","required":true,"schema":{"type":"string"}}],"responses":{"202":{"description":"Rule run accepted","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RuleRunResponse"}}}},"404":{"description":"Not found"}}}},"/scim/v2/Groups":{"get":{"tags":["scim"],"summary":"SCIM `GET /Groups` — list groups this IdP provisioned. Filter\nsubset: `displayName eq` and `externalId eq`.","operationId":"scim_group_list","parameters":[{"name":"filter","in":"query","description":"SCIM filter (displayName eq / externalId eq)","required":false,"schema":{"type":"string"}},{"name":"startIndex","in":"query","description":"1-indexed pagination start","required":false,"schema":{"type":"integer","minimum":0}},{"name":"count","in":"query","description":"Page size","required":false,"schema":{"type":"integer","minimum":0}}],"responses":{"200":{"description":"ListResponse (RFC 7644 §3.4.2)","content":{"application/json":{"schema":{}}}},"400":{"description":"Unsupported filter"},"401":{"description":"Missing or invalid bearer token"}}},"post":{"tags":["scim"],"summary":"SCIM `POST /Groups` — materialises a SCIM Group as a `TeamItem`\nwith `source = \"scim\"` + `external_idp_id = `.","operationId":"scim_group_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimGroupBody"}}},"required":true},"responses":{"201":{"description":"Group provisioned","content":{"application/json":{"schema":{}}}},"400":{"description":"Missing displayName or malformed members"},"401":{"description":"Missing or invalid bearer token"}}}},"/scim/v2/Groups/{id}":{"get":{"tags":["scim"],"summary":"SCIM `GET /Groups/{id}` — returns the group only if this IdP owns it.","operationId":"scim_group_get","parameters":[{"name":"id","in":"path","description":"Vigilfield team id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Group","content":{"application/json":{"schema":{}}}},"401":{"description":"Missing or invalid bearer token"},"404":{"description":"Group not found or not owned by this IdP"}}},"delete":{"tags":["scim"],"summary":"SCIM `DELETE /Groups/{id}` — hard-deletes the team row. Group\nrows don't carry historical state we need to retain, so deletion\nis fine; users keep their other team memberships.","operationId":"scim_group_delete","parameters":[{"name":"id","in":"path","description":"Vigilfield team id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Group deleted"},"401":{"description":"Missing or invalid bearer token"},"404":{"description":"Group not found or not owned by this IdP"}}},"patch":{"tags":["scim"],"summary":"SCIM `PATCH /Groups/{id}` — accepts the common Okta + Entra\npatterns: replace displayName, replace/add/remove members.","operationId":"scim_group_patch","parameters":[{"name":"id","in":"path","description":"Vigilfield team id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimGroupPatchOp"}}},"required":true},"responses":{"200":{"description":"Updated group","content":{"application/json":{"schema":{}}}},"400":{"description":"Unsupported PATCH op or path"},"401":{"description":"Missing or invalid bearer token"},"404":{"description":"Group not found or not owned by this IdP"}}}},"/scim/v2/ResourceTypes":{"get":{"tags":["scim"],"summary":"`GET /scim/v2/ResourceTypes` — RFC 7644 §4 listing of resource\ntypes the server exposes (Users + Groups). Unauthenticated.","operationId":"scim_resource_types","responses":{"200":{"description":"SCIM resource type list (RFC 7644 §4)","content":{"application/json":{"schema":{}}}}}}},"/scim/v2/Schemas":{"get":{"tags":["scim"],"summary":"`GET /scim/v2/Schemas` — RFC 7644 §4 listing of schemas the server\nsupports. Unauthenticated.","operationId":"scim_schemas","responses":{"200":{"description":"SCIM schema list (RFC 7644 §4)","content":{"application/json":{"schema":{}}}}}}},"/scim/v2/ServiceProviderConfig":{"get":{"tags":["scim"],"summary":"`GET /scim/v2/ServiceProviderConfig` — RFC 7644 §4 discovery\ndocument describing what this SCIM server supports (filter\noperators, auth schemes, bulk/patch/etag policy). Unauthenticated.","description":"The response body is JSON-typed-as-`Value` rather than a Rust\nstruct: RFC 7644 is the authoritative schema for SCIM clients, and\nduplicating it as utoipa structs would only invite drift. The\nannotation here covers the endpoint surface for SDK / CLI\nconsumers; the body shape is RFC 7644.","operationId":"scim_service_provider_config","responses":{"200":{"description":"SCIM ServiceProviderConfig (RFC 7644 §4)","content":{"application/json":{"schema":{}}}}}}},"/scim/v2/Users":{"get":{"tags":["scim"],"summary":"SCIM `GET /Users` — list users this IdP provisioned. Supports the\neq-only filter subset (see `scim::filter`).","operationId":"scim_user_list","parameters":[{"name":"filter","in":"query","description":"SCIM filter (userName eq / externalId eq / emails[type eq \"work\"].value eq)","required":false,"schema":{"type":"string"}},{"name":"startIndex","in":"query","description":"1-indexed pagination start","required":false,"schema":{"type":"integer","minimum":0}},{"name":"count","in":"query","description":"Page size","required":false,"schema":{"type":"integer","minimum":0}}],"responses":{"200":{"description":"ListResponse (RFC 7644 §3.4.2)","content":{"application/json":{"schema":{}}}},"400":{"description":"Unsupported filter"},"401":{"description":"Missing or invalid bearer token"}}},"post":{"tags":["scim"],"summary":"SCIM `POST /Users` — JIT-provisions a `UserItem` tagged with\n`provisionedBy = `. Email domain must be on the IdpRecord's\nbound domains.","operationId":"scim_user_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimUserBody"}}},"required":true},"responses":{"201":{"description":"User provisioned","content":{"application/json":{"schema":{}}}},"400":{"description":"Email domain not bound or payload invalid"},"401":{"description":"Missing or invalid bearer token"}}}},"/scim/v2/Users/{id}":{"get":{"tags":["scim"],"summary":"SCIM `GET /Users/{id}` — returns the user only if this IdP owns it.","operationId":"scim_user_get","parameters":[{"name":"id","in":"path","description":"Vigilfield user id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"User","content":{"application/json":{"schema":{}}}},"401":{"description":"Missing or invalid bearer token"},"404":{"description":"User not found or not owned by this IdP"}}},"delete":{"tags":["scim"],"summary":"SCIM `DELETE /Users/{id}` — soft-delete via `status = inactive`.\nRow is kept for audit; session revocation hangs off #317.","operationId":"scim_user_delete","parameters":[{"name":"id","in":"path","description":"Vigilfield user id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"User deprovisioned"},"401":{"description":"Missing or invalid bearer token"},"404":{"description":"User not found or not owned by this IdP"}}},"patch":{"tags":["scim"],"summary":"SCIM `PATCH /Users/{id}` — accepts `op = replace` / `add` on\n`active` and `displayName`. Wider RFC 7644 §3.5.2 path expressions\nare out of scope.","operationId":"scim_user_patch","parameters":[{"name":"id","in":"path","description":"Vigilfield user id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ScimUserPatchOp"}}},"required":true},"responses":{"200":{"description":"Updated user","content":{"application/json":{"schema":{}}}},"400":{"description":"Unsupported PATCH op or path"},"401":{"description":"Missing or invalid bearer token"},"404":{"description":"User not found or not owned by this IdP"}}}},"/sources":{"get":{"tags":["sources"],"operationId":"source_list","responses":{"200":{"description":"Source list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_SourceResponse"}}}}}},"post":{"tags":["sources"],"operationId":"source_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSourceRequest"}}},"required":true},"responses":{"201":{"description":"Source created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourceResponse"}}}},"400":{"description":"Validation error — including VFQL diagnostics, an unknown grammar version, or an unsupported statement shape"},"409":{"description":"Name conflict"}}}},"/sources/{id}":{"get":{"tags":["sources"],"operationId":"source_get","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Source found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourceResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["sources"],"operationId":"source_update","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateSourceRequest"}}},"required":true},"responses":{"200":{"description":"Source updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourceResponse"}}}},"400":{"description":"Validation error — including VFQL diagnostics, an unknown grammar version, or an unsupported statement shape"},"404":{"description":"Not found"}}},"delete":{"tags":["sources"],"operationId":"source_delete","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Source deleted"},"404":{"description":"Not found"}}}},"/sources/{id}/attach":{"post":{"tags":["sources"],"operationId":"source_attach","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AttachSourceBody"}}},"required":true},"responses":{"200":{"description":"Source attached (enabled)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourceResponse"}}}},"404":{"description":"Source or table not found"},"409":{"description":"Already attached elsewhere, or the table is not source-fed"}}}},"/sources/{id}/detach":{"post":{"tags":["sources"],"operationId":"source_detach","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Source detached (disabled)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourceResponse"}}}},"404":{"description":"Not found"}}}},"/sources/{id}/eventbridge-setup":{"get":{"tags":["sources"],"operationId":"source_get_eventbridge_setup","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"EventBridge rule snippet","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventBridgeSetupResponse"}}}},"400":{"description":"Not an EventBridge source"}}}},"/sources/{id}/freshness":{"get":{"tags":["sources"],"operationId":"source_freshness","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Freshness indicator","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FreshnessResponse"}}}},"404":{"description":"Not found / not a CloudWatchLogs source"}}}},"/sources/{id}/iam-template":{"get":{"tags":["sources"],"operationId":"source_get_iam_template","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Role template (trust, permissions, CloudFormation)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RoleTemplateResponse"}}}},"400":{"description":"The source reads with no role in your AWS account"},"404":{"description":"Source not found"},"503":{"description":"Federation issuer not configured"}}}},"/sources/{id}/metrics":{"get":{"tags":["sources"],"operationId":"source_metrics","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}},{"name":"from","in":"query","description":"Range start (RFC3339, inclusive)","required":true,"schema":{"type":"string"}},{"name":"to","in":"query","description":"Range end (RFC3339, inclusive)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ingestion metric series","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourceMetricsResponse"}}}},"404":{"description":"Not found"}}}},"/sources/{id}/replay":{"post":{"tags":["sources"],"operationId":"source_replay","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReplayRequest"}}},"required":true},"responses":{"200":{"description":"Replay windows enqueued","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReplayResponse"}}}},"400":{"description":"Invalid range / not a CloudWatchLogs source"}}}},"/sources/{id}/template-upgrade":{"get":{"tags":["sources"],"operationId":"source_get_upgrade","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Upgrade availability + diff","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TemplateUpgradeAvailability"}}}},"400":{"description":"Source has no template"}}},"post":{"tags":["sources"],"operationId":"source_apply_upgrade","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplyUpgradeRequest"}}}},"responses":{"200":{"description":"Upgrade applied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourceResponse"}}}},"409":{"description":"Already at the requested version"}}}},"/sources/{id}/verifications":{"post":{"tags":["sources"],"operationId":"source_verify","parameters":[{"name":"id","in":"path","description":"Source id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Verified (or already active)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SourceVerificationResponse"}}}},"400":{"description":"The source reads with no role in your AWS account"},"404":{"description":"Source not found"},"409":{"description":"Verify failed with a named customer-side reason","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerificationFailureBody"}}}},"503":{"description":"A fault of ours, or the request budget ran out"}}}},"/storage-key":{"get":{"tags":["storage-key"],"summary":"`GET /storage-key` — the org's storage key, or 404 when unset (the org then\nuses its Vigilfield-owned per-org default key).","operationId":"storage_key_get","responses":{"200":{"description":"Org storage key","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StorageKeyResponse"}}}},"404":{"description":"No storage key set (uses the Vigilfield default key)"}}},"put":{"tags":["storage-key"],"summary":"`PUT /storage-key` — set or replace the org's storage key.","operationId":"storage_key_set","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetStorageKeyRequest"}}},"required":true},"responses":{"200":{"description":"Storage key set","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StorageKeyResponse"}}}},"400":{"description":"Invalid key ARN"},"403":{"description":"Admin only"}}},"delete":{"tags":["storage-key"],"summary":"`DELETE /storage-key` — clear the org's storage key (reverts to the\nVigilfield-owned per-org default key).","operationId":"storage_key_clear","responses":{"204":{"description":"Storage key cleared"},"403":{"description":"Admin only"}}}},"/storage-key/iam-template":{"get":{"tags":["storage-key"],"summary":"`GET /storage-key/iam-template` — the four ADR-0066 deployment artifacts\n(role template, key-policy statement in two forms, OIDC snippet), rendered\nfor the requested account. A pure read: no storage-key row, no AWS call.\nAdmin gating stays in the logic layer, like every sibling here.","operationId":"storage_key_iam_template_get","parameters":[{"name":"account_id","in":"query","description":"The customer's 12-digit AWS account id to render the artifacts for","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The deployment artifacts","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StorageKeyIamTemplateResponse"}}}},"400":{"description":"account_id is not a 12-digit AWS account id"},"403":{"description":"Admin only"},"503":{"description":"Federation issuer not configured"}}}},"/tables":{"get":{"tags":["tables"],"summary":"⚠️ The parameter is spelled **inline** rather than by deriving `ToSchema` on\n`ListTablesQuery`: a query struct no body or component reference names would\nadd an orphan schema to `openapi.json`. Same shape as `routes/grant.rs`.","operationId":"table_list","parameters":[{"name":"include_query_results","in":"query","description":"Include query-result tables in the list","required":false,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"Table list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_TableResponse"}}}}}},"post":{"tags":["tables"],"operationId":"table_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateTableRequest"}}},"required":true},"responses":{"201":{"description":"Table created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TableResponse"}}}},"400":{"description":"Validation error"},"409":{"description":"Template version conflict"}}}},"/tables/{id}":{"get":{"tags":["tables"],"operationId":"table_get","parameters":[{"name":"id","in":"path","description":"Table id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Table found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TableResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["tables"],"operationId":"table_update","parameters":[{"name":"id","in":"path","description":"Table id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateTableRequest"}}},"required":true},"responses":{"200":{"description":"Table updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TableResponse"}}}},"400":{"description":"Validation error"},"404":{"description":"Not found"}}},"delete":{"tags":["tables"],"operationId":"table_delete","parameters":[{"name":"id","in":"path","description":"Table id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Table deleted"},"404":{"description":"Not found"}}}},"/tables/{id}/versions":{"get":{"tags":["tables"],"operationId":"table_versions","parameters":[{"name":"id","in":"path","description":"Table id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Lookup-table versions, newest first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TableVersionsResponse"}}}},"400":{"description":"Table is not a lookup table"},"404":{"description":"Not found"}}}},"/teams":{"get":{"tags":["teams"],"summary":"`GET /teams` — list all teams in the org.","operationId":"team_list","responses":{"200":{"description":"Team list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_TeamResponse"}}}}}},"post":{"tags":["teams"],"summary":"`POST /teams` — create a team.","operationId":"team_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateTeamRequest"}}},"required":true},"responses":{"201":{"description":"Team created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamResponse"}}}}}}},"/teams/{id}":{"get":{"tags":["teams"],"summary":"`GET /teams/{id}` — fetch a single team.","operationId":"team_get","parameters":[{"name":"id","in":"path","description":"Team id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Team found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["teams"],"summary":"`PUT /teams/{id}` — update a team.","operationId":"team_update","parameters":[{"name":"id","in":"path","description":"Team id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateTeamRequest"}}},"required":true},"responses":{"200":{"description":"Team updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["teams"],"summary":"`DELETE /teams/{id}` — remove a team.","operationId":"team_delete","parameters":[{"name":"id","in":"path","description":"Team id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"Team deleted"},"404":{"description":"Not found"}}}},"/teams/{id}/users":{"post":{"tags":["teams"],"summary":"`POST /teams/{id}/users` — add a user to a team.","operationId":"team_add_user","parameters":[{"name":"id","in":"path","description":"Team id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AddTeamUserRequest"}}},"required":true},"responses":{"201":{"description":"User added to team","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamResponse"}}}},"404":{"description":"Not found"}}}},"/teams/{id}/users/{userId}":{"delete":{"tags":["teams"],"summary":"`DELETE /teams/{id}/users/{userId}` — remove a user from a team.","operationId":"team_remove_user","parameters":[{"name":"id","in":"path","description":"Team id","required":true,"schema":{"type":"string"}},{"name":"userId","in":"path","description":"User id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"User removed from team"},"404":{"description":"Not found"}}}},"/templates":{"get":{"tags":["templates"],"summary":"`GET /templates` — list all built-in templates in registry order.\nAuthenticated (any valid session) but **scope-free**: the static built-in\ncatalog carries no tenant data, so it takes `AuthContext` to require a login\nand performs no grant/scope check.","operationId":"template_list","responses":{"200":{"description":"Registered built-in templates","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/TemplateResponse"}}}}}}}},"/templates/{id}":{"get":{"tags":["templates"],"summary":"`GET /templates/{id}` — fetch one template by id. 404 on unknown.","operationId":"template_get","parameters":[{"name":"id","in":"path","description":"Template id, e.g. `CloudTrail`, `Custom`","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Template found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TemplateResponse"}}}},"404":{"description":"Unknown template id"}}}},"/users":{"get":{"tags":["users"],"summary":"`GET /users` — list all users in the org.","operationId":"user_list","responses":{"200":{"description":"User list","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedResponse_UserResponse"}}}}}},"post":{"tags":["users"],"summary":"`POST /users` — create a user in the org.","operationId":"user_create","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateUserRequest"}}},"required":true},"responses":{"201":{"description":"User created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserResponse"}}}},"400":{"description":"Validation error"}}}},"/users/me":{"get":{"tags":["users"],"summary":"`GET /users/me` — the authenticated caller's own row.","description":"The **one** authenticated route that does not require a valid\n`x-vf-team-id` ([`SelfAuthContext`]). The client derives its acting\nteam from the `team_ids` this returns, so requiring an acting team to ask\nwould be unsatisfiable — and every other route that could report memberships\nis gated on the very header that is wrong when the client needs to\nreconcile.\n\n⚠️ The id is `auth.user_id`, the signature-verified `sub`. There is no\ncaller-supplied id here and there must never be one: the acting-team check\nthis route skips is what scopes a request to a team.","operationId":"user_get_self","responses":{"200":{"description":"The authenticated caller","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserResponse"}}}},"404":{"description":"Not found"}}}},"/users/{id}":{"get":{"tags":["users"],"summary":"`GET /users/{id}` — fetch a single user.","operationId":"user_get","parameters":[{"name":"id","in":"path","description":"User id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"User found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserResponse"}}}},"404":{"description":"Not found"}}},"put":{"tags":["users"],"summary":"`PUT /users/{id}` — replace a user's fields.","operationId":"user_update","parameters":[{"name":"id","in":"path","description":"User id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateUserRequest"}}},"required":true},"responses":{"200":{"description":"User updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserResponse"}}}},"404":{"description":"Not found"}}},"delete":{"tags":["users"],"summary":"`DELETE /users/{id}` — remove a user from the org.","operationId":"user_delete","parameters":[{"name":"id","in":"path","description":"User id","required":true,"schema":{"type":"string"}}],"responses":{"204":{"description":"User deleted"},"404":{"description":"Not found"}}},"patch":{"tags":["users"],"summary":"`PATCH /users/{id}` — partially update a user.","operationId":"user_patch","parameters":[{"name":"id","in":"path","description":"User id","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PatchUserRequest"}}},"required":true},"responses":{"200":{"description":"User patched","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserResponse"}}}},"404":{"description":"Not found"}}}},"/users/{id}/mfa-resets":{"post":{"tags":["account"],"summary":"`POST /users/{id}/mfa-resets` — admin recovery for a native user who lost\ntheir second factor (`rh-kk6vbu`). Authz and target rules are\n`/users/{id}/password-resets`': admin only, 404 outside the caller's org,\n400 for a federated or app target.","description":"Turns the user's TOTP off in Cognito and marks the row\n`mfa_reset_pending`. From that moment a passkey sign-in is refused; the\nuser's next password sign-in deletes their passkeys and security keys\n(Cognito has no admin API for that) and asks them to set a factor up again.","operationId":"account_admin_reset_mfa","parameters":[{"name":"id","in":"path","description":"Target user id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"MFA reset; completes at the user's next password sign-in","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminMfaResetResponse"}}}},"400":{"description":"Target is a federated or app user"},"403":{"description":"Caller is not an admin"},"404":{"description":"Target user not found in caller's org"}}}},"/users/{id}/ownership-transfers":{"post":{"tags":["users"],"summary":"`POST /users/{id}/ownership-transfers` — transfer org ownership to this user.","operationId":"user_transfer_ownership","parameters":[{"name":"id","in":"path","description":"User id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ownership transferred","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserResponse"}}}},"404":{"description":"Not found"}}}},"/users/{id}/password-resets":{"post":{"tags":["account"],"summary":"`POST /users/{id}/password-resets` — admin-initiated password reset.","description":"$cc","operationId":"account_admin_reset_password","parameters":[{"name":"id","in":"path","description":"Target user id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Reset initiated; setup email sent","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdminPasswordResetResponse"}}}},"400":{"description":"Target is a federated or app user"},"403":{"description":"Caller is not an admin"},"404":{"description":"Target user not found in caller's org"}}}}},"components":{"schemas":{"AccountIamTemplate":{"type":"object","description":"One account's documents. `identity_provider_included` is false when some\nsource of the org has already verified in this account (the\nper-resource responses' `identity_provider_known`, once per account) — the\nprovider resource is then already deployed and the document omits it.","required":["account_id","identity_provider_included","cloudformation_yaml","terraform_hcl","roles"],"properties":{"account_id":{"type":"string"},"cloudformation_yaml":{"type":"string"},"identity_provider_included":{"type":"boolean"},"roles":{"type":"array","items":{"$ref":"#/components/schemas/BulkRoleEntry"}},"terraform_hcl":{"type":"string"}}},"AddTeamUserRequest":{"type":"object","required":["user_id"],"properties":{"user_id":{"type":"string"}}},"AdminMfaResetResponse":{"type":"object","description":"Response body for `POST /users/{id}/mfa-resets`. Nothing is sent to the\nuser: the reset completes at their next password sign-in, which asks them to\nset a factor up again.","required":["user_id","reset_at"],"properties":{"reset_at":{"type":"string"},"user_id":{"type":"string"}}},"AdminPasswordResetResponse":{"type":"object","description":"Response body for `POST /users/{id}/password-resets`.\nReturned to the admin caller after a successful invalidate +\nsetup-email send. The plaintext is never returned — it's emailed\nto the user directly. The `sentTo` field echoes the target email\nso the admin can confirm they reset the right account.","required":["user_id","sent_to","reset_at"],"properties":{"reset_at":{"type":"string"},"sent_to":{"type":"string"},"user_id":{"type":"string"}}},"AlertDestinationIamTemplateResponse":{"type":"object","description":"`GET /alert-destinations/{id}/iam-template` — the derived role's template,\nmirroring the source route's `RoleTemplateResponse` field for field (the\napp-side mental model carries over). Webhook destinations: 400 (G-6).","required":["role_arn","account_id","region","token_subject","federation_issuer","trust_policy","permissions_policy","cloudformation_yaml","oidc_provider_cloudformation_yaml","identity_provider_known"],"properties":{"account_id":{"type":"string"},"cloudformation_yaml":{"type":"string"},"federation_issuer":{"type":"string"},"identity_provider_known":{"type":"boolean"},"oidc_provider_cloudformation_yaml":{"type":"string"},"permissions_policy":{"type":"string"},"region":{"type":"string"},"role_arn":{"type":"string"},"token_subject":{"type":"string"},"trust_policy":{"type":"string"}}},"AlertDestinationResponse":{"type":"object","description":"`GET /alert-destinations` item / `POST` / `PUT` response. The webhook\nvariant carries the `url` and no secret field at all.","required":["org_id","id","kind","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"id":{"type":"string"},"kind":{"$ref":"#/components/schemas/DestinationKindInput"},"org_id":{"type":"string"},"owner_team_id":{"type":["string","null"]},"sns":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SnsDestinationResponse"}]},"updated_at":{"type":"string"},"webhook":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/WebhookDestinationResponse"}]}}},"AlertDestinationVerificationResponse":{"type":"object","description":"`POST /alert-destinations/{id}/verifications` body — the typed outcome.\n`ok` is true for `Published` / `Delivered`; on a failure `reason` is the\nmachine-readable code (STS refusal code, egress variant name,\n`http_`) and `message` the customer-facing string around it.","required":["destination_id","ok","outcome"],"properties":{"destination_id":{"type":"string"},"message":{"type":["string","null"]},"ok":{"type":"boolean"},"outcome":{"type":"string"},"reason":{"type":["string","null"]}}},"AlertListResponse":{"type":"object","description":"A page of alerts. No total: a page may hold fewer than `limit` alerts, even\nnone, while `next_cursor` is set.","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/AlertResponse"}},"next_cursor":{"type":["string","null"],"description":"Follow it until it is null. Opaque, and good only for the caller it was\nissued to."}}},"AlertResponse":{"type":"object","description":"One alert, as a caller who may see it reads it.","required":["id","origin","source","key","title","description","severity","status","first_seen","last_seen","hit_count","latest_row"],"properties":{"delivery_failed":{"type":["array","null"],"items":{"type":"string"},"description":"The destination ids whose delivery exhausted its attempts (ADR-0067\n§4) — a delivery that will never land. `None` while none have."},"description":{"type":"string"},"first_seen":{"type":"string","description":"RFC 3339, milliseconds."},"hit_count":{"type":"integer","format":"int64","minimum":0},"id":{"type":"string"},"key":{"type":"string"},"last_seen":{"type":"string"},"latest_row":{"description":"The latest matching row, or `{\"vf_row_omitted\":{\"size_bytes\":n}}` when\nit was over 32 KiB."},"origin":{"type":"string","description":"`rule:` or `system:` — the same field as ADR-0067 §4's\ndelivery payload."},"severity":{"$ref":"#/components/schemas/AlertSeverity"},"source":{"$ref":"#/components/schemas/AlertSourceResponse"},"status":{"$ref":"#/components/schemas/AlertStatus"},"title":{"type":"string"}}},"AlertSeverity":{"type":"string","description":"Declaration order is severity order (`Ord`).\n\n⚠️ **Published as `AlertSeverity`** (rh-sshb3s). The `as` rename is kept\neven though the colliding notification `Severity` component is gone\n(rh-rde2vd.6 DB-4): the wire name is stable, and re-claiming the bare\n`Severity` component name would churn every generated consumer for no\nreader-visible gain.","enum":["informational","low","medium","high","critical"]},"AlertSourceResponse":{"oneOf":[{"type":"object","required":["rule_id","result_table_id","run_id","class"],"properties":{"class":{"type":"string","enum":["rule"]},"result_table_id":{"type":"string","description":"The latest run's result table. It may have expired (result tables\nare kept seven days), or be unreadable to a caller who sees the\nalert through a grant."},"rule_id":{"type":"string"},"run_id":{"type":"string"}}},{"type":"object","required":["kind","class"],"properties":{"class":{"type":"string","enum":["system"]},"kind":{"type":"string","description":"`usage_threshold`, `usage_cap`, `rule_failed` or `source_unhealthy`."}}}],"description":"Where an alert comes from, tagged by `class`."},"AlertStatus":{"type":"string","description":"Where an alert is in its lifecycle. Only forward: see [`transition`].","enum":["open","acknowledged","resolved"]},"AlertTransitionResponse":{"type":"object","description":"What an acknowledge or resolve answers: the id and the resulting status,\nand nothing else — so an audited response body never holds customer text.","required":["id","status"],"properties":{"id":{"type":"string"},"status":{"$ref":"#/components/schemas/AlertStatus"}}},"AppFilter":{"type":"string","description":"Which slice of the visible set `GET /apps` should return\n(ADR-0050 §6).\n\nA **type**, not a string compared in the handler, so the vocabulary is\nclosed and a value outside it cannot fall through to the default. It\n**narrows** the visible set and never widens it: every arm is applied\n*after* `visible_to`, so no filter value can show a caller a row their\ndefault list would not.\n\n⚠️ **There is deliberately no `all`.** With `admin_by_role` inside\n`visible_to`, a governance principal's *default* view already is the\norg-wide roster, so an `all` value plus a `403` gate would be a second\nspelling of a decision the predicate already makes, in a second place, kept\nin sync by hand. It is unrepresentable instead.","enum":["authored","catalog","installed"]},"AppResponse":{"type":"object","description":"Standard read shape — `GET /apps` and\n`GET /apps/{id}` both return this.","required":["id","name","email","owner_user_id","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"description":{"type":["string","null"]},"email":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"owner_user_id":{"type":"string"},"published":{"type":"boolean","description":"ADR-0050 §6 catalog flag, as persisted. Always serialized, same reason."},"required_permissions":{"type":"array","items":{"type":"string"},"description":"The declared manifest, as persisted. ⚠️ No `skip_serializing_if`,\nunlike the optional fields above: an empty manifest must read back as\n`[]`, never as an absent key — a consent document that can be\nabsent-or-empty is a tri-state nobody wants to interpret."},"role":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserRole"}]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserStatus"}]},"team_ids":{"type":["array","null"],"items":{"type":"string"}},"updated_at":{"type":"string"}}},"ApplyUpgradeMode":{"type":"string","enum":["overwrite","merge"]},"ApplyUpgradeRequest":{"type":"object","description":"Optional body for `POST /sources/{id}/template-upgrade`.","properties":{"mode":{"$ref":"#/components/schemas/ApplyUpgradeMode"},"target_version":{"type":["integer","null"],"format":"int32","minimum":0}}},"ArtifactResponse":{"type":"object","required":["id","org_id","investigation_id","name","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"id":{"type":"string"},"investigation_id":{"type":"string"},"last_query_id":{"type":["string","null"],"description":"FK to the most recent `QueryRunItem` this artifact ran. The\nfrontend looks the row up via `useQueryRunLookup` to surface\nsql, status, error, execution timing, and row count —\nnothing is denormalised onto the artifact row."},"name":{"type":"string"},"org_id":{"type":"string"},"updated_at":{"type":"string"}}},"AttachSourceBody":{"type":"object","description":"`POST /sources/{id}/attach` body.","required":["table_id"],"properties":{"auto_add_extra_columns":{"type":"boolean","description":"C5 (ADR-0022): add each extra source output field to the\ntable as a nullable column instead of dropping it on ingest."},"table_id":{"type":"string","description":"The table this source will feed (must be source-fed — population kind\n`source`)."}}},"AttributeMappings":{"type":"object","description":"Attribute mappings — single shared shape across federation and SCIM.\nAll fields are IdP attribute names; the api applies the mapping at\nJIT-provisioning time (and at SCIM sync time).","properties":{"display_name":{"type":["string","null"]},"email":{"type":["string","null"]},"groups":{"type":["string","null"]},"role":{"type":["string","null"]}}},"AuthConfigResponse":{"type":"object","description":"$cd","properties":{"org_id":{"type":"string","description":"Resolved by the endpoint, never read from the blob.\n\n⚠️ `#[serde(default)]` is load-bearing on the **deserialize** side: the\nstored blob carries no `org_id`, so without it every parse would fail on\nthe missing field, fall to `unwrap_or_default()`, and silently serve an\norg with none of its pool keys — a login page that cannot sign anyone in.\nIt is not `skip_serializing_if`, because the response always carries it."},"region":{"type":["string","null"]},"user_pool_client_id":{"type":["string","null"]},"user_pool_domain":{"type":["string","null"]},"user_pool_id":{"type":["string","null"]}}},"AuthMethods":{"type":"object","required":["password","sso","mfa"],"properties":{"mfa":{"type":"boolean"},"password":{"type":"boolean"},"sso":{"type":"boolean"}}},"AvailabilityQuery":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string"}}},"BillingResponse":{"type":"object","required":["org_id","billing_period","annual_discount_percent","retention_days","gb_ingested_limit","gb_scanned_limit","gb_exported_limit","gb_stored_limit","payment_method_configured","is_trial_active","updated_at"],"properties":{"annual_discount_percent":{"type":"integer","format":"int32","description":"Percent discount applied when on annual billing. Mirrors the\nstored value, falling back to 20 when unset.","minimum":0},"auto_topup_enabled":{"type":"boolean","description":"Auto-top-up. The cell `From` impl leaves these at the defaults\n(`false`/`None`); the Router fills them from the root billing row."},"auto_topup_packs":{"type":["integer","null"],"format":"int64","minimum":0},"auto_topup_threshold_pct":{"type":["integer","null"],"format":"int32","minimum":0},"billing_period":{"type":"string","description":"Defaults to `\"monthly\"` for orgs that have never explicitly set it."},"gb_exported_limit":{"type":"integer","format":"int64","minimum":0},"gb_ingested_limit":{"type":"integer","format":"int64","description":"**Effective** usage limits (decimal GB) the org is enforced against:\nthe per-org override if set, else the `plan_tier` default from\n`plan-defaults.yaml` (`vigilfield_common::effective_limits`). Same\nresolved-value shape as `retention_days`; never uncapped.","minimum":0},"gb_scanned_limit":{"type":"integer","format":"int64","minimum":0},"gb_stored_limit":{"type":"integer","format":"int64","minimum":0},"is_trial_active":{"type":"boolean","description":"Computed from `trial_ends_at` vs `now()`."},"org_id":{"type":"string"},"payment_method_configured":{"type":"boolean","description":"Computed: true when the org has at least one payment method on\nfile. The handler populates this — the From\nimpl alone returns `false`."},"plan_tier":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PlanTier"}]},"retention_days":{"type":"integer","format":"int32","description":"Days of data retained in the lake. Defaults derived from\n`plan_tier` when unset (Startup: 30, SMB: 90, Enterprise: 365).","minimum":0},"stripe_customer_id":{"type":["string","null"]},"trial_ends_at":{"type":["string","null"]},"updated_at":{"type":"string"}}},"BulkCreateInvitationRequest":{"type":"object","description":"Bulk-import request. Up to `BULK_MAX_ROWS` rows per\nrequest — the api fails the entire request with 400 above that.\nEach row is processed independently; per-row outcomes ride back\nin `BulkCreateInvitationResponse.results`.","required":["rows"],"properties":{"rows":{"type":"array","items":{"$ref":"#/components/schemas/CreateInvitationRequest"}}}},"BulkCreateInvitationResponse":{"type":"object","required":["results","summary"],"properties":{"results":{"type":"array","items":{"$ref":"#/components/schemas/BulkInvitationResult"}},"summary":{"$ref":"#/components/schemas/BulkSummary","description":"Convenience counters so the UI doesn't have to re-tally."}}},"BulkIamTemplatesRequest":{"type":"object","description":"`POST /iam-templates` body. The id list defaults empty — that is the\nimplicit selection (every `awaiting_role` source the caller may read); a\nnamed id is rendered in any state.","properties":{"source_ids":{"type":"array","items":{"type":"string"}}}},"BulkIamTemplatesResponse":{"type":"object","description":"`POST /iam-templates` response: one document pair per AWS account, and the\nresources the selection surfaced but did not render (role-less kinds),\neach with its reason — \"where is my source?\" has an answer in the response\nthe customer already holds.","required":["templates","skipped"],"properties":{"skipped":{"type":"array","items":{"$ref":"#/components/schemas/SkippedResource"}},"templates":{"type":"array","items":{"$ref":"#/components/schemas/AccountIamTemplate"}}}},"BulkInvitationOutcome":{"type":"string","description":"Per-row outcome string. Audit-log-compatible (matches the\n`outcome` field in the existing single-create audit shape).","enum":["created","invalid_email","policy_rejected","invalid_role","rate_limited","internal_error","unknown_team","guarded_team"]},"BulkInvitationResult":{"type":"object","required":["email","outcome"],"properties":{"email":{"type":"string","description":"Echo of the row's email so the client can correlate without\nrelying on positional indexing."},"invitation":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/InvitationResponse","description":"Populated when `outcome == Created`. The created row itself — the same\nshape a `GET /invitations` entry has, and it carries neither the\ncredential nor the link."}]},"message":{"type":["string","null"],"description":"Human-readable reason, surfaced to the admin UI. Populated\nfor every non-`created` outcome."},"outcome":{"$ref":"#/components/schemas/BulkInvitationOutcome"},"token":{"type":["string","null"],"description":"Populated when `outcome == Created`. The whole wire token,\n`..` — an opaque DB-backed capability, not a\nsigned one (see `token.rs`).\n\n⚠️ This route sends no email, so the caller delivers the invite itself —\nand must **split** the token rather than put it in a URL. The link is\n`{base}/.#`, where `{base}` is the\ndeployment's invite page (`VIGILFIELD_INVITE_REDEMPTION_BASE_URL`,\ndefault `https://vigilfield.com/invite`). Only the locator may ride the\npath: a browser never sends a fragment to a server, which is what keeps\nthe secret out of access logs and WAF samples.\n\nA link built as `{base}/` fails closed and silently — the invite\npage reads a three-part locator and an empty fragment and renders\n\"Invitation link is missing.\" `POST /invitations` hands back the\nassembled link as `redemption_url`; this route has no such field."}}},"BulkRoleEntry":{"type":"object","description":"One role in an account document — the same fields the per-resource\ntemplate responses carry, with the two policies as JSON strings (the same\nserializations, byte for byte).","required":["kind","id","role_arn","token_subject","trust_policy","permissions_policy"],"properties":{"id":{"type":"string"},"kind":{"type":"string","description":"`source` — the one derived-role kind a bulk document renders today."},"permissions_policy":{"type":"string"},"role_arn":{"type":"string"},"token_subject":{"type":"string"},"trust_policy":{"type":"string"}}},"BulkSummary":{"type":"object","required":["total","created","rejected"],"properties":{"created":{"type":"integer","format":"int32","minimum":0},"rejected":{"type":"integer","format":"int32","minimum":0},"total":{"type":"integer","format":"int32","minimum":0}}},"ChildFetcher":{"type":"object","description":"One entry of a [`Delegation`] map: a VRL expression that extracts the child\nURL(s) from the parent response object, plus the child fetcher's own kind. A\nchild with neither `next_page_expression` nor `delegation` is a **Simple**\nleaf (body → deserializer); with `next_page_expression` it is **Paginating**;\nwith `delegation` it recurses (**Delegating**). The three are mutually\nexclusive on one child.","required":["url_expression"],"properties":{"delegation":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Delegation","description":"Delegating child: recurse with this nested map. `None` ⇒ a leaf. (The\n`Vec` in `Delegation` already breaks the type cycle, so no\n`Box` is needed.) `no_recursion` stops utoipa from inlining the\n`Delegation → ChildFetcher → Delegation` cycle (it emits a `$ref` to the\nregistered component instead) — without it, schema generation overflows."}]},"max_pages":{"type":["integer","null"],"format":"int32","description":"Paginating child page cap (see [`HttpSourceConfig::effective_max_pages`]).","minimum":0},"next_page_expression":{"type":["string","null"],"description":"Paginating child: its own next-page expression, evaluated over the\nchild's response. `None` ⇒ not paginating."},"url_expression":{"type":"string","description":"VRL over the parent response object `{status, reason, headers, body, url}`\n→ the child URL. May return a **string** (one child), an **array of\nstrings** (fan-out to N identical children), or **null**/empty (no\nchild). Relative URLs resolve against the parent response's final `url`."}}},"ClientResponse":{"type":"object","description":"Standard read shape — `GET /clients` + `GET /clients/{id}`. The secret is\nintentionally absent.","required":["client_id","name","installation_id","scopes","created_at","updated_at"],"properties":{"client_id":{"type":"string"},"created_at":{"type":"string"},"installation_id":{"type":"string","description":"The installation this credential belongs to — its authority source.\nThe identity a token minted here acts as is that installation's\nApp, which this shape deliberately does not repeat: one id, one\nmeaning."},"last_used_at":{"type":["string","null"]},"name":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"updated_at":{"type":"string"}}},"ColumnChange":{"type":"object","required":["name","before","after"],"properties":{"after":{"$ref":"#/components/schemas/OutputColumnDef"},"before":{"$ref":"#/components/schemas/OutputColumnDef"},"name":{"type":"string"}}},"ColumnDef":{"type":"object","description":"One column in a Vigilfield table — the **pure storage schema** (ADR-0022\n/ #1291). Extraction VRL moved to the source's `output_schema`. Mirrors the\nstorage shape the ingestion service coerces rows into.","required":["name","data_type","nullable"],"properties":{"data_type":{"type":"string","description":"snake_case enum value: `string`, `int64`, `float64`, `bool`,\n`timestamp`, `json`, `string_array`. Kept as a string here so this\ncrate doesn't need the ingestion `DataType` enum."},"description":{"type":["string","null"],"description":"Customer-facing description of the column."},"name":{"type":"string"},"nullable":{"type":"boolean"}}},"ColumnOrigin":{"type":"string","enum":["from-template","customer-added"]},"CompileQueryResponse":{"type":"object","description":"`POST /queries/compile` response, for **both** compile outcomes.\n\nA failed compile is a 200, not a 4xx: the request asked *\"is this valid, and\nwhere is it wrong?\"* and got its answer. The two are told apart by which\nfield is present, never by the status.\n\n| outcome | `sql` | `diagnostics` |\n| --- | --- | --- |\n| compiled | the Trino `SELECT` | `[]` |\n| refused | absent | one entry per problem, all of them |\n\n⚠️ An unknown `vfql_version` is neither row: it is a **400** carrying a\nmessage and no `diagnostics` key at all (R6). `CompileError::UnknownVersion`\nhas no span, so it has no place in this array and must never enter it.\n\nDiagnostics are **collected**, not first-wins: three typoed columns come back\nas three entries, because an analyst fixing one at a time is the same query\nfailing three times.","required":["diagnostics"],"properties":{"diagnostics":{"type":"array","items":{"$ref":"#/components/schemas/QueryDiagnostic"}},"sql":{"type":["string","null"],"description":"The generated Trino `SELECT`. Absent when the compile was refused."}}},"ConnectionType":{"type":"string","description":"Which cloud a connection reaches. Wire values `aws` / `https` (ours, so\nsnake_case per repo convention).","enum":["aws","https"]},"ControlPlaneExportOptions":{"type":"object","properties":{"audit_logs":{"type":"boolean"},"databases":{"type":"boolean"},"investigations":{"type":"boolean"},"rules":{"type":"boolean"},"tables":{"type":"boolean"},"teams_and_permissions":{"type":"boolean"}}},"CreateAlertDestinationRequest":{"type":"object","description":"`POST /alert-destinations` / `PUT /alert-destinations/{id}` body — the\ncreate/update request. `secret` is plaintext on the way in and sealed\nserver-side; it is never stored or echoed.","required":["kind"],"properties":{"kind":{"$ref":"#/components/schemas/DestinationKindInput"},"owner_team_id":{"type":["string","null"],"description":"The team the destination is owned by (grants that team write authority)."},"sns":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SnsDestinationInput"}]},"webhook":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/WebhookDestinationInput"}]}}},"CreateAppRequest":{"type":"object","description":"`POST /apps` body.","required":["name"],"properties":{"description":{"type":["string","null"],"description":"Optional free-form description. Visible only in the admin UI;\nnot displayed in audit logs."},"name":{"type":"string","description":"Human-friendly label. Required, max 80 chars. Surfaces in the\nadmin UI and every audit line touching the app."},"published":{"type":["boolean","null"],"description":"ADR-0050 §6 catalog flag. Defaults to `false`. Inert — nothing reads it\nfor any decision today."},"required_permissions":{"type":["array","null"],"items":{"type":"string"},"description":"The `resource:action` manifest this app declares it needs\n(ADR-0050 §1). Absent and `[]` are both legal and both mean \"declares\nnothing\"; declaring confers **nothing** — the bound is the installer's\nauthority at install time. Validated on write: every token must parse and\nmust not name an owner-only lever."},"role":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserRole","description":"Initial role. Defaults to `member`. The create handler\nrejects `admin` / `owner` per the #496 no-admin invariant —\nthe wire enum is still the full `UserRole` so an admin-side\nvalidation error is surfaced as a 400 with a readable message\nrather than a generic serde deserialize failure."}]},"team_ids":{"type":["array","null"],"items":{"type":"string"},"description":"Initial team memberships. Each must be an existing team in the\norg; the handler doesn't validate that here, but follow-ons\nwill land team-existence checks once the team-leaf exposes a\nlookup helper."}}},"CreateAppResponse":{"type":"object","description":"`POST /apps` response — the provisioned identity.","required":["id","name","role","owner_user_id","email","created_at"],"properties":{"created_at":{"type":"string"},"description":{"type":["string","null"]},"email":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"owner_user_id":{"type":"string"},"published":{"type":"boolean","description":"ADR-0050 §6 catalog flag, as persisted. Always serialized, same reason."},"required_permissions":{"type":"array","items":{"type":"string"},"description":"The declared manifest, as persisted. ⚠️ No `skip_serializing_if`,\nunlike the optional fields above: an empty manifest must read back as\n`[]`, never as an absent key — a consent document that can be\nabsent-or-empty is a tri-state nobody wants to interpret."},"role":{"$ref":"#/components/schemas/UserRole"},"team_ids":{"type":["array","null"],"items":{"type":"string"}}}},"CreateArtifactRequest":{"type":"object","required":["name"],"properties":{"last_query_id":{"type":["string","null"],"description":"Optional pointer to the most recent query run this artifact\nsurfaces. Set by the \"Save as Investigation\" flow (#388\njourney #5) so the React layer can mint the artifact already\nlinked to the just-run query without a follow-up PATCH. Omit\nfor a fresh artifact whose `lastQueryId` gets stamped later\nby the in-editor execute flow."},"name":{"type":"string"}}},"CreateClientRequest":{"type":"object","description":"`POST /clients` body. The credential is issued against the installation\n`installation_id` names (ADR-0050 §5) and acts as that installation's\nApp. `scopes` is the declared subset the token can never exceed,\ncapped to `⊆` **the installation's** grants — not the App's, and not\na role bundle's.","required":["name","installation_id","scopes"],"properties":{"installation_id":{"type":"string","description":"The **installation** id the credential is issued against. Required: it\nmust name a live installation whose App is active.\n\n⚠️ An App id is not accepted by any path (ADR-0050 §5 R2) — it\nis the same `BadRequest` as an `inst-…` naming no row, so a caller\ncannot fall back to the pre-re-key shape and quietly get a credential\nbounded by nothing."},"name":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"},"description":"Declared scope subset as `type:action` tokens (e.g. `[\"tables:read\"]`)."}}},"CreateClientResponse":{"type":"object","description":"`POST /clients` response — the client + its one-time plaintext secret.","required":["client","client_secret"],"properties":{"client":{"$ref":"#/components/schemas/ClientResponse"},"client_secret":{"type":"string","description":"`vfcs_…` — captured here exactly once, never retrievable again."}}},"CreateDomainRequest":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string"},"settings":{},"status":{"type":["string","null"]},"verified_at":{"type":["string","null"]}}},"CreateExportRequest":{"type":"object","description":"Body of `POST /exports`. The UI offers two delivery modes:\ndirect download (small result sets) and S3 push (large exports\nthe customer wants in their own bucket).\n\nThe source is a **table** (ADR-0027 §2 / M2.2): any table the caller may\n`tables:export` — a query-result table (owned via the executing team) or a\nregular ingestion/storage table. The old query-keyed source is gone.","required":["table_id","format","delivery_method"],"properties":{"delivery_method":{"type":"string","description":"`\"download\"` or `\"s3\"`."},"destination":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ExportDestination","description":"The inline S3 destination (ADR-0068) the export lands in. Required\nwhen `delivery_method == \"s3\"` — refused 400 at create naming the\nmissing field. A destination on a `download` export is refused\nnaming both fields."}]},"filter_expression":{"type":["string","null"],"description":"Optional VRL expression evaluated per row at encode time.\nRows for which the program resolves to a truthy value land\nin the output; everything else is dropped. Compile-validated\nat the preprocessor — syntax errors surface as a 400 on this\ncall. Empty / whitespace-only is treated as \"no filter\"."},"format":{"type":"string","description":"`\"json\"`, `\"csv\"`, or `\"parquet\"`."},"table_id":{"type":"string","description":"The table to export. The preprocessor resolves it in the org catalog and\ngates the caller on `tables:export` (ownership ∪ grant); the exporter\nreads that table's Iceberg storage location."}}},"CreateFolderRequest":{"type":"object","required":["name"],"properties":{"description":{"type":["string","null"]},"name":{"type":"string"},"owner_team_id":{"type":["string","null"]},"parent_id":{"type":["string","null"]}}},"CreateGrantRequest":{"type":"object","description":"`POST /grants` body.","required":["subject_type","subject_id","scope","target"],"properties":{"scope":{"type":"string","description":"`:` scope (e.g. `tables:query`); validated server-side."},"subject_id":{"type":"string"},"subject_type":{"$ref":"#/components/schemas/SubjectKind"},"target":{"type":"string","description":"`\"*\"` (org-wide, all of the scope's kind) or a concrete resource id."}}},"CreateIdentityProviderRequest":{"type":"object","required":["name","protocol","domains"],"properties":{"attribute_mappings":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AttributeMappings"}]},"domains":{"type":"array","items":{"type":"string"},"description":"Verified email domains the IdP serves. Required non-empty.\nEach domain must already exist + be verified in the org's\n`/domains`; the handler also rejects overlaps with other\nIdpRecords in the same org so a given email domain routes to\nexactly one IdP (#308 follow-up — supports parent/subsidiary\norgs without a user-facing IdP picker)."},"enabled":{"type":["boolean","null"]},"name":{"type":"string"},"oidc":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OidcConfig"}]},"protocol":{"$ref":"#/components/schemas/IdpProtocol","description":"Required. Issue #311 prohibits SCIM-only configurations: every\nIdpRecord must carry a federation protocol."},"saml":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SamlConfig"}]},"scim":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ScimConfig"}]}}},"CreateInvestigationRequest":{"type":"object","required":["name"],"properties":{"description":{"type":["string","null"]},"folder_id":{"type":["string","null"]},"name":{"type":"string"},"owner_team_id":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/InvestigationStatus"}]}}},"CreateInvitationRequest":{"type":"object","required":["email"],"properties":{"email":{"type":"string"},"external_user":{"type":"boolean","description":"Explicit acknowledgement that the invitee's email domain is not\namong the org's verified domains. Required when the org's\n`invite_domain_policy` is `verified_default_override` and the\nemail domain is unverified. Ignored otherwise."},"role":{"type":["string","null"],"description":"`\"owner\"`, `\"admin\"`, or `\"member\"`. Defaults to `\"member\"` if\nunset."},"team_ids":{"type":["array","null"],"items":{"type":"string"}},"ttl_hours":{"type":["integer","null"],"format":"int32","description":"Override the org's default TTL for this invite. The hard\nplatform ceiling is 7 days; values above the ceiling are\nclamped server-side.","minimum":0}}},"CreateOrgExportRequest":{"type":"object","properties":{"destination":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ExportDestination","description":"The inline S3 destination (ADR-0068) this export delivers to.\nRequired — gated at create (400 naming the missing field); the\nshape-only gate runs facade-side and never probes the role."}]},"error_message":{"type":["string","null"]},"export_type":{"type":["string","null"]},"status":{"type":["string","null"]}}},"CreateRuleRequest":{"type":"object","required":["name"],"properties":{"alerting":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleAlerting","description":"What the rule's matches become (ADR-0067 §3). Absent or `null`: the\nrule never alerts."}]},"description":{"type":["string","null"]},"enabled":{"type":["boolean","null"]},"name":{"type":"string"},"owner_team_id":{"type":["string","null"]},"query":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryText"}]},"schedule":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleStatus"}]}}},"CreateSourceRequest":{"type":"object","description":"`POST /sources` body. A source is created **detached** (attach is a separate\nstep — `POST /sources/{id}/attach`, #1293). The read pipeline is supplied\n**either** by naming a built-in `template_id` (the api expands it into the\nAWS pipeline + `output_schema`) **or** inline via `aws` + `output_schema`\n(ADR-0022; source-create 1(a)).\n\n⚠️ **`deny_unknown_fields`, deliberately** (one of four write DTOs — see\n`organization/dto.rs` for the documented default and why these four depart\nfrom it): `category` and `kind` are dead field names (ADR-0069), and a body\ncarrying them must be refused for **any** value — plain field deletion would\nsilently ignore them, which is exactly the acceptance AC2 forbids.","required":["name"],"properties":{"customizations":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/TemplateCustomizations","description":"Customisations applied on top of the template (escape hatch for\ndivergence)."}]},"description":{"type":["string","null"]},"http_credential":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HttpCredentialInput","description":"The HTTP source's **own** credential. Required for an HTTP source —\n`{\"kind\": \"none\"}` for a public endpoint — and refused on every other\nsource. The `secret` is **write-only**: it is sealed at create and never\nappears in any response, error body or log line."}]},"ingestion":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/IngestionSourceConfigInput","description":"Ingestion pipeline params (the FE wizard's high-level shape). Required\non every source — source means ingestion (ADR-0069). Nothing is\nprovisioned at create: an S3, CloudWatch Logs or SQS source is created\n`awaiting_role` (ADR-0065)."}]},"name":{"type":"string"},"output_schema":{"type":"array","items":{"$ref":"#/components/schemas/OutputColumnDefInput"},"description":"The declared **output schema** (extraction mapping). Required for a\ncustom (non-template) source; expanded from the template otherwise."},"owner_team_id":{"type":["string","null"],"description":"Owning team — grants the caller's team read/write authority over this\nsource (ADR-0026). `None` = unowned (org-owner-only)."},"seed_table":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SeedTableRequest","description":"\"New table from template\" convenience (ADR-0022): additionally\nseed a starter table whose storage schema matches this source's\nresolved output schema, and attach the source to it — one call yields\nworking ingestion. Orchestrated table-side\n(`vigilfield_table::create_source_with_starter_table_for`)."}]},"template_id":{"type":["string","null"],"description":"Optional built-in template id (e.g. `Route53DNS`). When set, the api\nexpands the template's `(mechanism, input_format)` + per-column\nextraction into the source's AWS pipeline + `output_schema`."},"template_version":{"type":["integer","null"],"format":"int32","description":"Template version captured at create time. Pairs with `template_id`.","minimum":0}},"additionalProperties":false},"CreateTableRequest":{"type":"object","description":"`POST /tables` body — pure **storage schema** + population (ADR-0069).\nIngestion is wired separately by creating + attaching Sources.\n\n⚠️ **`deny_unknown_fields`, deliberately** (one of four write DTOs — see\n`organization/dto.rs` for the documented default and why these four depart\nfrom it): a body carrying a dead key (`category`, a source's `kind`) must be\nrefused, not silently dropped — the field-rename this request survived\nwould otherwise accept bodies written for the shape it replaced.","required":["name"],"properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/ColumnDef"},"description":"Storage columns (`name` / `data_type` / `nullable` / `description`).\nNo extraction VRL — that lives on the source's `output_schema`."},"description":{"type":["string","null"]},"kind":{"$ref":"#/components/schemas/TableKind","description":"`event` (default) or `lookup` (ADR-0028). Immutable after create."},"max_versions":{"type":"integer","format":"int32","description":"Lookup-table version retention (1–30, default 1). Ignored for `event`.","minimum":0},"name":{"type":"string"},"owner_team_id":{"type":["string","null"],"description":"Team that owns this table. `None` leaves it unowned — nothing infers\nit. ⚠️ This used to say *\"inherits from the parent database\"*, which\n`build_table_item` never did (`logic.rs`); ADR-0061 then removed the\ndatabase it would have inherited from."},"population":{"$ref":"#/components/schemas/PopulationConfig","description":"What fills this table (`source` / `rule` / `query`, ADR-0069). Attached\nsources require `kind: source`. Defaults to `{kind: source}`."},"table_name":{"type":["string","null"]}},"additionalProperties":false},"CreateTeamRequest":{"type":"object","required":["name"],"properties":{"description":{"type":["string","null"]},"external_id":{"type":["string","null"]},"name":{"type":"string"},"source":{"type":["string","null"]}}},"CreateUserRequest":{"type":"object","required":["email"],"properties":{"avatar":{"type":["string","null"]},"email":{"type":"string"},"is_admin":{"type":["boolean","null"]},"name":{"type":["string","null"]},"provisioned_by":{"type":["string","null"],"description":"FK to the IdP record that provisioned this user. `None` for\nnative (password) users — see `UserItem.provisioned_by`."},"role":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserStatus"}]},"team_ids":{"type":["array","null"],"items":{"type":"string"}}}},"CreatedInvitationResponse":{"type":"object","description":"Response from `POST /invitations`. The token\nis returned only on creation — it's the only place the api ever\nemits it (audit ergonomics + harm reduction if the row is later\ndumped). The admin UI tucks it into a \"copy link\" affordance for\nout-of-band delivery in case the emailed link gets stuck.","required":["invitation","token","redemption_url"],"properties":{"invitation":{"$ref":"#/components/schemas/InvitationResponse"},"redemption_url":{"type":"string","description":"The full URL the recipient should click. Useful for admin\ntooling that wants to display / copy the link without\nreassembling the host."},"token":{"type":"string"}}},"CwlSourceConfig":{"type":"object","description":"Fetcher config for the CloudWatch Logs pull transport.","required":["log_group_name"],"properties":{"log_group_name":{"type":"string","description":"CloudWatch Logs log-group name in the customer's account."},"log_stream_pattern":{"type":["string","null"],"description":"Optional `logStreamNamePrefix` to scope `FilterLogEvents` calls."},"poll_interval_override_secs":{"type":["integer","null"],"format":"int32","description":"Per-source override for the scheduler's poll cadence.","minimum":0}}},"Delegation":{"type":"object","description":"Delegating-fetcher fan-out config (ADR-0024 §1) plus the recursion\nbudget (§5). A delegating node issues **one** request, does not deserialize\nits own body, and dispatches each configured child to a fetcher of its own.","required":["children"],"properties":{"children":{"type":"array","items":{"$ref":"#/components/schemas/ChildFetcher"},"description":"The VRL map: each child extracts a URL from the parent response object and\ndispatches it to a child fetcher. Must be non-empty."},"max_depth":{"type":["integer","null"],"format":"int32","description":"Max delegation depth (the root delegation is depth 1). Recursion into a\nchild's nested `delegation` beyond this is refused at fetch time.\nDefaults to [`Delegation::DEFAULT_MAX_DEPTH`]; clamped to the ceiling.","minimum":0},"max_total_requests":{"type":["integer","null"],"format":"int32","description":"Max **total** child requests per trigger across the whole delegation tree\n(every guarded fetch — root, each child, each paginating page — counts).\nDefaults to [`Delegation::DEFAULT_MAX_TOTAL_REQUESTS`]; clamped to the\nceiling. Together with URL cycle detection this bounds fan-out.","minimum":0}}},"DeserializerResponse":{"type":"object","description":"One deserializer a template-less custom source may pick (ADR-0023).\n`id` is the wire `input_format` tag; `description` is the catalog's\noutput contract, shown as the option's help text in the wizard.","required":["id","description"],"properties":{"description":{"type":"string"},"id":{"type":"string"},"required_capability":{"type":["string","null"],"description":"Per-org capability this deserializer requires, if any (ADR-0024 §3 /\n#1302) — e.g. `first_party` for the Tor / HTML deserializers. The wizard\noffers a gated deserializer only to an eligible org. Absent ⇒ general."}}},"DestinationConnection":{"type":"object","description":"The customer's connection an export delivery assumes through. The\nrole ARN is pasted (see the module doc); `type` must be `aws`.","required":["type","account_id","region","role_arn"],"properties":{"account_id":{"type":"string","description":"12-digit AWS account id, trimmed — the account the role and\nbucket live in."},"region":{"type":"string","description":"AWS region code (`us-east-1`), trimmed — where the bucket lives\nand the region the assumed S3 client is scoped to."},"role_arn":{"type":"string","description":"The customer's role ARN, pasted. Its trust policy pins\n`export:`."},"type":{"$ref":"#/components/schemas/ConnectionType","description":"Which cloud the connection reaches. Export delivery requires\n`aws` — `validate_shape` refuses `https`."}}},"DestinationKindInput":{"type":"string","enum":["sns","webhook"]},"DomainAvailabilityResponse":{"type":"object","required":["available"],"properties":{"available":{"type":"boolean"}}},"DomainResponse":{"type":"object","required":["id","org_id","domain","consecutive_failure_count","created_at","updated_at"],"properties":{"auto_join_disabled_at":{"type":["string","null"],"description":"Set when the state machine auto-flipped `allowAutoJoin` to\n`false` (degrade transition). Cleared on recovery, but the\n`allowAutoJoin` flag itself stays off until admin re-enables."},"consecutive_failure_count":{"type":"integer","format":"int32","description":"Consecutive failed re-verifications. Resets to 0 on every\nsuccess; 7 consecutive failures revokes the domain.","minimum":0},"created_at":{"type":"string"},"degraded_at":{"type":["string","null"],"description":"Set when the row first transitioned to `degraded`. Cleared\non recovery to `verified`. The admin UI uses this to render\nthe \"degraded since …\" banner."},"domain":{"type":"string"},"id":{"type":"string"},"last_checked_at":{"type":["string","null"],"description":"Most recent verify attempt — success OR failure. Drives the\n\"last attempted\" tooltip in the admin UI so an operator can\nspot a stuck tick."},"last_verified_at":{"type":["string","null"],"description":"Most recent successful DNS re-verification. Distinct\nfrom `verified_at`, which is the FIRST verify and never\nmoves. `lastVerifiedAt - now()` is what the admin UI shows as\n\"verified 3 hours ago\"."},"org_id":{"type":"string"},"revoked_at":{"type":["string","null"],"description":"Set when the row transitioned to `revoked`. Stays set even\nafter a manual recovery so the timeline reads correctly."},"settings":{},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DomainStatus"}]},"updated_at":{"type":"string"},"verification_token":{"type":["string","null"],"description":"Per-domain verification token. Surfaced to the customer\nso the frontend can render the DNS instructions for the TXT\nrecord: `vf-domain-verification=` on\n`_vigilfield-verification.`."},"verified_at":{"type":["string","null"]}}},"DomainStatus":{"type":"string","description":"Lifecycle state of a verified domain. The state machine\nlives in `domain/state.rs`; this enum is the wire projection.\n\n`Verified` — current verification succeeded; full identity claims\naccepted. `Degraded` — recent re-verify failures crossed the\nwarning threshold; new JIT provisioning + auto-join blocked.\n`Revoked` — 7 consecutive failures; all federated paths blocked.","enum":["verified","degraded","revoked"]},"EstimateExportRequest":{"type":"object","description":"Body of `POST /org-exports/estimates`. The UI sends one of three export\nshapes: a full data export, a control-plane-only export, or a hybrid\n\"everything\" export. `control_plane_options` selects which control\nresources to include when the export type isn't pure data.","properties":{"control_plane_options":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ControlPlaneExportOptions"}]},"type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ExportType"}]}}},"EventBridgeSetupResponse":{"type":"object","description":"Response shape for `GET /tables/{id}/eventbridge-setup`.\n\nReturns everything the customer needs to wire their EventBridge\nrule to Vigilfield's queue: the target ARN, the source marker the\ninput transformer must stamp, and the InputPathsMap +\nInputTemplate strings ready to paste into the rule's input\ntransformer (or a CloudFormation snippet).\n\nThe marker is generated server-side at source-create time\n(`generate_source_marker`) and persisted on\n`EventBridgeSourceConfig.source_marker`; this endpoint just\nreads it back alongside the rest of the snippet so the customer\ncan copy + paste everything from one place.","required":["target_queue_arn","source_marker","input_paths_map","input_template"],"properties":{"input_paths_map":{"description":"JSON object mapping input-transformer variable names to\nEventBridge JsonPath expressions. Goes into the\n`Rule.Targets[*].InputTransformer.InputPathsMap` field."},"input_template":{"type":"string","description":"String literal for the input-transformer template. Carries\nthe source marker baked in plus passthroughs for every\nEventBridge envelope field; lands in\n`Rule.Targets[*].InputTransformer.InputTemplate`."},"source_marker":{"type":"string","description":"Opaque per-source marker the customer's input transformer\nstamps into every delivered event. The worker reads it off\nthe SQS message body to look the source up."},"target_queue_arn":{"type":"string","description":"Vigilfield's SQS queue ARN — the customer's EventBridge rule\ntargets this. Format:\n`arn:aws:sqs:::vf-ingestion-eventbridge`."}}},"EventBridgeSourceConfig":{"type":"object","description":"Fetcher config for the EventBridge transport.","required":["source_account","source_event_bus_arn","source_marker"],"properties":{"source_account":{"type":"string","description":"AWS account ID expected to publish events for this source."},"source_event_bus_arn":{"type":"string","description":"EventBridge bus ARN the customer's rule lives on. Reference only."},"source_marker":{"type":"string","description":"Opaque marker the worker uses to look up this source from the inner\nevent envelope. Generated server-side at source-creation time."}}},"ExportDestination":{"type":"object","description":"The destination an export delivers to. One variant today; the field,\nnot an enum, is the extension point — a second destination kind adds\nan optional sibling of `s3`, mirroring how alert destinations carry\n`sns` / `webhook`.","required":["s3"],"properties":{"s3":{"$ref":"#/components/schemas/S3Destination","description":"Write to the customer's S3 bucket."}}},"ExportEstimateBreakdown":{"type":"object","required":["control_plane_bytes","data_bytes","table_breakdown"],"properties":{"control_plane_bytes":{"type":"integer","format":"int64","minimum":0},"data_bytes":{"type":"integer","format":"int64","minimum":0},"table_breakdown":{"type":"array","items":{"$ref":"#/components/schemas/TableBytesBreakdown"}}}},"ExportEstimateResponse":{"type":"object","required":["size_bytes","cost_usd","estimated_duration_seconds","breakdown","estimated_rows","estimated_bytes"],"properties":{"breakdown":{"$ref":"#/components/schemas/ExportEstimateBreakdown"},"cost_usd":{"type":"number","format":"double"},"estimated_bytes":{"type":"integer","format":"int64","minimum":0},"estimated_duration_seconds":{"type":"integer","format":"int64","minimum":0},"estimated_rows":{"type":"integer","format":"int64","minimum":0},"size_bytes":{"type":"integer","format":"int64","minimum":0}}},"ExportResponse":{"type":"object","required":["id","org_id","table_id","format","delivery_method","status","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"delivery_method":{"type":"string"},"destination":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ExportDestination","description":"The inline destination the export lands in (ADR-0068). Echoed so\nthe UI can show where an export went without a second read;\n`None` for downloads."}]},"download_url":{"type":["string","null"]},"error_message":{"type":["string","null"]},"filter_expression":{"type":["string","null"],"description":"VRL filter expression applied to the export. Echoed back so\nthe UI can render what filter ran when displaying historical\nexports."},"format":{"type":"string"},"id":{"type":"string"},"org_id":{"type":"string"},"progress":{"type":["integer","null"],"format":"int32","description":"Monotonically-increasing 0..=100 while the exporter is\nrunning. Locked at 100 once `status == \"completed\"`. Absent\non `\"pending\"` / `\"cancelled\"` and on terminal `\"failed\"`\n(the failure point isn't useful to the UI).","minimum":0},"status":{"type":"string","description":"`\"pending\"` / `\"running\"` / `\"completed\"` / `\"failed\"` /\n`\"cancelled\"`. Projected from the underlying workload's\n`QueryState` — see `ExportResponse::from_workload`."},"table_id":{"type":"string","description":"The exported table (ADR-0027 M2.2)."},"updated_at":{"type":"string"}}},"ExportType":{"type":"string","description":"Shape of an org-export request. `Data` = log data only;\n`ControlPlane` = metadata only (schemas, configs); `Everything` =\nboth. Note: a previous draft of the frontend called this\n`\"full\"` — the canonical wire value is `\"everything\"`.","enum":["data","control_plane","everything"]},"FolderResponse":{"type":"object","required":["id","org_id","name","created_at","updated_at","investigation_count"],"properties":{"created_at":{"type":"string"},"description":{"type":["string","null"]},"id":{"type":"string"},"investigation_count":{"type":"integer","format":"int32"},"name":{"type":"string"},"org_id":{"type":"string"},"owner_team_id":{"type":["string","null"]},"parent_id":{"type":["string","null"]},"updated_at":{"type":"string"}}},"ForgotPasswordRequest":{"type":"object","required":["email","slug"],"properties":{"email":{"type":"string","description":"Email the user typed on the forgot-password page. Used as the\ncanonical lookup key against the org's user list. The response\nis identical whether the email matches or not (anti-enumeration)."},"slug":{"type":"string","description":"Org slug the user is signing in to. The endpoint runs against\nthe apex (no auth, no subdomain context), so the slug has to\nride in the request body."}}},"FreshnessResponse":{"type":"object","description":"Wire shape for `GET /tables/{id}/freshness`.\n\n`cursor_at_ms` is the most recent `window_end_ms` the worker\nsuccessfully committed for the source; `cursor_age_seconds` is\n`(now - cursor_at_ms) / 1000`. `last_polled_at` is the most\nrecent successful tick (even if no data landed); `polled_age_seconds`\nis its derived lag. All four are `None` for sources whose worker\nhas never recorded a successful tick — those show as `Lagging`.","required":["status"],"properties":{"cursor_age_seconds":{"type":["integer","null"],"format":"int64","description":"`(now - cursor_at_ms) / 1000`. `None` when `cursor_at_ms` is."},"cursor_at_ms":{"type":["integer","null"],"format":"int64","description":"Epoch milliseconds of the most recent committed window end."},"last_polled_at":{"type":["string","null"],"description":"ISO 8601 UTC timestamp of the most recent successful tick."},"polled_age_seconds":{"type":["integer","null"],"format":"int64","description":"`(now - last_polled_at) / 1000`. `None` when `last_polled_at` is\nor can't be parsed."},"status":{"$ref":"#/components/schemas/FreshnessStatus"}}},"FreshnessStatus":{"type":"string","description":"Coarse health bucket for the freshness indicator.\n\nComputed from the joined `SourceHealthItem`:\n- `Quarantined` when `health.quarantined` is true (PR for #426 PR 2\n flips this flag).\n- `CatchingUp` when the cursor (or last successful poll) is more\n than `CWL_CATCHUP_THRESHOLD_SECS` (default 300s) behind. Mirrors\n the tick's state-machine threshold so the customer\n sees the same signal the dispatcher is reacting to.\n- `Lagging` when the cursor / poll is between 2× and 5× the\n scheduler tick behind — the data is current enough not to\n alarm, but visibly behind real-time.\n- `Healthy` for everything within 2× the scheduler tick.","enum":["Healthy","Lagging","CatchingUp","Quarantined"]},"GrantResponse":{"type":"object","description":"Read shape for `GET /grants` / `POST /grants`.","required":["id","subject_type","subject_id","scope","target","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"granted_by":{"type":["string","null"]},"id":{"type":"string"},"scope":{"type":"string"},"subject_id":{"type":"string"},"subject_type":{"$ref":"#/components/schemas/SubjectKind"},"target":{"type":"string"},"updated_at":{"type":"string"}}},"HttpCredentialInput":{"type":"object","description":"The HTTP source's credential, as the create / update request carries it.\nEvery field is `#[serde(default)]` — a **flat struct, not a tagged enum**:\nserde silently ignores unknown keys on a unit variant, so `{\"kind\": \"none\",\n\"secret\": \"…\"}` posted into a tagged enum would drop the secret with a\n`201`. The flat shape makes every stray key a named field the handler\nvalidates, and `kind` is `#[schema(required = true)]` so the OpenAPI\ndocument does not lie about it.","required":["kind"],"properties":{"header_name":{"type":["string","null"],"description":"Header name for `kind: api_key` (e.g. `X-Api-Key`, or `Authorization`\nfor a `Basic ` value — Okta's `SSWS` style)."},"kind":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HttpCredentialKind","description":"Which auth scheme to send. Required at validation even though the\nfield is an `Option` — a flat struct cannot express a required key, so\n`seal` refuses its absence with a `400`."}]},"secret":{"type":["string","null"],"description":"The secret material — a token, password or `Basic ` blob.\nSealed at create/rotation; never stored in the clear, never echoed."},"username":{"type":["string","null"],"description":"Username for `kind: basic`."}}},"HttpCredentialKind":{"type":"string","description":"Which auth scheme an HTTP pull source sends (`none`, `bearer`, `api_key`,\n`basic`). Wire values are ours: snake_case.","enum":["none","bearer","api_key","basic"]},"HttpCredentialScheme":{"oneOf":[{"type":"object","required":["kind"],"properties":{"kind":{"type":"string","enum":["none"]}}},{"type":"object","required":["kind"],"properties":{"kind":{"type":"string","enum":["bearer"]}}},{"type":"object","required":["header_name","kind"],"properties":{"header_name":{"type":"string"},"kind":{"type":"string","enum":["api_key"]}}},{"type":"object","required":["username","kind"],"properties":{"kind":{"type":"string","enum":["basic"]},"username":{"type":"string"}}}],"description":"The HTTP source's credential as the **wire** sees it: the scheme and its\nnon-secret parameters. It has no secret field, so a response cannot carry\none by construction."},"HttpNameValue":{"type":"object","description":"One HTTP header or query parameter — an ordered `{name, value}` pair.\nOrdered arrays (not a map) so repeated names and order are preserved (a\nquery string may legitimately repeat a key). Secret auth material never\nlives here — an HTTP source's credential is the row's own\n`http_credential` (`SourceItem`), and `validate` refuses a plain header\nthat names a credential.","required":["name","value"],"properties":{"name":{"type":"string"},"value":{"type":"string"}}},"HttpSourceConfig":{"type":"object","description":"Fetcher config for the first-party HTTP pull transport (ADR-0024). Holds the\nnon-secret request shape (method, URL, headers, query params, body) plus the\nper-source SSRF/egress caps. HTTPS-only is enforced at validation. Auth\ncomes from the source's own `http_credential` (`SourceItem`), never stored\nhere.","required":["method","url","cron"],"properties":{"body":{"type":["string","null"],"description":"Optional request body, sent verbatim."},"cron":{"type":"string","description":"5-field cron expression (`min hour dom month dow`, UTC) driving the pull\ncadence (ADR-0024 §2). Validated to fire no more than once every\n[`HttpSourceConfig::MIN_CRON_INTERVAL_SECS`]."},"delegation":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Delegation","description":"Delegating-kind config (ADR-0024 §1). When set the root request's\nbody is **not** deserialized; each child extracts a URL from the response\nobject and is fetched as its own Simple / Paginating / Delegating fetcher\n(recursive; children inherit this source's method/headers/auth/caps —\nonly the URL differs). Mutually exclusive with `next_page_expression` on\nthe same node. `None` ⇒ not a delegating root."}]},"headers":{"type":"array","items":{"$ref":"#/components/schemas/HttpNameValue"},"description":"Non-secret request headers, in order."},"max_pages":{"type":["integer","null"],"format":"int32","description":"Paginating-kind cap on pages fetched per trigger (ADR-0024 §5). Defaults\nto [`HttpSourceConfig::DEFAULT_MAX_PAGES`] when absent; only consulted when\n`next_page_expression` is set.","minimum":0},"max_redirects":{"type":["integer","null"],"format":"int32","description":"Per-source redirect cap. Defaults to\n[`HttpSourceConfig::DEFAULT_MAX_REDIRECTS`] when absent.","minimum":0},"max_response_bytes":{"type":["integer","null"],"format":"int64","description":"Per-source response-body cap in bytes. Defaults to\n[`HttpSourceConfig::DEFAULT_MAX_RESPONSE_BYTES`] when absent.","minimum":0},"method":{"type":"string","description":"HTTP method / verb (uppercased at validation), e.g. `GET`, `POST`."},"next_page_expression":{"type":["string","null"],"description":"Paginating-kind VRL **next-page expression** (ADR-0024 §1).\nEvaluated over the response object `{status, reason, headers, body, url}`\nafter each page; returns the next page's URL (absolute, or relative —\nresolved against the response's final `url`) or `null` to stop. `None`\nmeans the Simple kind (one request, no pagination)."},"query_params":{"type":"array","items":{"$ref":"#/components/schemas/HttpNameValue"},"description":"Query parameters appended to the URL, in order."},"timeout_secs":{"type":["integer","null"],"format":"int32","description":"Per-source request timeout in seconds. Defaults to\n[`HttpSourceConfig::DEFAULT_TIMEOUT_SECS`] when absent.","minimum":0},"url":{"type":"string","description":"Absolute request URL. Must be `https://` (validated)."}}},"IdentityProviderResponse":{"type":"object","required":["id","org_id","name","protocol","domains","enabled","created_at","updated_at"],"properties":{"attribute_mappings":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AttributeMappings"}]},"cognito_provider_name":{"type":["string","null"],"description":"Cognito-side federation provider name. Surfaced read-only so the\nadmin UI can show \"federation active\" once Cognito's\n`CreateIdentityProvider` succeeds."},"created_at":{"type":"string"},"domains":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"id":{"type":"string"},"last_sync_at":{"type":["string","null"]},"name":{"type":"string"},"oidc":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OidcConfig"}]},"org_id":{"type":"string"},"protocol":{"$ref":"#/components/schemas/IdpProtocol"},"saml":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SamlConfig"}]},"scim":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ScimConfig"}]},"updated_at":{"type":"string"}}},"IdpConnectionTestResponse":{"type":"object","description":"Response from `POST /identity-providers/{id}/tests`. Renamed\nfrom `ConnectionTestResponse` to avoid a utoipa schema-name\ncollision with `connection::dto::ConnectionTestResponse`, which\nhas a richer shape; both used to share the same generated TS\nalias and the FE-facing test endpoint quietly lost every field\nexcept `success`.","required":["success"],"properties":{"success":{"type":"boolean"}}},"IdpProtocol":{"type":"string","description":"Federation protocol. `saml` and `oidc` are the only supported values;\nSCIM is **not** a protocol — it's an optional add-on on top of an\nIdpRecord, modelled as `ScimConfig` below.","enum":["saml","oidc"]},"IngestionConfigInput":{"oneOf":[{"type":"object","required":["bucket_name","mechanism"],"properties":{"bucket_name":{"type":"string"},"mechanism":{"type":"string","enum":["S3"]},"prefix_filter":{"type":["string","null"]}}},{"type":"object","required":["log_group_arn","mechanism"],"properties":{"log_group_arn":{"type":"string","description":"Full `arn:aws:logs:::log-group::*`; the api\nparses the log-group name out, and refuses an ARN outside the\nsource's `aws` account and region."},"mechanism":{"type":"string","enum":["CloudWatchLogs"]}}},{"type":"object","required":["event_bus_arn","mechanism"],"properties":{"event_bus_arn":{"type":"string"},"mechanism":{"type":"string","enum":["EventBridge"]}}},{"type":"object","description":"SQS pull: the worker receives newline-separated JSON events from a queue\nthe customer already owns, under a role in their account.","required":["queue_arn","mechanism"],"properties":{"mechanism":{"type":"string","enum":["Sqs"]},"queue_arn":{"type":"string","description":"ARN of the customer's queue (`arn:aws:sqs:::`),\nin the source's `aws` account and region."}}},{"type":"object","description":"First-party HTTP pull (ADR-0024). Carries the full non-secret request\nshape; the credential is the request's own `http_credential` block.","required":["method","url","cron","mechanism"],"properties":{"body":{"type":["string","null"]},"cron":{"type":"string","description":"5-field cron schedule (UTC) driving the pull cadence; validated to\nthe 5-minute floor (ADR-0024 §2)."},"delegation":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Delegation","description":"Delegating-kind fan-out map + recursion budget (ADR-0024 §1).\n`None` ⇒ not delegating; mutually exclusive with\n`next_page_expression`."}]},"headers":{"type":"array","items":{"$ref":"#/components/schemas/HttpNameValue"}},"max_pages":{"type":["integer","null"],"format":"int32","description":"Paginating page cap per trigger (ADR-0024 §5).","minimum":0},"max_redirects":{"type":["integer","null"],"format":"int32","minimum":0},"max_response_bytes":{"type":["integer","null"],"format":"int64","minimum":0},"mechanism":{"type":"string","enum":["Http"]},"method":{"type":"string","description":"HTTP method / verb."},"next_page_expression":{"type":["string","null"],"description":"Paginating-kind VRL next-page expression over the response object\n(ADR-0024 §1). `None` ⇒ the Simple kind."},"query_params":{"type":"array","items":{"$ref":"#/components/schemas/HttpNameValue"}},"timeout_secs":{"type":["integer","null"],"format":"int32","minimum":0},"url":{"type":"string","description":"Absolute `https://` request URL."}}}],"description":"Discriminated union of per-mechanism source params the FE wizard builds."},"IngestionSourceConfig":{"type":"object","description":"External-log read pipeline. Holds the transport **vendor** (AWS or HTTP —\nthe sub-category), the **fetcher** stage reference (+ its per-transport\nsub-config), the **deserializer** stage reference (+ `format_string`), the\noptional `filter_expression`, and the extraction VRL program\n(`vrl_program_source`), plus the customer's connection (`connection`) and\nthe provisioning state.\n\nFederation is reserved as a future **source sub-config** beside this one —\nthe room the retired source kind enum's doc comment held open (ADR-0069); a\nfederation source needs no kind on the source, so nothing here designs it.\n\nA fetcher runtime that assumes a customer role (S3 / CloudWatch Logs / SQS)\ncarries `connection`; EventBridge carries neither `connection` nor a\ncredential; the `Http` vendor carries the first-party HTTP pull (`http`\nsub-config). The HTTP credential itself is **not here** — it is\n[`SourceItem`]'s own `http_credential` field, sealed and off the wire.","required":["fetcher","vrl_program_source","write_prefix","provisioning_state","deserializer"],"properties":{"cloudwatch_logs":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/CwlSourceConfig","description":"Populated iff the fetcher is the CloudWatch Logs pull."}]},"connection":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SourceConnection","description":"The customer's connection — which cloud the source reads through and\n(for `aws`) the account and region. `Some` iff the fetcher runtime\nassumes a role in the customer's account\n([`FetcherRuntime::assumes_customer_role`][acr]), which\n[`IngestionSourceConfig::validate`] enforces on every write path. Checked\nfor shape at create, and never edited in place.\n\n[acr]: vigilfield_ingestion_stages::FetcherRuntime::assumes_customer_role"}]},"data_source_type":{"type":["string","null"],"description":"Coarse UI categorisation of the data source (`CloudTrail`,\n`VPCFlowLogs`, `Custom`, …). Informational."},"deserializer":{"$ref":"#/components/schemas/StageRef","description":"The **deserializer** stage reference (ADR-0023)."},"eventbridge":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/EventBridgeSourceConfig","description":"Populated iff the fetcher is the EventBridge transport."}]},"fetcher":{"$ref":"#/components/schemas/StageRef","description":"The **fetcher** stage reference (ADR-0023). The catalog entry's\nruntime decides which worker receive loop serves this source."},"filter_expression":{"type":["string","null"],"description":"Optional VRL boolean expression (the **filter** stage). Rows for which\nit evaluates `false` are dropped before VRL extraction."},"format_string":{"type":["string","null"],"description":"Customer-declared VPC Flow Logs custom format string — deserializer\nconfig, only meaningful when the deserializer is `VPC_FLOW_TEXT`."},"http":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HttpSourceConfig","description":"Populated iff the fetcher is the first-party HTTP pull (ADR-0024). The\nsource's own credential rides on the row (`SourceItem.http_credential`),\nand `connection` is absent."}]},"on_extraction_failure":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OnExtractionFailure","description":"What ingestion does when per-column VRL extraction fails. Defaults to\n`Skip` when absent."}]},"provisioning_error":{"type":["string","null"]},"provisioning_state":{"$ref":"#/components/schemas/ProvisioningState"},"sqs":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SqsSourceConfig","description":"Populated iff the fetcher is the SQS pull transport: the customer's queue."}]},"topic_arn":{"type":["string","null"],"description":"SNS topic ARN for the S3 transport. Topic name format:\n`vf-ingest--`. Created at Verify (`rh-lo8eeu.5`),\nnever at create, so `None` until then."},"vendor":{"$ref":"#/components/schemas/IngestionVendor","description":"Transport vendor — the sub-category selecting which fetcher family this\nsource uses."},"vrl_program_source":{"type":"string","description":"VRL program text. Compiled inside the ingestion service per snapshot\nrefresh; never executed in the control plane."},"write_prefix":{"type":"string","description":"S3 prefix under the data-lake bucket where rows for this source land.\nFormat: `orgs//tables//sources//data/`\n(per-source under the table's read tree, so many sources feed one\ntable's Iceberg data without collision). Ingestion enforces\nwriter-side."}}},"IngestionSourceConfigInput":{"type":"object","description":"Ingestion pipeline params — the high-level shape the FE wizard sends. The\napi derives the low-level storage state (transport vendor, mechanism\nsub-config, initial state) from the chosen `ingestion_config`, and stores\nthe `connection` as typed, trimmed.","required":["ingestion_config"],"properties":{"connection":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SourceConnectionInput","description":"The connection an S3, CloudWatch Logs or SQS source reads through.\nRequired for those three, refused for EventBridge and HTTP."}]},"data_source_type":{"type":["string","null"],"description":"Coarse UI categorisation (`CloudTrail`, `VPCFlowLogs`, `Custom`, …)."},"filter_expression":{"type":["string","null"],"description":"Optional VRL boolean filter — rows evaluating `false` are dropped\nbefore extraction."},"format_string":{"type":["string","null"],"description":"VPC Flow Logs custom format string. Only meaningful when `input_format`\nis `\"VPC_FLOW_TEXT\"`."},"ingestion_config":{"$ref":"#/components/schemas/IngestionConfigInput","description":"Discriminated union of S3 / CloudWatch Logs / EventBridge / HTTP\ntransport params. The transport vendor is derived from this."},"input_format":{"type":["string","null"],"description":"Deserializer tag. `None` means `JSON`. Ignored when `template_id` is\nset — the api derives it from the template."},"on_extraction_failure":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OnExtractionFailure","description":"What ingestion does when per-column VRL extraction fails. Defaults to\n`Skip`."}]}}},"IngestionVendor":{"type":"string","description":"Transport vendor of an [`IngestionSourceConfig`] — the sub-category grouping\nunder the source's one ingestion pipeline (ADR-0069). `Aws` covers the S3 / CloudWatch Logs\n/ SQS / EventBridge fetchers; `Http` covers the first-party HTTP pull\n(ADR-0024; secret-backed `Http` connection). Whether a role in the customer's\naccount is assumed is the fetcher runtime's decision, never the vendor's\n(`FetcherRuntime::assumes_customer_role`): EventBridge is `Aws` and assumes\nnothing.","enum":["AWS","HTTP"]},"InstallationSummary":{"type":"object","description":"$ce","required":["id","app_id","team_id","installed_by","created_at"],"properties":{"app_id":{"type":"string"},"created_at":{"type":"string"},"id":{"type":"string"},"installed_by":{"type":"string","description":"The user who installed it. Provenance, not authority."},"team_id":{"type":"string"}}},"InvestigationResponse":{"type":"object","required":["id","org_id","name","artifact_ids","created_at","updated_at"],"properties":{"artifact_ids":{"type":"array","items":{"type":"string"},"description":"Ordered child artifact ids — defines layout, owned by the\ninvestigation row."},"created_at":{"type":"string"},"created_by":{"type":["string","null"]},"description":{"type":["string","null"]},"folder_id":{"type":["string","null"]},"id":{"type":"string"},"name":{"type":"string"},"org_id":{"type":"string"},"owner_team_id":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/InvestigationStatus"}]},"updated_at":{"type":"string"}}},"InvestigationStatus":{"type":"string","description":"Investigation lifecycle state. Handler emits `OPEN` on create and\nflips to `CLOSED` on the duplicate-as-closed path; storage shape\n(`InvestigationItem.status: Option`) is unchanged, only\nthe wire DTO carries the typed enum.","enum":["OPEN","CLOSED"]},"InvitationLookupRequest":{"type":"object","description":"Body of `POST /invitation-tokens/{invitation}/lookups`.\n\nThe whole body is the credential: the path carries only the locator, and the\nsecret rides here because a request body is the one place on this path that\nnothing records(see `token.rs`'s module header). The field name\nis load-bearing too: `audit_redact`'s denylist masks any key containing\n`secret`, so the audit event records `[REDACTED]` rather than the value.","required":["secret"],"properties":{"secret":{"type":"string","description":"The random secret from the emailed link's fragment. Possession of it is\nwhat authorizes the lookup."}}},"InvitationLookupResponse":{"type":"object","description":"Public lookup response from `POST /invitation-tokens/{invitation}/lookups`.\nReturns minimal data — just enough for the redemption page to render\nwho's inviting whom. Crucially does NOT echo the secret back.","required":["email","org_id","role","status","expires_at"],"properties":{"email":{"type":"string"},"expires_at":{"type":"string"},"org_id":{"type":"string"},"role":{"$ref":"#/components/schemas/UserRole"},"status":{"$ref":"#/components/schemas/InvitationStatus"}}},"InvitationResponse":{"type":"object","required":["id","org_id","email","role","team_ids","status","expires_at","created_by","created_at","updated_at"],"properties":{"cancelled_at":{"type":["string","null"]},"created_at":{"type":"string"},"created_by":{"type":"string"},"email":{"type":"string"},"expires_at":{"type":"string"},"id":{"type":"string"},"org_id":{"type":"string"},"redeemed_at":{"type":["string","null"]},"redeemed_user_id":{"type":["string","null"]},"role":{"$ref":"#/components/schemas/UserRole"},"status":{"$ref":"#/components/schemas/InvitationStatus"},"team_ids":{"type":"array","items":{"type":"string"}},"updated_at":{"type":"string"}}},"InvitationStatus":{"type":"string","description":"Lifecycle state of an invitation. Storage keeps\n`InvitationItem.status: String` for handler-side compatibility;\nthis enum lives on the wire DTO so frontends + api-types.ts ship\na proper union. The handler-side enum-shaped helper at\n`invitation/handler.rs:1123` mirrors these values.","enum":["pending","redeemed","cancelled","expired"]},"InvoiceResponse":{"type":"object","description":"One row of the customer's Stripe invoice history — what the billing page\nlists per period (every period since the subscription started). The links\nare Stripe-hosted: a viewable page (`hosted_invoice_url`) + a downloadable\nPDF (`invoice_pdf`).","required":["id","amount_due","amount_paid"],"properties":{"amount_due":{"type":"integer","format":"int64"},"amount_paid":{"type":"integer","format":"int64"},"created_at":{"type":["string","null"]},"currency":{"type":["string","null"]},"hosted_invoice_url":{"type":["string","null"]},"id":{"type":"string"},"invoice_pdf":{"type":["string","null"]},"number":{"type":["string","null"]},"period_end":{"type":["string","null"]},"period_start":{"type":["string","null"]},"status":{"type":["string","null"]}}},"ListAppsQuery":{"type":"object","description":"`GET /apps` query string.\n\n`filter` is a raw `String` here and parsed by [`AppFilter::parse`]\nin the handler, **not** deserialized straight into the enum: axum's own\nrejection says the field failed to deserialize, not what the legal values\nare, and a caller reading that cannot fix their request. Parsing in the\nhandler is what makes the `400` name `authored, catalog`.","properties":{"filter":{"type":["string","null"]}}},"ListDomainsQuery":{"type":"object","properties":{"domain":{"type":["string","null"],"description":"Exact-match filter on the domain name (used by availability lookups)."},"include_unverified":{"type":["boolean","null"],"description":"When `true`, include domains without a `verified_at` timestamp.\nDefaults to `false` — the frontend lists verified domains by default\nand only shows pending ones inside the verification wizard."}}},"ListInvestigationsQuery":{"type":"object","properties":{"folder_id":{"type":["string","null"]}}},"ListQueriesQuery":{"type":"object","properties":{"artifact_id":{"type":["string","null"]},"rule_id":{"type":["string","null"]},"source":{"type":["string","null"]},"status":{"type":["string","null"]}}},"MfaRequiredResponse":{"type":"object","description":"`ApiError::MfaRequired`'s body, declared for the OpenAPI spec (the app reads\n`mfa` off it). The runtime body is built in `into_response`; the\n`mfa_required_body_matches_its_schema` test keeps the two one shape.","required":["message","mfa"],"properties":{"message":{"type":"string"},"mfa":{"$ref":"#/components/schemas/MfaStep"}}},"MfaStep":{"type":"string","description":"What a sign-in refused by [`ApiError::MfaRequired`] must do next. The wire\nvalue is the `mfa` field of the 403 body.","enum":["enroll","second_factor"]},"ObservedRetention":{"type":"object","description":"Snapshot of a CloudWatch Logs group's retention as last seen by the daily\nre-check pass. Server-managed.","required":["observed_at"],"properties":{"days":{"type":["integer","null"],"format":"int32","description":"Days of retention as last observed. `None` = \"no explicit policy\".","minimum":0},"observed_at":{"type":"string","description":"ISO 8601 UTC timestamp of the observation."}}},"OcsfChange":{"type":"object","required":["before_class_uid","after_class_uid","before_activity_id","after_activity_id"],"properties":{"after_activity_id":{"type":"integer","format":"int32","minimum":0},"after_class_uid":{"type":"integer","format":"int32","minimum":0},"before_activity_id":{"type":"integer","format":"int32","minimum":0},"before_class_uid":{"type":"integer","format":"int32","minimum":0}}},"OcsfMappingDto":{"type":"object","required":["class_uid","category_uid","activity_id","type_uid"],"properties":{"activity_id":{"type":"integer","format":"int32","minimum":0},"category_uid":{"type":"integer","format":"int32","minimum":0},"class_uid":{"type":"integer","format":"int32","minimum":0},"type_uid":{"type":"integer","format":"int64","description":"Derived: `class_uid * 100 + activity_id`. Returned on the wire so\nclients don't have to recompute it.","minimum":0}}},"OidcConfig":{"type":"object","required":["issuer","client_id"],"properties":{"client_id":{"type":"string"},"client_secret":{"type":["string","null"],"description":"Stored encrypted at rest (PII KMS key); never serialised back to the\nwire after creation. The DTO type is `Option` so reads can\nemit `None` while writes accept the secret."},"issuer":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"},"description":"OAuth scopes the api should request alongside `openid`."}}},"OnExtractionFailure":{"type":"string","description":"What the ingestion data plane does when a row fails per-column VRL\nextraction. Mirrors the FE wizard's three modes.","enum":["skip","nullify","dead_letter"]},"OrgExportResponse":{"type":"object","required":["id","org_id","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"destination":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ExportDestination","description":"The inline destination the export delivers to (ADR-0068)."}]},"error_message":{"type":["string","null"]},"export_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ExportType"}]},"id":{"type":"string"},"org_id":{"type":"string"},"status":{"type":["string","null"]},"updated_at":{"type":"string"}}},"OrganizationResponse":{"type":"object","required":["id","name","created_at","updated_at"],"properties":{"auth_config":{},"capabilities":{"type":"array","items":{"type":"string"},"description":"Per-org opt-in feature capabilities (ADR-0024) — e.g.\n`first_party`. Surfaced so the frontend can gate first-party features\n(the HTTP fetcher source wizard is shown when this carries\n`first_party`, or the app is running in staging; #1330)."},"created_at":{"type":"string"},"data_lake_bucket":{"type":["string","null"]},"display_name":{"type":["string","null"]},"id":{"type":"string"},"name":{"type":"string"},"plan_tier":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PlanTier","description":"Renamed from `plan` on the wire — `plan_tier` is the consistent\nlabel used across User/Billing/Org responses for the same concept."}]},"settings":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OrganizationSettings"}]},"slug":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OrganizationStatus"}]},"updated_at":{"type":"string"}}},"OrganizationSettings":{"type":"object","required":["auth_methods"],"properties":{"auth_methods":{"$ref":"#/components/schemas/AuthMethods","description":"Which sign-in methods the org has enabled. Drives whether the\nlogin form shows the password field, SSO buttons, etc."},"invite_domain_policy":{"type":["string","null"],"description":"How permissive invitation issuance is when the org has verified\nemail domains. One of:\n- `\"unrestricted\"` — invitations to any email address are\n accepted. The implicit default when no verified domains exist.\n- `\"verified_default_override\"` — invitations to domains outside\n the verified set require an explicit `external_user` toggle on\n the create request. The implicit default once at least one\n verified domain exists.\n- `\"verified_only\"` — invitations to non-verified domains are\n rejected outright. The strictest policy; no override available."},"session_timeout_minutes":{"type":["integer","null"],"format":"int32","description":"Session lifetime before re-authentication. `None` falls back to the\nplatform default (24h at the time of writing).","minimum":0}}},"OrganizationStatus":{"type":"string","description":"$cf","enum":["active","deleting","pending","suspended","trial"]},"OutputColumnDef":{"type":"object","description":"One column in a source's **declared output schema** — the extraction\nmapping. `vrl_expression` is the per-column VRL that produces the value;\n`name` / `data_type` / `nullable` declare the shape the extraction yields.\nThe compatibility check tests this against the table's storage\ncolumns (`S ≼ T`).","required":["name","data_type","nullable","vrl_expression"],"properties":{"data_type":{"type":"string","description":"snake_case enum value: `string`, `int64`, `float64`, `bool`,\n`timestamp`, `json`, `string_array`. Kept as a string so this crate\ndoesn't depend on ingestion's `DataType`; ingestion-side serde\nvalidates the values."},"description":{"type":["string","null"],"description":"Customer-facing description, carried from the source template."},"name":{"type":"string"},"nullable":{"type":"boolean"},"vrl_expression":{"type":"string","description":"The per-column extraction VRL. Compiled inside the ingestion service."}}},"OutputColumnDefInput":{"type":"object","description":"One declared output column on the wire — the extraction mapping input.","required":["name","data_type","vrl_expression"],"properties":{"data_type":{"type":"string"},"description":{"type":["string","null"]},"name":{"type":"string"},"nullable":{"type":"boolean"},"vrl_expression":{"type":"string"}}},"PaginatedResponse_AppResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","description":"Standard read shape — `GET /apps` and\n`GET /apps/{id}` both return this.","required":["id","name","email","owner_user_id","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"description":{"type":["string","null"]},"email":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"owner_user_id":{"type":"string"},"published":{"type":"boolean","description":"ADR-0050 §6 catalog flag, as persisted. Always serialized, same reason."},"required_permissions":{"type":"array","items":{"type":"string"},"description":"The declared manifest, as persisted. ⚠️ No `skip_serializing_if`,\nunlike the optional fields above: an empty manifest must read back as\n`[]`, never as an absent key — a consent document that can be\nabsent-or-empty is a tri-state nobody wants to interpret."},"role":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserRole"}]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserStatus"}]},"team_ids":{"type":["array","null"],"items":{"type":"string"}},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_ArtifactResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","investigation_id","name","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"id":{"type":"string"},"investigation_id":{"type":"string"},"last_query_id":{"type":["string","null"],"description":"FK to the most recent `QueryRunItem` this artifact ran. The\nfrontend looks the row up via `useQueryRunLookup` to surface\nsql, status, error, execution timing, and row count —\nnothing is denormalised onto the artifact row."},"name":{"type":"string"},"org_id":{"type":"string"},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_ClientResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","description":"Standard read shape — `GET /clients` + `GET /clients/{id}`. The secret is\nintentionally absent.","required":["client_id","name","installation_id","scopes","created_at","updated_at"],"properties":{"client_id":{"type":"string"},"created_at":{"type":"string"},"installation_id":{"type":"string","description":"The installation this credential belongs to — its authority source.\nThe identity a token minted here acts as is that installation's\nApp, which this shape deliberately does not repeat: one id, one\nmeaning."},"last_used_at":{"type":["string","null"]},"name":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_DomainResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","domain","consecutive_failure_count","created_at","updated_at"],"properties":{"auto_join_disabled_at":{"type":["string","null"],"description":"Set when the state machine auto-flipped `allowAutoJoin` to\n`false` (degrade transition). Cleared on recovery, but the\n`allowAutoJoin` flag itself stays off until admin re-enables."},"consecutive_failure_count":{"type":"integer","format":"int32","description":"Consecutive failed re-verifications. Resets to 0 on every\nsuccess; 7 consecutive failures revokes the domain.","minimum":0},"created_at":{"type":"string"},"degraded_at":{"type":["string","null"],"description":"Set when the row first transitioned to `degraded`. Cleared\non recovery to `verified`. The admin UI uses this to render\nthe \"degraded since …\" banner."},"domain":{"type":"string"},"id":{"type":"string"},"last_checked_at":{"type":["string","null"],"description":"Most recent verify attempt — success OR failure. Drives the\n\"last attempted\" tooltip in the admin UI so an operator can\nspot a stuck tick."},"last_verified_at":{"type":["string","null"],"description":"Most recent successful DNS re-verification. Distinct\nfrom `verified_at`, which is the FIRST verify and never\nmoves. `lastVerifiedAt - now()` is what the admin UI shows as\n\"verified 3 hours ago\"."},"org_id":{"type":"string"},"revoked_at":{"type":["string","null"],"description":"Set when the row transitioned to `revoked`. Stays set even\nafter a manual recovery so the timeline reads correctly."},"settings":{},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DomainStatus"}]},"updated_at":{"type":"string"},"verification_token":{"type":["string","null"],"description":"Per-domain verification token. Surfaced to the customer\nso the frontend can render the DNS instructions for the TXT\nrecord: `vf-domain-verification=` on\n`_vigilfield-verification.`."},"verified_at":{"type":["string","null"]}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_FolderResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","name","created_at","updated_at","investigation_count"],"properties":{"created_at":{"type":"string"},"description":{"type":["string","null"]},"id":{"type":"string"},"investigation_count":{"type":"integer","format":"int32"},"name":{"type":"string"},"org_id":{"type":"string"},"owner_team_id":{"type":["string","null"]},"parent_id":{"type":["string","null"]},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_GrantResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","description":"Read shape for `GET /grants` / `POST /grants`.","required":["id","subject_type","subject_id","scope","target","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"granted_by":{"type":["string","null"]},"id":{"type":"string"},"scope":{"type":"string"},"subject_id":{"type":"string"},"subject_type":{"$ref":"#/components/schemas/SubjectKind"},"target":{"type":"string"},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_IdentityProviderResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","name","protocol","domains","enabled","created_at","updated_at"],"properties":{"attribute_mappings":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AttributeMappings"}]},"cognito_provider_name":{"type":["string","null"],"description":"Cognito-side federation provider name. Surfaced read-only so the\nadmin UI can show \"federation active\" once Cognito's\n`CreateIdentityProvider` succeeds."},"created_at":{"type":"string"},"domains":{"type":"array","items":{"type":"string"}},"enabled":{"type":"boolean"},"id":{"type":"string"},"last_sync_at":{"type":["string","null"]},"name":{"type":"string"},"oidc":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OidcConfig"}]},"org_id":{"type":"string"},"protocol":{"$ref":"#/components/schemas/IdpProtocol"},"saml":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SamlConfig"}]},"scim":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ScimConfig"}]},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_InstallationSummary":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","description":"$d0","required":["id","app_id","team_id","installed_by","created_at"],"properties":{"app_id":{"type":"string"},"created_at":{"type":"string"},"id":{"type":"string"},"installed_by":{"type":"string","description":"The user who installed it. Provenance, not authority."},"team_id":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_InvestigationResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","name","artifact_ids","created_at","updated_at"],"properties":{"artifact_ids":{"type":"array","items":{"type":"string"},"description":"Ordered child artifact ids — defines layout, owned by the\ninvestigation row."},"created_at":{"type":"string"},"created_by":{"type":["string","null"]},"description":{"type":["string","null"]},"folder_id":{"type":["string","null"]},"id":{"type":"string"},"name":{"type":"string"},"org_id":{"type":"string"},"owner_team_id":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/InvestigationStatus"}]},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_InvitationResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","email","role","team_ids","status","expires_at","created_by","created_at","updated_at"],"properties":{"cancelled_at":{"type":["string","null"]},"created_at":{"type":"string"},"created_by":{"type":"string"},"email":{"type":"string"},"expires_at":{"type":"string"},"id":{"type":"string"},"org_id":{"type":"string"},"redeemed_at":{"type":["string","null"]},"redeemed_user_id":{"type":["string","null"]},"role":{"$ref":"#/components/schemas/UserRole"},"status":{"$ref":"#/components/schemas/InvitationStatus"},"team_ids":{"type":"array","items":{"type":"string"}},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_InvoiceResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","description":"One row of the customer's Stripe invoice history — what the billing page\nlists per period (every period since the subscription started). The links\nare Stripe-hosted: a viewable page (`hosted_invoice_url`) + a downloadable\nPDF (`invoice_pdf`).","required":["id","amount_due","amount_paid"],"properties":{"amount_due":{"type":"integer","format":"int64"},"amount_paid":{"type":"integer","format":"int64"},"created_at":{"type":["string","null"]},"currency":{"type":["string","null"]},"hosted_invoice_url":{"type":["string","null"]},"id":{"type":"string"},"invoice_pdf":{"type":["string","null"]},"number":{"type":["string","null"]},"period_end":{"type":["string","null"]},"period_start":{"type":["string","null"]},"status":{"type":["string","null"]}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_OrgExportResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"destination":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ExportDestination","description":"The inline destination the export delivers to (ADR-0068)."}]},"error_message":{"type":["string","null"]},"export_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ExportType"}]},"id":{"type":"string"},"org_id":{"type":"string"},"status":{"type":["string","null"]},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_OrganizationResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","name","created_at","updated_at"],"properties":{"auth_config":{},"capabilities":{"type":"array","items":{"type":"string"},"description":"Per-org opt-in feature capabilities (ADR-0024) — e.g.\n`first_party`. Surfaced so the frontend can gate first-party features\n(the HTTP fetcher source wizard is shown when this carries\n`first_party`, or the app is running in staging; #1330)."},"created_at":{"type":"string"},"data_lake_bucket":{"type":["string","null"]},"display_name":{"type":["string","null"]},"id":{"type":"string"},"name":{"type":"string"},"plan_tier":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PlanTier","description":"Renamed from `plan` on the wire — `plan_tier` is the consistent\nlabel used across User/Billing/Org responses for the same concept."}]},"settings":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OrganizationSettings"}]},"slug":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OrganizationStatus"}]},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_PaymentMethodResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","description":"One saved card on the org's Stripe customer (`GET /billing/payment-methods`).\nDisplay fields only — the raw card lives in Stripe's vault, never here.","required":["id","is_default"],"properties":{"brand":{"type":["string","null"]},"expiry_month":{"type":["integer","null"],"format":"int32"},"expiry_year":{"type":["integer","null"],"format":"int32"},"id":{"type":"string"},"is_default":{"type":"boolean","description":"True for the customer's `invoice_settings.default_payment_method` — the\ncard top-up charges hit."},"last4":{"type":["string","null"]}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_QueryResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","description":"Unified wire shape for **every** query endpoint — list, submit,\nget, cancel. Mirrors `QueryItem` (the storage shape) directly;\nthe scheduler's `QueryRunItem` is an internal detail and never\nreaches the wire. Internal scheduler fields (`slot_group`,\n`priority`, `translated_sql`, `engine_query_id`,\n`cost_credits_debited`) are deliberately omitted.","required":["id","org_id","created_at","updated_at"],"properties":{"artifact_id":{"type":["string","null"]},"created_at":{"type":"string"},"data_scanned_bytes":{"type":["integer","null"],"format":"int64","minimum":0},"engine_execution_time_ms":{"type":["integer","null"],"format":"int64","minimum":0},"error_message":{"type":["string","null"]},"finished_at":{"type":["string","null"]},"id":{"type":"string"},"org_id":{"type":"string"},"output_location":{"type":["string","null"],"description":"Athena/engine output location (S3 URI)."},"principal_id":{"type":["string","null"]},"principal_kind":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PrincipalKind","description":"Who / what submitted the run. `None` on legacy rows."}]},"query":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryText","description":"The VFQL that produced this run, as the analyst typed it, with the\ngrammar version it was read under and the values bound into it — enough\nto re-display, re-edit and re-run it.\n\n⚠️ **Absent on a rule-origin run**, and that is the whole of the\ndifference (`rh-egf71u`, decided option A). A saved rule submits SQL,\nwhich is not VFQL and has no grammar version, so the run carries no query\ntext rather than a fabricated version — until `rh-2mjwt2` migrates rules.\nThe run itself stays visible with its `source`, `rule_id`, state and\ntimings; only the text is absent.\n\n`translated_sql` is not here and never has been: it names Glue namespaces\nand table ids the caller never wrote."}]},"result_expired":{"type":"boolean","description":"ADR-0027 M3.3: `true` when this succeeded query's result table has expired\n(>7 days) — the run + SQL persist as history, but its results are gone and\nit's no longer requeryable/exportable. `state` stays `succeeded` (the run\ndid succeed); this annotates that the heavy data was reclaimed."},"row_count":{"type":["integer","null"],"format":"int64","description":"Result row count reported by the engine on terminal\ntransition. `None` until the engine→scheduler→api plumbing\nfor row count lands.","minimum":0},"rule_id":{"type":["string","null"]},"source":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QuerySource","description":"Where the query was issued from (artifact vs rule)."}]},"started_at":{"type":["string","null"]},"state":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryState","description":"Lifecycle state. `None` for legacy rows whose storage value\nfalls outside the typed `QueryState` set."}]},"submitted_at":{"type":["string","null"]},"team_id":{"type":["string","null"]},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_RuleResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","name","enabled","created_at","updated_at"],"properties":{"alerting":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleAlerting","description":"What the rule's matches become (ADR-0067 §3); absent on a rule that\nnever alerts."}]},"covered_through":{"type":["string","null"],"description":"The instant this rule has scanned **every** one of its source tables\nthrough (REQ-013). Read-only: it appears here and on no request DTO, so a\ncustomer can see where the ledger has reached and cannot move it.\n\nThe **minimum** `committed_at` across the bookmark map, not the maximum:\na rule has covered everything committed through that instant on all of\nits tables, and a maximum would overstate coverage by the laggard's lag.\n\n`None` while the rule has no bookmarks, and `None` while any bookmark is\nstill a baseline — see [`Self::covered_through_of`]."},"created_at":{"type":"string"},"description":{"type":["string","null"]},"enabled":{"type":"boolean"},"id":{"type":"string"},"last_run_at":{"type":["string","null"]},"last_run_status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleRunStatus"}]},"name":{"type":"string"},"next_run_at":{"type":["string","null"]},"org_id":{"type":"string"},"owner_team_id":{"type":["string","null"]},"query":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryText"}]},"schedule":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleStatus"}]},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_RuleRunResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","rule_id","created_at"],"properties":{"completed_at":{"type":["string","null"]},"created_at":{"type":"string"},"deltas":{"type":"object","description":"The ingestion-time window this run scanned on each source table, keyed on\n`table_id` and carried through from [`RuleRunItem`].\n\n⚠️ **The stored row carries this and the wire has to as well**, or\n`docs/vfql.md` § *What you can see* — *\"Every run records what it was\ngiven … when a run comes back empty, that is the first thing to read\"* —\ndescribes a procedure no API response makes possible. It is also the\naudit read: *which snapshots did this alert come from* is the first\nquestion asked of a false positive (REQ-012).\n\nEmpty — not absent — for a run that bound no delta (a manual run, or one\ndispatched before the field existed), so a reader never has to\ndistinguish \"no tables\" from \"field missing\".","additionalProperties":{"$ref":"#/components/schemas/RunDelta"},"propertyNames":{"type":"string"}},"error_message":{"type":["string","null"]},"id":{"type":"string"},"org_id":{"type":"string"},"rule_id":{"type":"string"},"started_at":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleRunStatus"}]}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_SourceResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","description":"`Source` wire shape. `attached_table_id` present ⇒ the source is enabled.\nCarries the read pipeline (`ingestion`), the declared `output_schema`, and\nthe template lineage — and no category: source means ingestion (ADR-0069).","required":["id","org_id","name","created_at","updated_at"],"properties":{"attached_table_id":{"type":["string","null"]},"created_at":{"type":"string"},"cwl_observed_retention":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ObservedRetention"}]},"description":{"type":["string","null"]},"http_credential":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HttpCredentialScheme","description":"The HTTP source's credential as the wire sees it — scheme and\nnon-secret parameters only. The stored ciphertext has no field on this\ntype to reach the wire through ([`SealedHttpCredential`] is not a schema\ntype)."}]},"id":{"type":"string"},"ingestion":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/IngestionSourceConfig"}]},"name":{"type":"string"},"org_id":{"type":"string"},"output_schema":{"type":"array","items":{"$ref":"#/components/schemas/OutputColumnDef"}},"owner_team_id":{"type":["string","null"]},"template_id":{"type":["string","null"]},"template_version":{"type":["integer","null"],"format":"int32","minimum":0},"updated_at":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"},"description":"Non-fatal advisories surfaced at create/update time (e.g. short CWL\nretention). Never persisted."}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_TableResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","name","population","kind","max_versions","columns","row_count","size_bytes","is_system","is_managed","is_readonly","created_at","updated_at"],"properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/ColumnDef"}},"created_at":{"type":"string"},"description":{"type":["string","null"]},"id":{"type":"string"},"is_managed":{"type":"boolean","description":"True iff Vigilfield provisioned and owns this table's lifecycle (the\ntable analogue of `DatabaseItem.is_managed`). Team-visible but\ncustomer-immutable. Sourced from `TableItem.is_managed`; api-only."},"is_readonly":{"type":"boolean","description":"True iff the customer may **not** mutate this table (alter / delete):\n`is_readonly = is_system || is_managed`. The UI gates its edit/delete\naffordances on this single flag rather than re-deriving the rule."},"is_system":{"type":"boolean","description":"True iff this row was provisioned by Vigilfield as a built-in\nsystem table (lives in the per-org system database; the admin\nUI renders a `System` badge + hides edit/delete affordances).\nSourced directly from the storage row (`TableItem.is_system`),\nwhich is settable only by the api itself — customers can't\ntoggle this via create / update."},"kind":{"$ref":"#/components/schemas/TableKind","description":"`event` or `lookup` (ADR-0028)."},"last_ingested_at":{"type":["string","null"],"description":"ISO 8601 timestamp of the last ingestion that wrote into this\ntable. Populated by the ingestion data plane via a callback the\nhandler is wired up to read; `None` until that callback exists."},"max_versions":{"type":"integer","format":"int32","description":"Lookup-table version retention (1–30). Meaningful only for `lookup`.","minimum":0},"name":{"type":"string"},"org_id":{"type":"string"},"owner_team_id":{"type":["string","null"]},"population":{"$ref":"#/components/schemas/PopulationConfig","description":"What fills the table (`source` / `rule` / `query`, ADR-0069); attached\nsources require `source`."},"result_of_query_id":{"type":["string","null"],"description":"The query whose CTAS materialized this table (ADR-0061 R5).\nPresent only on a query-result table; omitted from the JSON entirely for\nevery other, per this DTO's `skip_serializing_if` convention. snake_case\non the wire.\n\nThis is the capability the stored field buys beyond the sweep predicate:\n\"which query produced this table?\" is answerable from the API instead of by\nre-deriving a string transform outside it."},"row_count":{"type":"integer","format":"int64","description":"Aggregate row count. Aggregation against Athena\n`INFORMATION_SCHEMA` / a denormalized counter is a separate task;\nthe handler currently reports 0 here until that lands. The\nfrontend renders \"0 rows\" — same as the prior `undefined`\nfallback, but now the field is at least always on the wire.","minimum":0},"size_bytes":{"type":"integer","format":"int64","description":"Aggregate on-disk size in bytes. Same caveat as `row_count`.","minimum":0},"table_name":{"type":["string","null"]},"updated_at":{"type":"string"},"warnings":{"type":"array","items":{"$ref":"#/components/schemas/TableWarning"},"description":"Non-fatal warnings the api wants the customer to see. Empty for\nlist / get responses; populated on create / update when the\nrequest crossed a threshold worth flagging (e.g. CloudWatch Logs\nretention too short for safe recovery — see #424). Each warning\ncarries a stable `code` the frontend can switch on."}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_TeamResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","name","member_ids","member_count","is_system","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"description":{"type":["string","null"]},"external_id":{"type":["string","null"]},"external_idp_id":{"type":["string","null"],"description":"FK to the `IdpRecord` that SCIM-pushed this team. The\nadmin UI keys off this to render the \"Managed by …\" badge and\nhide local edit affordances; the api enforces it server-side\nvia the `is_externally_managed` predicate in `team::handler`."},"id":{"type":"string"},"is_system":{"type":"boolean","description":"True iff this row was provisioned by Vigilfield as the per-org\nsystem team (owner FK target for the system database + its\nbuilt-in tables). Customer-immutable on the same handler\nrejection path as `external_idp_id`. Sourced directly\nfrom the storage row (`TeamItem.is_system`)."},"member_count":{"type":"integer","format":"int32","description":"`member_ids.len()` — surfaced so cards/lists don't have to compute it\n(and so paginated list responses with truncated member arrays still\nexpose the real total).","minimum":0},"member_ids":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"org_id":{"type":"string"},"source":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/TeamSource"}]},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"PaginatedResponse_UserResponse":{"type":"object","required":["data","total","page","page_size","total_pages"],"properties":{"data":{"type":"array","items":{"type":"object","required":["id","org_id","email","is_admin","team_ids","kind","created_at","updated_at"],"properties":{"avatar":{"type":["string","null"]},"created_at":{"type":"string"},"email":{"type":"string"},"id":{"type":"string"},"is_admin":{"type":"boolean"},"kind":{"$ref":"#/components/schemas/UserKind","description":"Principal kind. Falls back to `Native` for any row\nwritten before #496 PR A (via `UserKind`'s `Default` impl)."},"last_login_at":{"type":["string","null"]},"name":{"type":["string","null"]},"org_id":{"type":"string"},"provisioned_by":{"type":["string","null"]},"role":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserRole"}]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserStatus"}]},"status_unrecognized":{"type":["string","null"]},"team_ids":{"type":"array","items":{"type":"string"}},"updated_at":{"type":"string"}}}},"page":{"type":"integer","minimum":0},"page_size":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"total_pages":{"type":"integer","minimum":0}}},"ParamValue":{"oneOf":[{"type":"object","required":["bool"],"properties":{"bool":{"type":"boolean"}}},{"type":"object","required":["int"],"properties":{"int":{"type":"integer","format":"int64"}}},{"type":"object","required":["real"],"properties":{"real":{"type":"number","format":"double"}}},{"type":"object","required":["str"],"properties":{"str":{"type":"string"}}},{"type":"object","description":"`#[schema(value_type = String)]` for the same reason as `unit` below:\n`utoipa` is pinned without its `chrono` feature, so `DateTime`\nhas no `ToSchema`. The wire already spells an instant as a string --\nserde emits RFC 3339 through chrono -- so this is what the payload is,\nnot a stand-in for it.","required":["date_time"],"properties":{"date_time":{"type":"string","description":"`#[schema(value_type = String)]` for the same reason as `unit` below:\n`utoipa` is pinned without its `chrono` feature, so `DateTime`\nhas no `ToSchema`. The wire already spells an instant as a string --\nserde emits RFC 3339 through chrono -- so this is what the payload is,\nnot a stand-in for it."}}},{"type":"object","required":["timespan"],"properties":{"timespan":{"type":"object","required":["value","unit"],"properties":{"unit":{"type":"string","description":"`#[schema(value_type = String)]` so `vfql` needs no `utoipa`\ndependency of its own. The cost is that OpenAPI shows a string\nwithout enumerating the units; `docs/vfql-compatibility.md` and the\ngrammar publish them, and the compiler refuses an unknown one."},"value":{"type":"number","format":"double"}}}}}],"description":"A value supplied for a declared query parameter.\n\nOne variant per JSON shape a request body can carry, plus the two the wire\nspells as strings and the caller parses — an instant and a timespan. The\ncompiler binds by **declared** type, so this enum says what arrived, never\nwhat it means.\n\n`Serialize`/`Deserialize` because the golden corpus carries bound values and\nis read by **two** crates — the golden test here and the preprocessor's\nround-trip test — so a case's parameters are decoded into this type rather\nthan re-typed as a fixture in each. Variants and fields are snake_case, per\nthe root `AGENTS.md`'s wire rule.\n`utoipa::ToSchema` **in place** rather than a mirror in the DTO layer\n(`POST /queries/compile`, R3). This is the type that decides how a supplied\nvalue is *bound*, which is the injection property; a second spelling in the\nwire layer is the one thing that could drift from it. A schema derive reads\nthe type and adds no clock, no filesystem and no network, so the crate's\nstated purity is untouched."},"PatchAppRequest":{"type":"object","description":"`PATCH /apps/{id}` body. Every field optional — absent\nmeans unchanged. `role` cannot be moved to admin/owner (rejected\nat the handler).","properties":{"description":{"type":["string","null"]},"name":{"type":["string","null"]},"owner_user_id":{"type":["string","null"],"description":"Handoff lever — reassign the app from Alice to Bob before Alice\ngets deprovisioned. Must name an **active, non-app** user in the\ncaller's org; the handler rejects anything else with `400`.\n\nNot \"an admin\", which an earlier wording said: the holder of\n`apps:write` is routinely a non-admin now, so a rule naming\nadmins would contradict the gate in the same file. Active, because the\nfield's one consumer is the deprovisioning handoff gate — handing off to\na deprovisioned user recreates what that gate exists to prevent.\nNon-app, because an App owning an App is a cycle\nthe same gate would chase."},"published":{"type":["boolean","null"],"description":"ADR-0050 §6 catalog flag. Defaults to `false`. Inert — nothing reads it\nfor any decision today."},"required_permissions":{"type":["array","null"],"items":{"type":"string"},"description":"The `resource:action` manifest this app declares it needs\n(ADR-0050 §1). Absent and `[]` are both legal and both mean \"declares\nnothing\"; declaring confers **nothing** — the bound is the installer's\nauthority at install time. Validated on write: every token must parse and\nmust not name an owner-only lever."},"role":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserRole"}]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserStatus","description":"Lifecycle state — admin can pause an app (`active` → `inactive`\nand back). `pending` is rejected at the handler — apps activate\nat create time, no signup flow."}]},"team_ids":{"type":["array","null"],"items":{"type":"string"}}}},"PatchBillingRequest":{"type":"object","properties":{"annual_discount_percent":{"type":["integer","null"],"format":"int32","minimum":0},"auto_topup_enabled":{"type":["boolean","null"],"description":"Auto-top-up: enable auto-buying packs as a dimension nears its\nceiling, the trigger threshold (% of ceiling; default 90), and the refill\npacks per trigger (default 1). Bounded by the monthly top-up spend cap."},"auto_topup_packs":{"type":["integer","null"],"format":"int64","minimum":0},"auto_topup_threshold_pct":{"type":["integer","null"],"format":"int32","minimum":0},"billing_period":{"type":["string","null"]},"gb_exported_limit":{"type":["integer","null"],"format":"int64","minimum":0},"gb_ingested_limit":{"type":["integer","null"],"format":"int64","description":"Per-org usage-limit **overrides** in decimal GB. Set a value to\npin a custom ceiling (e.g. a negotiated Enterprise contract); omit to\nleave the tier default in force. Like `retention_days`, this patch only\nsets — it can't clear an override back to the default.","minimum":0},"gb_scanned_limit":{"type":["integer","null"],"format":"int64","minimum":0},"gb_stored_limit":{"type":["integer","null"],"format":"int64","minimum":0},"plan_tier":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PlanTier","description":"Renamed from `plan` for symmetry with `OrganizationResponse.planTier`."}]},"retention_days":{"type":["integer","null"],"format":"int32","minimum":0},"stripe_customer_id":{"type":["string","null"]},"trial_ends_at":{"type":["string","null"]}}},"PatchClientRequest":{"type":"object","description":"`PATCH /clients/{id}` body — every field optional (absent = unchanged).\nChanging `scopes` re-runs the subset cap.","properties":{"name":{"type":["string","null"]},"scopes":{"type":["array","null"],"items":{"type":"string"}}}},"PatchIdentityProviderRequest":{"type":"object","properties":{"attribute_mappings":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AttributeMappings"}]},"enabled":{"type":["boolean","null"]},"scim":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ScimConfig"}]}}},"PatchRuleRequest":{"type":"object","properties":{"alerting":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleAlerting","description":"Absent leaves alerting as it is; `null` removes it; an object replaces\nit whole."}]},"description":{"type":["string","null"]},"enabled":{"type":["boolean","null"]},"name":{"type":["string","null"]},"owner_team_id":{"type":["string","null"]},"query":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryText"}]},"schedule":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleStatus"}]}}},"PatchUserRequest":{"type":"object","properties":{"avatar":{"type":["string","null"]},"email":{"type":["string","null"]},"is_admin":{"type":["boolean","null"]},"last_login_at":{"type":["string","null"]},"name":{"type":["string","null"]},"provisioned_by":{"type":["string","null"]},"role":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserStatus"}]},"team_ids":{"type":["array","null"],"items":{"type":"string"}}}},"PaymentMethodResponse":{"type":"object","description":"One saved card on the org's Stripe customer (`GET /billing/payment-methods`).\nDisplay fields only — the raw card lives in Stripe's vault, never here.","required":["id","is_default"],"properties":{"brand":{"type":["string","null"]},"expiry_month":{"type":["integer","null"],"format":"int32"},"expiry_year":{"type":["integer","null"],"format":"int32"},"id":{"type":"string"},"is_default":{"type":"boolean","description":"True for the customer's `invoice_settings.default_payment_method` — the\ncard top-up charges hit."},"last4":{"type":["string","null"]}}},"PlanCatalogFeatures":{"type":"object","description":"What differs between tiers besides volume. Every product feature is on\nevery tier (rh-j5fxxe), so this carries support and SLA and nothing else.","required":["dedicated_support","sla_guarantees"],"properties":{"dedicated_support":{"type":"boolean"},"sla_guarantees":{"type":"boolean"}}},"PlanCatalogLimits":{"type":"object","description":"Default per-month / at-rest usage limits (decimal GB) for the tier.","required":["gb_ingested","gb_scanned","gb_exported","gb_stored"],"properties":{"gb_exported":{"type":"integer","format":"int64","minimum":0},"gb_ingested":{"type":"integer","format":"int64","minimum":0},"gb_scanned":{"type":"integer","format":"int64","minimum":0},"gb_stored":{"type":"integer","format":"int64","minimum":0}}},"PlanCatalogPlan":{"type":"object","required":["tier","name","description","target_audience","monthly_cents","annual_cents","limits","features"],"properties":{"annual_cents":{"type":"integer","format":"int64","minimum":0},"description":{"type":"string"},"features":{"$ref":"#/components/schemas/PlanCatalogFeatures"},"limits":{"$ref":"#/components/schemas/PlanCatalogLimits"},"monthly_cents":{"type":"integer","format":"int64","description":"Prepaid base subscription price, integer cents. `0` = pending product\nsign-off (see `pricing-defaults.yaml`).","minimum":0},"name":{"type":"string"},"target_audience":{"type":"string"},"tier":{"$ref":"#/components/schemas/PlanTier"}}},"PlanCatalogResponse":{"type":"object","description":"The public plan catalog — the single wire source for the pricing UI,\ncomposed from the `plan-defaults.yaml` (limits) + `pricing-defaults.yaml`\n(prices) codegen + the hand-written `PLAN_CATALOG` (labels + features). Served\nunauthenticated at `GET /billing/plans` (the signup page reads it).","required":["currency","plans"],"properties":{"currency":{"type":"string"},"plans":{"type":"array","items":{"$ref":"#/components/schemas/PlanCatalogPlan"}}}},"PlanTier":{"type":"string","enum":["startup","smb","enterprise"]},"PopulationConfig":{"type":"object","description":"The populate-config the table carries (ADR-0069 Decision B): `kind` plus the\nfields that kind pairs with — `rule_id` for `rule`, `query` for `query`,\n`event_time_field` shared by the rule and query kinds.\n\n**The kind↔field pairing is create/update-time validation**\n([`Self::validate`]), not a storage invariant: the result-table sink writes\n`kind: query` with no `query` text beside `result_of_query_id`, which is the\nrun linkage that identifies the query after the fact.","required":["kind"],"properties":{"event_time_field":{"type":["string","null"],"description":"The events' custom timestamp column, when the rule's or query's events\ncarry one. The ingestion snapshot builder rides it to the writer's\npopulation rule; `None` falls through to the platform event-time column."},"kind":{"$ref":"#/components/schemas/PopulationKind"},"query":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryText","description":"The VFQL text a `query` table is a view over."}]},"rule_id":{"type":["string","null"],"description":"The rule whose output fills a `rule` table."}}},"PopulationKind":{"type":"string","description":"What fills a table (ADR-0069). `source` — an external-log feed attached to\nit; `rule` — a scheduled rule's output; `query` — a materialized view. The\nwire values are ours, so snake_case.\n\nNo `Default`, and no string form: wire parsing is serde (an unknown variant\nis a deserialization error naming the value), and there is no string\nfallback to silently default one — the silent-default failure mode\nADR-0069 deletes. Every kind-dependent decision is an exhaustive `match`\nmethod here — a fourth kind is a compile error at each one, not a silent\narm.","enum":["source","rule","query"]},"PrincipalKind":{"type":"string","enum":["user","api_key"]},"ProvisioningState":{"type":"string","description":"Where a source is in getting the access it reads with (ADR-0065).\n\n- `AwaitingRole`: what a source whose runtime assumes a customer role (S3,\n CloudWatch Logs, SQS) is created in. Nothing is provisioned at create; the\n source waits for Verify (`rh-lo8eeu.5`) to find the role it derives.\n- `Active`: ingestable, and the only state\n [`SourceItem::is_ingestion_active`] accepts. EventBridge and HTTP sources\n are created in it.\n- `Pending` and `Failed`: written by nothing since create stopped\n provisioning, and kept for Verify to use or delete. `provisioning_error`\n carries a `Failed` source's customer-facing message.\n\n`snake_case`, not `lowercase`: `lowercase` spells `AwaitingRole` as\n`awaitingrole`. The one-word variants are spelled the same either way.","enum":["pending","active","failed","awaiting_role"]},"PublicIdp":{"type":"object","description":"Minimal public projection of an `IdpRecord`. The full row (including SCIM\nconfig and attribute mappings) is admin-only via `/identity-providers`; here\nwe surface just what login.tsx needs for email-domain routing. `domains` is\nthe list of verified email domains the IdP serves.","required":["id","name","protocol","cognito_provider_name","domains"],"properties":{"cognito_provider_name":{"type":"string"},"domains":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"name":{"type":"string"},"protocol":{"type":"string"}}},"PublicIdpListResponse":{"type":"object","required":["idps"],"properties":{"idps":{"type":"array","items":{"$ref":"#/components/schemas/PublicIdp"}}}},"QueryDiagnostic":{"type":"object","description":"One problem with the query, at one place in it.","required":["kind","message","span"],"properties":{"kind":{"type":"string","description":"The stable discriminant, from `DiagnosticKind::code()`. **Branch on\nthis, never on `message`** — the message is for a person and is free to\nbe reworded; this is the contract."},"message":{"type":"string","description":"Human-readable, and the only field whose wording may change."},"span":{"$ref":"#/components/schemas/QuerySpan"}}},"QueryResponse":{"type":"object","description":"Unified wire shape for **every** query endpoint — list, submit,\nget, cancel. Mirrors `QueryItem` (the storage shape) directly;\nthe scheduler's `QueryRunItem` is an internal detail and never\nreaches the wire. Internal scheduler fields (`slot_group`,\n`priority`, `translated_sql`, `engine_query_id`,\n`cost_credits_debited`) are deliberately omitted.","required":["id","org_id","created_at","updated_at"],"properties":{"artifact_id":{"type":["string","null"]},"created_at":{"type":"string"},"data_scanned_bytes":{"type":["integer","null"],"format":"int64","minimum":0},"engine_execution_time_ms":{"type":["integer","null"],"format":"int64","minimum":0},"error_message":{"type":["string","null"]},"finished_at":{"type":["string","null"]},"id":{"type":"string"},"org_id":{"type":"string"},"output_location":{"type":["string","null"],"description":"Athena/engine output location (S3 URI)."},"principal_id":{"type":["string","null"]},"principal_kind":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PrincipalKind","description":"Who / what submitted the run. `None` on legacy rows."}]},"query":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryText","description":"The VFQL that produced this run, as the analyst typed it, with the\ngrammar version it was read under and the values bound into it — enough\nto re-display, re-edit and re-run it.\n\n⚠️ **Absent on a rule-origin run**, and that is the whole of the\ndifference (`rh-egf71u`, decided option A). A saved rule submits SQL,\nwhich is not VFQL and has no grammar version, so the run carries no query\ntext rather than a fabricated version — until `rh-2mjwt2` migrates rules.\nThe run itself stays visible with its `source`, `rule_id`, state and\ntimings; only the text is absent.\n\n`translated_sql` is not here and never has been: it names Glue namespaces\nand table ids the caller never wrote."}]},"result_expired":{"type":"boolean","description":"ADR-0027 M3.3: `true` when this succeeded query's result table has expired\n(>7 days) — the run + SQL persist as history, but its results are gone and\nit's no longer requeryable/exportable. `state` stays `succeeded` (the run\ndid succeed); this annotates that the heavy data was reclaimed."},"row_count":{"type":["integer","null"],"format":"int64","description":"Result row count reported by the engine on terminal\ntransition. `None` until the engine→scheduler→api plumbing\nfor row count lands.","minimum":0},"rule_id":{"type":["string","null"]},"source":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QuerySource","description":"Where the query was issued from (artifact vs rule)."}]},"started_at":{"type":["string","null"]},"state":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryState","description":"Lifecycle state. `None` for legacy rows whose storage value\nfalls outside the typed `QueryState` set."}]},"submitted_at":{"type":["string","null"]},"team_id":{"type":["string","null"]},"updated_at":{"type":"string"}}},"QueryResultsResponse":{"type":"object","required":["query_id","rows","page","page_size","has_more","results_may_be_incomplete"],"properties":{"has_more":{"type":"boolean","description":"Whether at least one more row exists past this page, so the UI can show\na \"next\" affordance without a separate count. Computed by reading one\nextra row beyond `page_size`."},"page":{"type":"integer","format":"int32","description":"Zero-based page index this response covers.","minimum":0},"page_size":{"type":"integer","format":"int32","description":"Effective (clamped) page size — not necessarily what the caller asked.","minimum":0},"query_id":{"type":"string"},"results_may_be_incomplete":{"type":"boolean","description":"$d1"},"rows":{"type":"array","items":{},"description":"The rows for the requested page. At most `page_size` entries."}}},"QuerySource":{"type":"string","description":"Where a query was issued from. `Investigation` for ad-hoc artifact\nruns, `Rule` for scheduled batch runs.","enum":["investigation","rule"]},"QuerySpan":{"type":"object","description":"A byte range in the submitted query text.\n\nA two-field mirror of `vfql::Span` rather than a re-export, so `vfql` gains\nno wire-annotation dependency; two `usize` fields have no drift surface worth\nnaming.","required":["start","end"],"properties":{"end":{"type":"integer","description":"End offset (exclusive), in **UTF-8 bytes**, into the submitted `text`.","minimum":0},"start":{"type":"integer","description":"Start offset, in **UTF-8 bytes**, into the `text` that was submitted —\nnot characters, and never an offset into the generated SQL, which the\nauthor never wrote and cannot act on.","minimum":0}}},"QueryState":{"type":"string","description":"Coarse lifecycle for a query run. Matches `vigilfield_workload_engine::EngineQueryState`\n1:1 with the addition of an explicit `Queued` for pre-engine queries\nthat haven't been dispatched yet (Athena's own Queued state means the\nquery was sent but isn't running; here it means the scheduler hasn't\nsent it to Athena at all).","enum":["queued","running","cancelling","succeeded","failed","cancelled"]},"QueryText":{"type":"object","description":"$d2","required":["text","vfql_version"],"properties":{"parameters":{"type":"object","description":"Values for the query's `declare query_parameters`, by name.\n\n[`ParamValue`] rather than a mirror of it: it is what decides how a value\nis **bound**, and a value that binds can never be text spliced into\n`text` (R3). A second spelling would be the one thing that could drift\nfrom that — which is the whole reason this type is here rather than in a\nDTO module.","additionalProperties":{"$ref":"#/components/schemas/ParamValue"},"propertyNames":{"type":"string"}},"text":{"type":"string","description":"The query, as the analyst typed it. Every span in the response is a byte\noffset into *this* string."},"vfql_version":{"type":"string","description":"The grammar version to parse under. Travels on the request so stored text\nre-displays, re-edits and re-compiles deterministically, and a future\ngrammar change is gated per query rather than migrating stored text.\n\n⚠️ **Not a security field** (§6). An unknown version is a 400 about the\nrequest; it denies nobody their results, because the results-access check\nparses nothing."}}},"RedeemInvitationRequest":{"type":"object","required":["secret","email"],"properties":{"email":{"type":"string","description":"Recipient must echo back the email the invite was issued to.\nThe row also stores the email, so this is belt + suspenders:\nprevents a leaked link from being redeemed by a different\naccount."},"name":{"type":["string","null"],"description":"User's chosen display name. The api persists this on the new\nuser row."},"secret":{"type":"string","description":"The random secret from the emailed link's fragment — the credential.\nSee [`InvitationLookupRequest`] for why it travels in the body."}}},"RedeemedInvitationResponse":{"type":"object","description":"$d3","required":["user_id","org_id"],"properties":{"org_id":{"type":"string"},"org_slug":{"type":["string","null"]},"user_id":{"type":"string"}}},"RefreshRequest":{"type":"object","description":"`POST /auth/refresh`'s **wire** request (`rh-cl95c` D5).\n\nThe refresh token is gone from the body: it lives in the `HttpOnly`\n`__Host-vf_refresh` cookie, which page script cannot read and therefore\ncannot put here. The transport reads the cookie and builds [`RefreshInput`]\nfrom `{cookie, body.slug}`.\n\n⚠️ **This type and [`RefreshInput`] are deliberately separate**, and\ncollapsing them back into one is the change to refuse. The cookie is a\n*transport* concern; the port speaks `(slug, refresh_token)` and knows\nnothing about how the credential arrived. One type for both would put the\ncookie's shape into the domain and would make the wire contract change every\ntime the transport did.","required":["slug"],"properties":{"slug":{"type":"string","description":"Org subdomain the refresh was issued under (matches the\nslug used in `GET /auth/config?slug=…` and the browser's\n`.vigilfield.com` URL)."}}},"RefreshResponse":{"type":"object","description":"`POST /auth/refresh`'s **wire** response.\n\nNo tokens. The new access token and its expiry go back as `Set-Cookie`\nheaders ([`crate::session`]); `expires_in` stays on the body only because a\ncaller that is *not* a browser — there is none today — would otherwise have\nno way to read it, and because it documents the renewal cadence in the spec.\nThe client reads the expiry from the `__Host-vf_expires_at` cookie, which is\nset in the same response and cannot drift from the credential beside it.\n\n⚠️ `vf_refresh` is **not** re-emitted. Cognito's `REFRESH_TOKEN_AUTH` returns\nno new refresh token, so re-setting the cookie would either write the same\nvalue again or write an empty one; the browser keeps the cookie it has and a\nsecond renewal works.","required":["expires_in"],"properties":{"expires_in":{"type":"integer","format":"int64"}}},"ReplayRequest":{"type":"object","description":"Wire shape for `POST /tables/{id}/replay`.\n\n`[fromTime, toTime)` is the half-open range the scheduler will\nre-pull through the existing CWL window pipeline. Cursor regression\nfor replay is intentional — the worker's MERGE-on-\n`(_cwl_log_stream, _cwl_event_id)` dedup absorbs duplicates, and\nthe snapshot-summary `max(window_end, prev_cursor)` rule keeps the\nin-Iceberg cursor from regressing past the current high-water.","required":["from_time","to_time"],"properties":{"from_time":{"type":"string","description":"ISO 8601 UTC start of the replay range. Inclusive."},"to_time":{"type":"string","description":"ISO 8601 UTC end of the replay range. Exclusive."}}},"ReplayResponse":{"type":"object","required":["windows_enqueued"],"properties":{"windows_enqueued":{"type":"integer","format":"int32","description":"Number of `WindowJob`s the api enqueued onto the CWL ingest\nqueue. Equal to `ceil((to_time - from_time) / catchup_window_secs)`\nin steady-state; can be less if the SQS send loop hit a\ntransient error after partial progress.","minimum":0}}},"RoleTemplateResponse":{"type":"object","description":"`GET /sources/{id}/iam-template` — everything the customer deploys, and the\none bit (`identity_provider_known`) that says whether the provider snippet\nis already in their account. `trust_policy`, `permissions_policy` and\n`cloudformation_yaml` are byte-identical whether or not the source has\nverified (AC-8/F16 covers exactly those three).","required":["role_arn","account_id","region","token_subject","federation_issuer","trust_policy","permissions_policy","cloudformation_yaml","oidc_provider_cloudformation_yaml","identity_provider_known"],"properties":{"account_id":{"type":"string"},"cloudformation_yaml":{"type":"string"},"federation_issuer":{"type":"string"},"identity_provider_known":{"type":"boolean"},"oidc_provider_cloudformation_yaml":{"type":"string"},"permissions_policy":{"type":"string"},"region":{"type":"string"},"role_arn":{"type":"string"},"token_subject":{"type":"string"},"trust_policy":{"type":"string"}}},"RuleAlerting":{"type":"object","description":"What a rule's matches become (ADR-0067 §3). Absent means the rule never\nalerts. One type at rest and on the wire — the idiom [`QueryText`] and\n[`TableBookmark`] follow.\n\nValidated in logic (`validate_alerting`), not in a `try_from` type: a stored\nrow that a later, tighter constant rejects would fail to deserialize and\ntake the whole `list` with it.","required":["severity"],"properties":{"destination_ids":{"type":"array","items":{"type":"string"},"description":"Alert destination ids (rh-rde2vd.4). Checked for shape only — whether\none belongs to the rule's team is rh-o0dc0c."},"severity":{"$ref":"#/components/schemas/AlertSeverity","description":"Every alert this rule opens carries it: per rule, not per row."}}},"RuleResponse":{"type":"object","required":["id","org_id","name","enabled","created_at","updated_at"],"properties":{"alerting":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleAlerting","description":"What the rule's matches become (ADR-0067 §3); absent on a rule that\nnever alerts."}]},"covered_through":{"type":["string","null"],"description":"The instant this rule has scanned **every** one of its source tables\nthrough (REQ-013). Read-only: it appears here and on no request DTO, so a\ncustomer can see where the ledger has reached and cannot move it.\n\nThe **minimum** `committed_at` across the bookmark map, not the maximum:\na rule has covered everything committed through that instant on all of\nits tables, and a maximum would overstate coverage by the laggard's lag.\n\n`None` while the rule has no bookmarks, and `None` while any bookmark is\nstill a baseline — see [`Self::covered_through_of`]."},"created_at":{"type":"string"},"description":{"type":["string","null"]},"enabled":{"type":"boolean"},"id":{"type":"string"},"last_run_at":{"type":["string","null"]},"last_run_status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleRunStatus"}]},"name":{"type":"string"},"next_run_at":{"type":["string","null"]},"org_id":{"type":"string"},"owner_team_id":{"type":["string","null"]},"query":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryText"}]},"schedule":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleStatus"}]},"updated_at":{"type":"string"}}},"RuleRunResponse":{"type":"object","required":["id","org_id","rule_id","created_at"],"properties":{"completed_at":{"type":["string","null"]},"created_at":{"type":"string"},"deltas":{"type":"object","description":"The ingestion-time window this run scanned on each source table, keyed on\n`table_id` and carried through from [`RuleRunItem`].\n\n⚠️ **The stored row carries this and the wire has to as well**, or\n`docs/vfql.md` § *What you can see* — *\"Every run records what it was\ngiven … when a run comes back empty, that is the first thing to read\"* —\ndescribes a procedure no API response makes possible. It is also the\naudit read: *which snapshots did this alert come from* is the first\nquestion asked of a false positive (REQ-012).\n\nEmpty — not absent — for a run that bound no delta (a manual run, or one\ndispatched before the field existed), so a reader never has to\ndistinguish \"no tables\" from \"field missing\".","additionalProperties":{"$ref":"#/components/schemas/RunDelta"},"propertyNames":{"type":"string"}},"error_message":{"type":["string","null"]},"id":{"type":"string"},"org_id":{"type":"string"},"rule_id":{"type":"string"},"started_at":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleRunStatus"}]}}},"RuleRunStatus":{"type":"string","description":"Per-execution status for a `RuleRun`. Matches what the rule-runner\nworker writes back to `RuleRunItem.status` (see\n`vigilfield/api/rule/tests/integration.rs`'s `run(..)` helper\nfor the canonical seed values).","enum":["PENDING","RUNNING","SUCCEEDED","FAILED"]},"RuleStatus":{"type":"string","description":"Rule-definition lifecycle. `Active` runs on schedule; `Paused`\nskips ticks without deleting the row. Storage\n(`RuleItem.status: Option`) is unchanged.","enum":["ACTIVE","PAUSED"]},"RunDelta":{"type":"object","description":"What one run actually scanned on one source table: the half-open snapshot\ndelta `(from, to]`, recorded at dispatch.\n\n⚠️ **Recorded, so `reconcile` advances the rule's bookmark from what the run\nreally read** rather than recomputing it from the rule as it stands at\nreconcile time — a `PATCH` between dispatch and reconcile would otherwise\nmove the bookmark past a snapshot no run ever scanned. It is also what makes\na run auditable months later, which is the first question asked of a false\npositive (REQ-012); run history is kept six months.","required":["from","to"],"properties":{"from":{"$ref":"#/components/schemas/TableBookmark","description":"Exclusive lower bound — the version the previous run finished at,\n**resolved** from the stored anchor instant at dispatch (so its\n`snapshot_id` is the concrete version this run actually scanned from,\naudit rather than address). Equal to `to` on a table with no bookmark,\nwhich scans nothing."},"to":{"$ref":"#/components/schemas/TableBookmark","description":"Inclusive upper bound — the table's current version at dispatch.\n\n⚠️ **This is the bookmark `reconcile` stores verbatim on success**, so\nits `baseline` is the value the *rule's* pin will carry — decided at\ndispatch (`rh-ajw5au`), not recomputed later. It is `true` only while\nthe pin has still scanned nothing: a quiet table stays a baseline, one\nthat actually advanced stops being one."}}},"S3Destination":{"type":"object","description":"The S3 coordinates of an [`ExportDestination`]. `kms_key_arn` is the\nonly optional field; everything else is required and shape-validated\nat create ([`Self::validate_shape`]).","required":["bucket","prefix","connection"],"properties":{"bucket":{"type":"string","description":"Bucket exports land in."},"connection":{"$ref":"#/components/schemas/DestinationConnection","description":"The customer's connection the delivery assumes through."},"kms_key_arn":{"type":["string","null"],"description":"When set, written objects carry this KMS key in their SSE\nheader; when absent the bucket's default encryption applies."},"prefix":{"type":"string","description":"Prefix the export is written under —\n`//`."}}},"SamlConfig":{"type":"object","properties":{"metadata_url":{"type":["string","null"],"description":"XML metadata URL (preferred) — Cognito can pull config from here."},"metadata_xml":{"type":["string","null"],"description":"Raw XML metadata document, alternative to `metadata_url`."},"sign_requests":{"type":"boolean","description":"Whether to require the IdP to sign requests. Most production IdPs do."}}},"ScimBearerRotationResponse":{"type":"object","description":"Response body for `POST /identity-providers/{id}/scim/bearer-tokens`.\nCarries the freshly-rotated plaintext bearer — surfaced to\nthe caller exactly once. Subsequent reads of the IdpRecord never\necho it (the persisted row only carries the hash).","required":["bearer_token","rotated_at"],"properties":{"bearer_token":{"type":"string","description":"64 hex chars (32 bytes / 256 bits of entropy). Caller copies\nthis once and configures their SCIM client with it; lose it\nand the only recovery is another rotation."},"rotated_at":{"type":"string","description":"Timestamp the rotation completed. Matches the `updated_at`\nthat lands on the IdpRecord row."}}},"ScimConfig":{"type":"object","properties":{"sync_groups":{"type":"boolean"},"sync_users":{"type":"boolean"}}},"ScimEmail":{"type":"object","properties":{"primary":{"type":"boolean"},"type":{"type":["string","null"],"description":"SCIM email entries carry a `type` field (work / home / …); we\ndon't act on it but accept it on the wire."},"value":{"type":["string","null"]}}},"ScimGroupBody":{"type":"object","required":["displayName"],"properties":{"displayName":{"type":"string"},"externalId":{"type":["string","null"]},"members":{"type":"array","items":{"$ref":"#/components/schemas/ScimGroupMember"}}}},"ScimGroupMember":{"type":"object","required":["value"],"properties":{"type":{"type":["string","null"]},"value":{"type":"string","description":"Vigilfield user id. SCIM clients pass through the value they got\nfrom our `/scim/v2/Users` create response, so this is always our\nown id — never the IdP's external user id."}}},"ScimGroupPatchOp":{"type":"object","required":["Operations"],"properties":{"Operations":{"type":"array","items":{"$ref":"#/components/schemas/ScimGroupPatchOperation"}}}},"ScimGroupPatchOperation":{"type":"object","required":["op"],"properties":{"op":{"type":"string"},"path":{"type":["string","null"]},"value":{}}},"ScimName":{"type":"object","properties":{"familyName":{"type":["string","null"]},"formatted":{"type":["string","null"]},"givenName":{"type":["string","null"]}}},"ScimUserBody":{"type":"object","properties":{"active":{"type":"boolean","description":"SCIM-side toggle. `false` means deprovisioned. We map to\n`UserItem.status = \"active\" | \"inactive\"`."},"displayName":{"type":["string","null"]},"emails":{"type":"array","items":{"$ref":"#/components/schemas/ScimEmail"}},"externalId":{"type":["string","null"]},"name":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ScimName"}]},"userName":{"type":["string","null"]}}},"ScimUserPatchOp":{"type":"object","required":["Operations"],"properties":{"Operations":{"type":"array","items":{"$ref":"#/components/schemas/ScimUserPatchOperation"}}}},"ScimUserPatchOperation":{"type":"object","required":["op","value"],"properties":{"op":{"type":"string"},"path":{"type":["string","null"]},"value":{}}},"SeedTableRequest":{"type":"object","description":"The starter table to seed alongside a source create.","required":["name"],"properties":{"description":{"type":["string","null"]},"kind":{"type":["string","null"],"description":"Starter-table kind (ADR-0028) — `event` (append, default) or `lookup`\n(versioned full-replace) — for the starter table this seeds alongside\nthe source. Unknown/absent ⇒ `event`. A plain string here keeps the\nsource crate decoupled from the table crate's `TableKind`; the seed flow\nparses it via `TableKind::from_wire_str`."},"name":{"type":"string"}}},"SessionRequest":{"type":"object","description":"`POST /auth/session`'s request body — the tokens the browser just minted.\n\n⚠️ **No `id_token`, deliberately.** The design listed one; nothing reads it.\nIts only former job was to be decoded by the app for the principal, which is\nwhat [`SessionResponse`] now carries — and `rh-cl95c` R1 says the id token is\nnever stored anywhere. A credential the server accepts and discards is a\ncredential that shows up in a request log or an error capture for no\nbenefit, so the field is absent rather than ignored.\n\n⚠️ **No `Debug`, deliberately.** Both fields are live credentials, and a\n`Debug` impl is how one ends up in a `tracing` line or a panic message.","required":["access_token","refresh_token"],"properties":{"access_token":{"type":"string","description":"The Cognito **access** token. Verified here exactly as it would be on\nany other request — signature, `iss`, `exp`, `aud`, `token_use`, the\nclosed trusted-issuer set, the org-header match and the #317\nsession-revocation check. Without that this endpoint would set a cookie\nfrom an attacker-chosen string."},"refresh_token":{"type":"string","description":"The Cognito **refresh** token. Not verified — it is opaque to us and\nonly Cognito can judge it; it is stored in the `__Host-vf_refresh`\ncookie and presented back at `POST /auth/refresh`, where Cognito does.\n\nA caller who supplies a *wrong* refresh token here has only made their\nown future renewal fail, because the access token above is what\nauthenticated this request."}}},"SessionResponse":{"type":"object","description":"`POST /auth/session`'s response — the caller's own row plus the one field it\ndoes not carry.\nNo `Deserialize`: the shared [`UserResponse`] it nests is serialize-only, and\nnothing in the tree reads this shape back.","required":["user","organization_slug"],"properties":{"organization_slug":{"type":"string","description":"The org's subdomain slug — the app's own hostname, and the value it\nsends back as `RefreshRequest.slug` on every renewal.\n\nA `String`, not an `Option`: a session cannot be renewed without it, so\nan org row carrying no slug is a provisioning defect and the endpoint\nfails rather than handing the app a session it cannot keep alive."},"user":{"$ref":"#/components/schemas/UserResponse","description":"The signed-in user, byte-identical to `GET /users/me`'s body. Nested\nrather than flattened so the shared DTO's schema is reused as-is and the\napp's `UserResponse` type keeps one definition."}}},"SetPasswordRequest":{"type":"object","required":["token","password"],"properties":{"password":{"type":"string","description":"New password. Validated against Cognito's pool policy\nserver-side; clients should also enforce minimum length 8."},"token":{"type":"string","description":"The signed setup token from the email link / invitation\nredemption response."}}},"SetPasswordResponse":{"type":"object","required":["user_id","org_id","email"],"properties":{"email":{"type":"string"},"org_id":{"type":"string"},"user_id":{"type":"string"}}},"SetStorageKeyRequest":{"type":"object","description":"`PUT /storage-key` body — set (or replace) the org's storage key.","required":["connection","key_arn"],"properties":{"account_id":{"type":["string","null"],"description":"The customer's confirmation of the account the key lives in, as the\niam-template route rendered it. Optional; the ARN stays authoritative —\na supplied value must equal the account parsed from `key_arn`, or the\nPUT is refused before anything is written. Never stored."},"connection":{"$ref":"#/components/schemas/StorageKeyConnection","description":"The org's connection to the key's cloud — `aws`. No default: nothing\nis deployed, so a request names the type explicitly."},"key_arn":{"type":"string","description":"AWS KMS key ARN (us-east-1) the org's data is encrypted under."}}},"SetupIntentResponse":{"type":"object","description":"`POST /billing/setup-intent` result — the client secret the browser hands to\nStripe Elements to vault + attach a card (no card data touches us).","required":["client_secret"],"properties":{"client_secret":{"type":"string"}}},"SkippedResource":{"type":"object","description":"A resource the selection named or found but rendered no role for, with the\nreason — surfaced, never silently dropped.","required":["kind","id","reason"],"properties":{"id":{"type":"string"},"kind":{"type":"string","description":"`source` — the one derived-role kind a bulk document renders today."},"reason":{"type":"string"}}},"SnsConnection":{"type":"object","description":"An SNS destination's connection: which cloud it publishes through, and the\nAWS identity the topic lives in. One type serves the wire in, the wire out,\nand the stored row — the shapes are identical by design, so there is no\nwire↔store translation anywhere.","required":["type","account_id","region"],"properties":{"account_id":{"type":"string","description":"12-digit AWS account id, trimmed."},"region":{"type":"string","description":"AWS region code (`us-east-1`), trimmed."},"type":{"$ref":"#/components/schemas/ConnectionType","description":"Which cloud this connection reaches — `aws` for an SNS destination\n(`validated_config` refuses `https`)."}}},"SnsDestinationInput":{"type":"object","required":["topic_arn","connection"],"properties":{"connection":{"$ref":"#/components/schemas/SnsConnection","description":"Which cloud the destination publishes through and the identity the\ntopic lives in."},"topic_arn":{"type":"string"}}},"SnsDestinationResponse":{"type":"object","required":["topic_arn","connection"],"properties":{"connection":{"$ref":"#/components/schemas/SnsConnection"},"topic_arn":{"type":"string"}}},"SourceConnection":{"type":"object","description":"The customer's AWS account and region a source reads from (ADR-0065). Only\nwhat the customer typed: the role is derived from the account and the\nsource id (`vf-source-`) and never stored.","required":["type","account_id","region"],"properties":{"account_id":{"type":"string","description":"12-digit AWS account id, trimmed."},"region":{"type":"string","description":"AWS region code (`us-east-1`), trimmed."},"type":{"$ref":"#/components/schemas/ConnectionType","description":"Which cloud this connection reaches. The role-assuming fetchers\nrequire `aws` — `RoleScope::parse` refuses `https`."}}},"SourceConnectionInput":{"type":"object","description":"The customer's AWS account and region on the create input (ADR-0065).\nRequired for the fetchers that assume a customer role (S3, CloudWatch Logs,\nSQS), refused for the rest. Both values are trimmed and shape-checked at\ncreate; the role is derived from the account and never taken as input.\n\n`#[serde(default)]` and `#[schema(required = true)]` together, on purpose:\nthe default turns a missing key into a blank the handler refuses with a 400\nnaming the field (without it the router answers 422), and `required` keeps\nthe published schema honest, since utoipa marks a `serde(default)` field\noptional otherwise.","required":["type","account_id","region"],"properties":{"account_id":{"type":"string","description":"12-digit AWS account id."},"region":{"type":"string","description":"AWS region code, such as `us-east-1`."},"type":{"$ref":"#/components/schemas/ConnectionType","description":"Which cloud the connection reaches. The role-assuming fetchers require\n`aws`."}}},"SourceMetricsPoint":{"type":"object","description":"One hourly bucket of ingestion counters (ADR-0036 M3b).","required":["bucket_ts","bytes","records","errors"],"properties":{"bucket_ts":{"type":"string","description":"RFC3339 hour key, e.g. `2026-07-25T14:00:00Z`."},"bytes":{"type":"integer","format":"int64"},"errors":{"type":"integer","format":"int64"},"records":{"type":"integer","format":"int64"}}},"SourceMetricsResponse":{"type":"object","description":"`GET /sources/{id}/metrics` response (ADR-0036 M3b.3) — the source detail\npage's three graph series, one point per hourly bucket, ascending by time.","required":["buckets"],"properties":{"buckets":{"type":"array","items":{"$ref":"#/components/schemas/SourceMetricsPoint"}}}},"SourceResponse":{"type":"object","description":"`Source` wire shape. `attached_table_id` present ⇒ the source is enabled.\nCarries the read pipeline (`ingestion`), the declared `output_schema`, and\nthe template lineage — and no category: source means ingestion (ADR-0069).","required":["id","org_id","name","created_at","updated_at"],"properties":{"attached_table_id":{"type":["string","null"]},"created_at":{"type":"string"},"cwl_observed_retention":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ObservedRetention"}]},"description":{"type":["string","null"]},"http_credential":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HttpCredentialScheme","description":"The HTTP source's credential as the wire sees it — scheme and\nnon-secret parameters only. The stored ciphertext has no field on this\ntype to reach the wire through ([`SealedHttpCredential`] is not a schema\ntype)."}]},"id":{"type":"string"},"ingestion":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/IngestionSourceConfig"}]},"name":{"type":"string"},"org_id":{"type":"string"},"output_schema":{"type":"array","items":{"$ref":"#/components/schemas/OutputColumnDef"}},"owner_team_id":{"type":["string","null"]},"template_id":{"type":["string","null"]},"template_version":{"type":["integer","null"],"format":"int32","minimum":0},"updated_at":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"},"description":"Non-fatal advisories surfaced at create/update time (e.g. short CWL\nretention). Never persisted."}}},"SourceVerificationResponse":{"type":"object","description":"`POST /sources/{id}/verifications` success body — exactly these fields and\nno more (AC-17): the audit trail stores it verbatim, so it carries no name,\ndescription, VRL or schema.","required":["source_id","provisioning_state","role_arn"],"properties":{"provisioning_state":{"type":"string"},"role_arn":{"type":"string"},"source_id":{"type":"string"},"topic_arn":{"type":["string","null"],"description":"S3 only: the topic ARN AWS answered (which may differ from the\ncomposed name — Verify stores the answered one, R9)."}}},"SqsSourceConfig":{"type":"object","description":"Fetcher config for the SQS pull transport (`SqsDirect`): the customer's own\nqueue, which the worker receives from under a role in the customer's\naccount (ADR-0004). The IAM template scopes the role's receive/delete grant\nto this ARN, and the worker derives the queue URL and region from it. Create\nrefuses a queue outside the source's `aws` account and region.","required":["queue_arn"],"properties":{"queue_arn":{"type":"string","description":"`arn:aws:sqs:::`."}}},"StageRef":{"type":"object","description":"A reference to a registered stage implementation in the internal catalog\n(`vigilfield_ingestion_stages`, ADR-0023): which fetcher acquires\nthis source's raw bytes / which deserializer parses them, pinned to a\nversion. Changing either field is a source-schema-affecting edit — every\npath that can make one re-runs the ADR-0022 `S ≼ T` gate before it rolls.","required":["id","version"],"properties":{"id":{"type":"string","description":"Catalog id (`\"S3\"`, `\"CloudWatchLogs\"`, `\"JSON\"`, `\"CLOUDTRAIL_S3\"`, …)."},"version":{"type":"integer","format":"int32","description":"Pinned implementation version. Tier 1 pins the catalog's registered\nversion at write time; a bump whose output contract changes rolls\nthrough the compatibility gate.","minimum":0}}},"StorageKeyConnection":{"type":"object","description":"A storage key's connection: which cloud the key lives in. A storage key has\nno account or region of its own — the key ARN carries both — so the\nconnection is the type alone, and the type must be `aws`\n(`set_storage_key_for` refuses `https`).","required":["type"],"properties":{"type":{"$ref":"#/components/schemas/ConnectionType"}}},"StorageKeyIamTemplateResponse":{"type":"object","description":"`GET /storage-key/iam-template` — the four ADR-0066 deployment artifacts,\nrendered for the requested account. A pure read: no storage-key row, no\nAWS call.","required":["role_arn","account_id","region","token_subject","federation_issuer","trust_policy","permissions_policy","cloudformation_yaml","new_key_cloudformation_yaml","key_policy_statement","oidc_provider_cloudformation_yaml","identity_provider_known","deployment_order"],"properties":{"account_id":{"type":"string","description":"The requested account."},"cloudformation_yaml":{"type":"string","description":"The role's CloudFormation (no `Policies` key — zero statements)."},"deployment_order":{"type":"array","items":{"type":"string"},"description":"The order to deploy the documents in."},"federation_issuer":{"type":"string","description":"The org's federation issuer the trust policy federates to."},"identity_provider_known":{"type":"boolean","description":"Whether some source in this org has already verified in this account —\nwhen true, the OIDC-provider step is already done and can be skipped."},"key_policy_statement":{"type":"string","description":"The grant-management key-policy statement alone, for adding to an\nexisting key's policy. One rendering with the template's embedded\nstatement — the two forms cannot drift."},"new_key_cloudformation_yaml":{"type":"string","description":"The `AWS::KMS::Key` template for a brand-new key, its policy carrying\nthe administrable and grant-management statements."},"oidc_provider_cloudformation_yaml":{"type":"string","description":"The one-time OIDC-provider snippet (shared renderer output)."},"permissions_policy":{"type":"string","description":"The role's permissions policy JSON — `Statement: []`: the role grants\nnothing; the key's policy carries the grants."},"region":{"type":"string","description":"The lake region the key must live in (`VIGILFIELD_LAKE_REGION`)."},"role_arn":{"type":"string","description":"`arn:aws:iam:::role/vf-storage-key`."},"token_subject":{"type":"string","description":"The `sub` claim the trust policy pins (`storage-key`)."},"trust_policy":{"type":"string","description":"The role's trust policy JSON (composer output)."}}},"StorageKeyResponse":{"type":"object","required":["org_id","connection","key_arn","created_at","updated_at"],"properties":{"connection":{"$ref":"#/components/schemas/StorageKeyConnection"},"created_at":{"type":"string"},"key_arn":{"type":"string"},"org_id":{"type":"string"},"updated_at":{"type":"string"}}},"SubjectKind":{"type":"string","description":"The kind of identity a grant is attached to. Identities are the grant\nsubjects (ADR-0026 §1); a client is a **credential** an identity holds, never\na subject itself (§4).","enum":["user","team","app"]},"SubmitQueryRequest":{"type":"object","description":"Submit a new query for execution.\n\n`POST /queries` body.","required":["query"],"properties":{"priority":{"type":["integer","null"],"format":"int32","description":"Higher values run first within a (org, team, principal) bucket.\nDefaults to 0."},"query":{"$ref":"#/components/schemas/QueryText","description":"The VFQL to run, its grammar version, and its parameter values —\n**the same [`QueryText`] `POST /queries/compile` takes** (ADR-0058 §5).\n\nOne shape for both endpoints, so text that compiled is text that submits;\nand there is **no language field**, because there is no spelling that\nmeans \"this one is SQL\" (R2). A refused compile is a 400 here, carrying\nthe same `diagnostics` array compile returns — submit was asked to *run*\nthe query and did not."},"slot_group":{"type":["string","null"],"description":"Optional slot group name. Defaults to `default`."}}},"SystemAlertDestinationsRequest":{"type":"object","description":"`PUT /alerts/system-destinations` body (rh-rde2vd.6 DB-1, ADR-0067 plan\nD1): the destination ids system alerts deliver to. Shape-only validation\nat the route — non-empty strings, no duplicates, at most 32; a stale id is\ntolerated at delivery, not refused here.","required":["system_alert_destination_ids"],"properties":{"system_alert_destination_ids":{"type":"array","items":{"type":"string"}}}},"SystemAlertDestinationsResponse":{"type":"object","description":"`GET /alerts/system-destinations` — the stored setting. Empty until an\nadmin sets it.","required":["system_alert_destination_ids"],"properties":{"system_alert_destination_ids":{"type":"array","items":{"type":"string"}}}},"TableBookmark":{"type":"object","description":"$d4","required":["snapshot_id","committed_at","baseline"],"properties":{"baseline":{"type":"boolean","description":"`true` for a pin written because the table had no bookmark at all —\na first run, which scans nothing because `from` and `to` are the same\nversion. `false` once a run has actually advanced into it.\n\n⚠️ **This is what keeps [`crate::dto::RuleResponse::covered_through`]\nhonest, and it has to live on storage.** After a first run succeeds the\nbookmark's `committed_at` is simply the instant of the version current\nwhen the rule was created, and everything committed before it is out of\nscope by design. `From` sees the bookmark map and nothing\nelse, so without this flag it cannot tell a baseline from earned\ncoverage — and would answer *\"why did my rule return nothing?\"* with\n*\"scanned everything through \"* at the exact moment that\nquestion is asked (plan-review D4)."},"committed_at":{"type":"string","description":"RFC 3339 instant that version was committed at — the bookmark's address."},"snapshot_id":{"type":"string","description":"The Iceberg snapshot id, as digits. See the type's doc for why a string."}}},"TableBytesBreakdown":{"type":"object","required":["table_id","table_name","bytes"],"properties":{"bytes":{"type":"integer","format":"int64","minimum":0},"table_id":{"type":"string"},"table_name":{"type":"string"}}},"TableKind":{"type":"string","description":"Two table shapes (ADR-0028). Immutable after create.","enum":["event","lookup"]},"TableResponse":{"type":"object","required":["id","org_id","name","population","kind","max_versions","columns","row_count","size_bytes","is_system","is_managed","is_readonly","created_at","updated_at"],"properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/ColumnDef"}},"created_at":{"type":"string"},"description":{"type":["string","null"]},"id":{"type":"string"},"is_managed":{"type":"boolean","description":"True iff Vigilfield provisioned and owns this table's lifecycle (the\ntable analogue of `DatabaseItem.is_managed`). Team-visible but\ncustomer-immutable. Sourced from `TableItem.is_managed`; api-only."},"is_readonly":{"type":"boolean","description":"True iff the customer may **not** mutate this table (alter / delete):\n`is_readonly = is_system || is_managed`. The UI gates its edit/delete\naffordances on this single flag rather than re-deriving the rule."},"is_system":{"type":"boolean","description":"True iff this row was provisioned by Vigilfield as a built-in\nsystem table (lives in the per-org system database; the admin\nUI renders a `System` badge + hides edit/delete affordances).\nSourced directly from the storage row (`TableItem.is_system`),\nwhich is settable only by the api itself — customers can't\ntoggle this via create / update."},"kind":{"$ref":"#/components/schemas/TableKind","description":"`event` or `lookup` (ADR-0028)."},"last_ingested_at":{"type":["string","null"],"description":"ISO 8601 timestamp of the last ingestion that wrote into this\ntable. Populated by the ingestion data plane via a callback the\nhandler is wired up to read; `None` until that callback exists."},"max_versions":{"type":"integer","format":"int32","description":"Lookup-table version retention (1–30). Meaningful only for `lookup`.","minimum":0},"name":{"type":"string"},"org_id":{"type":"string"},"owner_team_id":{"type":["string","null"]},"population":{"$ref":"#/components/schemas/PopulationConfig","description":"What fills the table (`source` / `rule` / `query`, ADR-0069); attached\nsources require `source`."},"result_of_query_id":{"type":["string","null"],"description":"The query whose CTAS materialized this table (ADR-0061 R5).\nPresent only on a query-result table; omitted from the JSON entirely for\nevery other, per this DTO's `skip_serializing_if` convention. snake_case\non the wire.\n\nThis is the capability the stored field buys beyond the sweep predicate:\n\"which query produced this table?\" is answerable from the API instead of by\nre-deriving a string transform outside it."},"row_count":{"type":"integer","format":"int64","description":"Aggregate row count. Aggregation against Athena\n`INFORMATION_SCHEMA` / a denormalized counter is a separate task;\nthe handler currently reports 0 here until that lands. The\nfrontend renders \"0 rows\" — same as the prior `undefined`\nfallback, but now the field is at least always on the wire.","minimum":0},"size_bytes":{"type":"integer","format":"int64","description":"Aggregate on-disk size in bytes. Same caveat as `row_count`.","minimum":0},"table_name":{"type":["string","null"]},"updated_at":{"type":"string"},"warnings":{"type":"array","items":{"$ref":"#/components/schemas/TableWarning"},"description":"Non-fatal warnings the api wants the customer to see. Empty for\nlist / get responses; populated on create / update when the\nrequest crossed a threshold worth flagging (e.g. CloudWatch Logs\nretention too short for safe recovery — see #424). Each warning\ncarries a stable `code` the frontend can switch on."}}},"TableVersionResponse":{"type":"object","description":"One version of a lookup table (ADR-0028 M5). `version` is the customer-facing\ninteger; Iceberg snapshot ids are never exposed. `timestamp_ms` is the commit\ntime (epoch ms UTC) — for display and as the as-of time-travel key.","required":["version","timestamp_ms","record_count","is_current"],"properties":{"is_current":{"type":"boolean","description":"True for the current (latest) version — never pruned by retention."},"record_count":{"type":"integer","format":"int64","minimum":0},"timestamp_ms":{"type":"integer","format":"int64"},"version":{"type":"integer","format":"int64","minimum":0}}},"TableVersionsResponse":{"type":"object","description":"`GET /tables/{id}/versions` response — a lookup table's versions, newest first.","required":["versions"],"properties":{"versions":{"type":"array","items":{"$ref":"#/components/schemas/TableVersionResponse"}}}},"TableWarning":{"type":"object","description":"A non-fatal advisory the api surfaces alongside a `TableResponse`.\n\nToday's codes:\n- `cwl_retention_low` — the customer's CloudWatch Logs group retention\n is shorter than the safe recovery window (or unset / never-expire).\n Message embeds the observed retention in days.","required":["code","message"],"properties":{"code":{"type":"string","description":"Stable machine-readable code. Frontends switch on this to render\nthe right affordance."},"message":{"type":"string","description":"Customer-readable explanation."}}},"TeamAccessEntry":{"type":"object","description":"One team's computed access to a resource — the wire shape of\n`vigilfield_org_authz::TeamAccess`. `actions` are `Action::as_str()` tokens\n(`\"read\"` / `\"write\"` / `\"query\"` / `\"export\"` / …).","required":["team_id","actions"],"properties":{"actions":{"type":"array","items":{"type":"string"}},"team_id":{"type":"string"}}},"TeamResponse":{"type":"object","required":["id","org_id","name","member_ids","member_count","is_system","created_at","updated_at"],"properties":{"created_at":{"type":"string"},"description":{"type":["string","null"]},"external_id":{"type":["string","null"]},"external_idp_id":{"type":["string","null"],"description":"FK to the `IdpRecord` that SCIM-pushed this team. The\nadmin UI keys off this to render the \"Managed by …\" badge and\nhide local edit affordances; the api enforces it server-side\nvia the `is_externally_managed` predicate in `team::handler`."},"id":{"type":"string"},"is_system":{"type":"boolean","description":"True iff this row was provisioned by Vigilfield as the per-org\nsystem team (owner FK target for the system database + its\nbuilt-in tables). Customer-immutable on the same handler\nrejection path as `external_idp_id`. Sourced directly\nfrom the storage row (`TeamItem.is_system`)."},"member_count":{"type":"integer","format":"int32","description":"`member_ids.len()` — surfaced so cards/lists don't have to compute it\n(and so paginated list responses with truncated member arrays still\nexpose the real total).","minimum":0},"member_ids":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"org_id":{"type":"string"},"source":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/TeamSource"}]},"updated_at":{"type":"string"}}},"TeamSource":{"type":"string","description":"Provenance of a team row. `manual` = admin-created in this app;\n`scim` = SCIM-pushed from an upstream IdP. Handler-side\ninvariant: SCIM-managed teams reject local edits.","enum":["manual","scim"]},"TemplateColumnDto":{"type":"object","required":["name","data_type","nullable","description","extraction"],"properties":{"data_type":{"type":"string"},"description":{"type":"string"},"extraction":{"type":"string"},"name":{"type":"string"},"nullable":{"type":"boolean"}}},"TemplateCustomizations":{"type":"object","description":"Template customisations the customer is opting into.","properties":{"allow_divergence":{"type":"boolean","description":"Opt out of strict template-shape validation."}}},"TemplateHttpDto":{"type":"object","description":"HTTP request defaults surfaced on an `Http`-mechanism template.","required":["url","cron","method"],"properties":{"cron":{"type":"string"},"method":{"type":"string"},"url":{"type":"string"}}},"TemplateMechanismDto":{"type":"object","required":["mechanism","input_format","default"],"properties":{"default":{"type":"boolean"},"http":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/TemplateHttpDto","description":"HTTP request defaults for an `Http` mechanism (ADR-0024) — the\nwizard pre-fills its request builder from this. Absent for AWS mechanisms."}]},"input_format":{"type":"string"},"mechanism":{"type":"string"}}},"TemplateResponse":{"type":"object","required":["id","label","description","version","status","ocsf","mechanisms","suggestions","columns","requires_ingestion_features"],"properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/TemplateColumnDto"}},"description":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"mechanisms":{"type":"array","items":{"$ref":"#/components/schemas/TemplateMechanismDto"}},"ocsf":{"$ref":"#/components/schemas/OcsfMappingDto"},"requires_ingestion_features":{"type":"array","items":{"type":"string"},"description":"Ingestion-side capabilities this template needs to function\nend-to-end. The wizard can grey-out templates whose features\naren't yet implemented in the running ingestion service."},"status":{"$ref":"#/components/schemas/TemplateStatus"},"suggestions":{"$ref":"#/components/schemas/TemplateSuggestionsDto"},"version":{"type":"integer","format":"int32","minimum":0}}},"TemplateStatus":{"type":"string","enum":["verified","draft","deprecated"]},"TemplateSuggestionsDto":{"type":"object","required":["table_name","table_description"],"properties":{"table_description":{"type":"string"},"table_name":{"type":"string"}}},"TemplateUpgradeAvailability":{"type":"object","description":"Response for `GET /sources/{id}/template-upgrade`.","required":["template_id","current_version","latest_version","is_upgradeable"],"properties":{"current_version":{"type":"integer","format":"int32","minimum":0},"diff":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/TemplateUpgradeDiff"}]},"is_upgradeable":{"type":"boolean"},"latest_version":{"type":"integer","format":"int32","minimum":0},"template_id":{"type":"string"}}},"TemplateUpgradeDiff":{"type":"object","description":"What changes between the source's current output schema and the latest\ntemplate.","required":["columns_added","columns_removed","columns_changed"],"properties":{"columns_added":{"type":"array","items":{"$ref":"#/components/schemas/OutputColumnDef"}},"columns_changed":{"type":"array","items":{"$ref":"#/components/schemas/ColumnChange"}},"columns_removed":{"type":"array","items":{"$ref":"#/components/schemas/OutputColumnDef"}},"ocsf_change":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OcsfChange"}]}}},"TopUpInfoResponse":{"type":"object","description":"`GET /billing/top-up` — everything the purchase UI needs to render the pack\n(per-dimension headroom + price), preview the cost, and show the remaining\nmonthly spend cap. The pack is one purchasable unit; the customer buys a\nquantity (per period).","required":["pack_ingested_gb","pack_scanned_gb","pack_exported_gb","pack_cents","currency","packs_this_period","max_packs_this_period","spent_cents"],"properties":{"currency":{"type":"string"},"max_packs_this_period":{"type":"integer","format":"int64","description":"The most packs the plan may hold this period: 100% of its included\ningested volume (rh-1yflrq). Past it the only path is an upgrade.","minimum":0},"monthly_cap_cents":{"type":["integer","null"],"format":"int64","description":"The org's monthly top-up spend cap in cents, if set (`None` → uncapped).","minimum":0},"pack_cents":{"type":"integer","format":"int64","description":"Price of one pack, in cents (0 = free / unset).","minimum":0},"pack_exported_gb":{"type":"integer","format":"int64","minimum":0},"pack_ingested_gb":{"type":"integer","format":"int64","description":"GB each pack adds to each dimension's monthly ceiling.","minimum":0},"pack_scanned_gb":{"type":"integer","format":"int64","minimum":0},"packs_this_period":{"type":"integer","format":"int64","description":"Packs already active this period (these expire at the month boundary).","minimum":0},"spent_cents":{"type":"integer","format":"int64","description":"Top-up spend charged this period, in cents.","minimum":0}}},"TopUpRequest":{"type":"object","description":"`POST /billing/top-up` — buy prepaid top-up **packs**. One pack bumps every\nflow dimension's monthly ceiling by a fixed per-dimension amount (sized by us;\nthe customer never picks a dimension), for one price. Packs are **per-period**\n— they lift the ceiling for the current month only and the cell picks them up\non its next `GetBudget` pull. The customer's card is charged at purchase.","required":["packs"],"properties":{"idempotency_key":{"type":["string","null"],"description":"Idempotency key for the purchase — generate one per purchase intent (e.g.\na UUID per click). A retry carrying the same key never double-charges or\ndouble-grants. Optional; the server mints one if omitted (less retry-safe)."},"packs":{"type":"integer","format":"int64","description":"Number of packs to buy. Must be > 0.","minimum":0}}},"TopUpResponse":{"type":"object","description":"The result of a `POST /billing/top-up`. (The plan/override ceiling in\n`BillingResponse` is unchanged; the packs lift the enforced ceiling via\n`GetBudget`.)","required":["org_id","topup_packs","charged_cents","updated_at"],"properties":{"charged_cents":{"type":"integer","format":"int64","description":"Amount charged to the card for this purchase, in cents (0 when the pack\nprice is unset / the purchase was free).","minimum":0},"org_id":{"type":"string"},"topup_packs":{"type":"integer","format":"int64","description":"Total prepaid top-up packs active this period (after this purchase).","minimum":0},"updated_at":{"type":"string"}}},"UpdateArtifactRequest":{"type":"object","description":"Update request. `lastQueryId` carries the freshly-submitted\nquery run from the React execute flow — the app's sequence is\n`POST /queries` (receives a `qry-…` id) → `PATCH …/artifacts/{a}`\nwith `lastQueryId` set. Passing `Some(None)` (i.e. JSON `null`)\nis reserved for clearing the link in a future refactor; today\nthe PATCH only sets a value when the caller sends one.","properties":{"last_query_id":{"type":["string","null"]},"name":{"type":["string","null"]}}},"UpdateDomainRequest":{"type":"object","properties":{"domain":{"type":["string","null"]},"settings":{},"status":{"type":["string","null"]},"verified_at":{"type":["string","null"]}}},"UpdateFolderRequest":{"type":"object","properties":{"description":{"type":["string","null"]},"name":{"type":["string","null"]},"owner_team_id":{"type":["string","null"]},"parent_id":{"type":["string","null"]}}},"UpdateIdentityProviderRequest":{"type":"object","properties":{"attribute_mappings":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AttributeMappings"}]},"domains":{"type":["array","null"],"items":{"type":"string"}},"enabled":{"type":["boolean","null"]},"name":{"type":["string","null"]},"oidc":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OidcConfig"}]},"protocol":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/IdpProtocol"}]},"saml":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SamlConfig"}]},"scim":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ScimConfig"}]}}},"UpdateInvestigationRequest":{"type":"object","properties":{"artifact_ids":{"type":["array","null"],"items":{"type":"string"},"description":"Replacement ordered list of child artifact ids. The handler\nvalidates that every id corresponds to an artifact already\nscoped to this investigation (no cross-investigation moves)\nand rejects duplicates. Pass `None` to leave layout untouched.\nSee #590 for why ordering lives on the investigation rather\nthan per-artifact."},"description":{"type":["string","null"]},"folder_id":{"type":["string","null"]},"name":{"type":["string","null"]},"owner_team_id":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/InvestigationStatus"}]}}},"UpdateOrganizationRequest":{"type":"object","description":"$d5","properties":{"display_name":{"type":["string","null"]},"name":{"type":["string","null"]},"settings":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OrganizationSettings"}]},"slug":{"type":["string","null"]}}},"UpdateRuleRequest":{"type":"object","properties":{"alerting":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleAlerting","description":"Absent leaves alerting as it is; `null` removes it; an object replaces\nit whole."}]},"description":{"type":["string","null"]},"enabled":{"type":["boolean","null"]},"name":{"type":["string","null"]},"owner_team_id":{"type":["string","null"]},"query":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryText"}]},"schedule":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/RuleStatus"}]}}},"UpdateSourceRequest":{"type":"object","description":"`PUT /sources/{id}` body — edit metadata and/or the pipeline. A pipeline\nedit re-runs provisioning where needed; the `S ≼ T` compatibility re-check\nagainst any attached table lands with #1292.\n\n⚠️ **`deny_unknown_fields`, deliberately** (one of four write DTOs — see\n`organization/dto.rs` for the documented default and why these four depart\nfrom it): a view's text is no longer a source field (ADR-0069 — a view's\n`query` and `event_time_field` live on the table's `population`), so the\ndead keys must refuse rather than drop.","properties":{"description":{"type":["string","null"]},"http_credential":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HttpCredentialInput","description":"Replaces the whole credential in place. Absent leaves the stored\ncredential untouched. A replacement lifts a quarantine. The transport\nitself stays create-only, so this block is the one way to change how an\nHTTP source authenticates. The `secret` is write-only here too."}]},"ingestion":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/IngestionSourceConfigInput"}]},"name":{"type":["string","null"]},"output_schema":{"type":["array","null"],"items":{"$ref":"#/components/schemas/OutputColumnDefInput"}},"owner_team_id":{"type":["string","null"],"description":"Re-own to a different team. The caller needs `sources:write` on both the\ncurrent and the new owning team."}},"additionalProperties":false},"UpdateTableRequest":{"type":"object","properties":{"columns":{"type":["array","null"],"items":{"$ref":"#/components/schemas/ColumnDef"}},"description":{"type":["string","null"]},"max_versions":{"type":["integer","null"],"format":"int32","description":"Change lookup-table version retention (1–30). `kind` is intentionally\nabsent — it's immutable after create (ADR-0028).","minimum":0},"name":{"type":["string","null"]},"owner_team_id":{"type":["string","null"],"description":"Transfer ownership."},"population":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PopulationConfig","description":"Replaces the population config **whole** — a present `population`\nsupersedes every field of the stored one, including fields the body\nomits. There is no partial nested update; `event_time_field` is\ncleared by a replacement that omits it (ADR-0069)."}]},"table_name":{"type":["string","null"]}},"additionalProperties":false},"UpdateTeamRequest":{"type":"object","properties":{"description":{"type":["string","null"]},"external_id":{"type":["string","null"]},"name":{"type":["string","null"]},"source":{"type":["string","null"]}}},"UpdateUserRequest":{"type":"object","properties":{"avatar":{"type":["string","null"]},"email":{"type":["string","null"]},"is_admin":{"type":["boolean","null"]},"last_login_at":{"type":["string","null"]},"name":{"type":["string","null"]},"provisioned_by":{"type":["string","null"]},"role":{"type":["string","null"]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserStatus"}]},"team_ids":{"type":["array","null"],"items":{"type":"string"}}}},"UserKind":{"type":"string","description":"Discriminates \"what kind of principal this row represents.\" All\nrows used to be implicitly human (Native or Federated, both with a\nCognito sub); #496 introduces `Service` for non-human identities\nowned by the org. The serde default keeps pre-migration rows\ndeserializing cleanly as `Native` — DynamoDB is schemaless and we\nnever rewrite historical rows.","enum":["native","federated","service"]},"UserResponse":{"type":"object","required":["id","org_id","email","is_admin","team_ids","kind","created_at","updated_at"],"properties":{"avatar":{"type":["string","null"]},"created_at":{"type":"string"},"email":{"type":"string"},"id":{"type":"string"},"is_admin":{"type":"boolean"},"kind":{"$ref":"#/components/schemas/UserKind","description":"Principal kind. Falls back to `Native` for any row\nwritten before #496 PR A (via `UserKind`'s `Default` impl)."},"last_login_at":{"type":["string","null"]},"name":{"type":["string","null"]},"org_id":{"type":"string"},"provisioned_by":{"type":["string","null"]},"role":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserRole"}]},"status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserStatus"}]},"status_unrecognized":{"type":["string","null"]},"team_ids":{"type":"array","items":{"type":"string"}},"updated_at":{"type":"string"}}},"UserRole":{"type":"string","description":"Per-org user role. The handler validates inbound `role` strings\nagainst this set (`user/handler.rs::enforce_*`); this enum lives\non the wire DTO so frontends + `api-types.ts` ship a proper\nunion. The `From` impl parses `item.role` and falls\nback to `None` for unknown / legacy values.","enum":["owner","admin","member"]},"UserStatus":{"type":"string","description":"Per-user lifecycle state. Same handler-string / DTO-enum split\nas `UserRole`.","enum":["active","inactive","pending"]},"VerificationFailureBody":{"type":"object","description":"The 409 body, serialized from this one struct so the OpenAPI schema is\nwhat is sent. Re-exported at the crate root as `VerificationFailure` — the\nschema name the API registers.","required":["message","reason","role_arn","account_id","token_subject"],"properties":{"account_id":{"type":"string"},"action":{"type":["string","null"]},"actual_region":{"type":["string","null"]},"code":{"type":["string","null"]},"message":{"type":"string"},"reason":{"type":"string"},"region":{"type":["string","null"]},"resource":{"type":["string","null"]},"role_arn":{"type":"string"},"token_subject":{"type":"string"}}},"VerificationOutcome":{"type":"string","description":"The outcomes that are not failures (the failures carry `reason` in the 409\nbody instead).","enum":["verified","no_op"]},"WebAuthnFinishRequest":{"type":"object","description":"`POST /auth/webauthn/finish`'s body. No `Debug`: `session` is a live\nchallenge handle.","required":["slug","email","session","credential"],"properties":{"credential":{"type":"string","description":"The browser's assertion (`PublicKeyCredential` JSON), as a string."},"email":{"type":"string"},"session":{"type":"string","description":"`WebAuthnStartResponse.session`, verbatim."},"slug":{"type":"string"}}},"WebAuthnStartRequest":{"type":"object","description":"`POST /auth/webauthn/start`'s body.","required":["slug","email"],"properties":{"email":{"type":"string"},"slug":{"type":"string","description":"Org subdomain slug — selects the org's Cognito app client."}}},"WebAuthnStartResponse":{"type":"object","description":"`POST /auth/webauthn/start`'s response: what the browser needs to sign the\nchallenge and answer it at `/auth/webauthn/finish`.","required":["session","credential_request_options"],"properties":{"credential_request_options":{"type":"string","description":"The `CREDENTIAL_REQUEST_OPTIONS` JSON **string** Cognito issued — parse\nit and hand it to `navigator.credentials.get`."},"session":{"type":"string","description":"Cognito's opaque challenge session; posted back verbatim to `finish`."}}},"WebhookConnection":{"type":"object","description":"A webhook destination's connection: which cloud it posts through, and the\nURL it posts to.","required":["type","url"],"properties":{"type":{"$ref":"#/components/schemas/ConnectionType","description":"Which cloud this connection reaches — `https` for a webhook\n(`validated_config` refuses `aws`)."},"url":{"type":"string","description":"The HTTPS URL deliveries POST to, trimmed."}}},"WebhookDestinationInput":{"type":"object","required":["connection"],"properties":{"connection":{"$ref":"#/components/schemas/WebhookConnection","description":"Which cloud the destination posts through and the URL it posts to."},"secret":{"type":["string","null"],"description":"The signing secret, plaintext on the way in. Sealed at create;\nrotation re-seals. Never returned."}}},"WebhookDestinationResponse":{"type":"object","required":["connection"],"properties":{"connection":{"$ref":"#/components/schemas/WebhookConnection"}}},"WhoCanAccessResponse":{"type":"object","description":"`GET /access` response — the effective-access answer for a resource\n(ADR-0026 §3, M1.10): which teams can do what, plus whether the resource\ncarries a policy and whether that policy binds owner/admins.","required":["teams","has_policy","bind_owner"],"properties":{"bind_owner":{"type":"boolean"},"has_policy":{"type":"boolean"},"teams":{"type":"array","items":{"$ref":"#/components/schemas/TeamAccessEntry"}}}}}},"tags":[{"name":"account","description":"Account lifecycle — set password after signup / invitation"},{"name":"artifact","description":"Investigation artifacts: queries, charts, notes, embeds"},{"name":"billing","description":"Subscription, payment methods, invoices"},{"name":"sources","description":"Standalone ingestion/rule/query sources (ADR-0022) that feed tables"},{"name":"invitations","description":"Invitation flow — issue, view, redeem, cancel"},{"name":"domain","description":"Customer-verified email domains for SSO + auto-join"},{"name":"folder","description":"Folders inside investigations"},{"name":"identity_provider","description":"SAML / OIDC identity provider configuration"},{"name":"investigation","description":"Investigations — the primary user-facing surface"},{"name":"rules","description":"Scheduled / triggered rules"},{"name":"alerts","description":"Alerts raised by rules and by the system (ADR-0067)"},{"name":"org_export","description":"Org data exports to customer-owned S3 buckets"},{"name":"organization","description":"Org provisioning and admin"},{"name":"query","description":"Ad-hoc SQL queries and their results"},{"name":"scim","description":"SCIM 2.0 server for external IdP-driven user / group provisioning (RFC 7644)"},{"name":"table","description":"Iceberg tables backing the data lake"},{"name":"team","description":"Teams within an org"},{"name":"templates","description":"Built-in OCSF table templates the wizard offers"},{"name":"user","description":"Org members"}]},"proxyUrl":"$undefined"},"document":"./openapi.json","operations":[{"method":"post","path":"/sources/{id}/verifications","tags":["sources"]}],"showDescription":true}]}]]}]

Source_verify

Path Parameters

Response Body

200application/json

400

404

409application/json

503

`application/json`

`application/json`