openapi: 3.1.0
info:
  title: SmartSRE - Intelligent Infrastructure Automation
  description: >-
    Intelligent infrastructure automation platform that automatically fixes GCP
    issues, optimizes costs, and prevents incidents
  version: 1.0.0
paths:
  /auth/login:
    post:
      tags:
        - authentication
      summary: Login
      description: Authenticate user and return tokens
      operationId: login_auth_login_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ValidatedLoginRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/logout:
    post:
      tags:
        - authentication
      summary: Logout
      operationId: logout_auth_logout_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /auth/refresh:
    post:
      tags:
        - authentication
      summary: Refresh Token
      operationId: refresh_token_auth_refresh_post
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/RefreshTokenRequest'
                - type: 'null'
              title: Refresh Data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/magic-link:
    post:
      tags:
        - authentication
      summary: Create Magic Link
      operationId: create_magic_link_auth_magic_link_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MagicLinkRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/magic-login:
    get:
      tags:
        - authentication
      summary: Magic Login
      operationId: magic_login_auth_magic_login_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /auth/select-project:
    post:
      tags:
        - authentication
      summary: Select Project
      operationId: select_project_auth_select_project_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SelectProjectRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /auth/select-tenant:
    post:
      tags:
        - authentication
      summary: Select Tenant
      operationId: select_tenant_auth_select_tenant_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SelectTenantRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /auth/ws-token:
    post:
      tags:
        - authentication
      summary: Create Ws Token
      description: >-
        Mint a short-lived WebSocket token for the current user (Phase 1).

        Requires a valid access token; returns a `ws_token` suitable for WS
        handshake.
      operationId: create_ws_token_auth_ws_token_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /auth/me:
    get:
      tags:
        - users
      summary: Get Current User
      description: Get current user information
      operationId: get_current_user_auth_me_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /auth/capabilities:
    get:
      tags:
        - users
      summary: Get User Capabilities
      description: >-
        Get current user's effective permissions (cleaner endpoint for UI
        logic).
      operationId: get_user_capabilities_auth_capabilities_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /auth/password/forgot:
    post:
      tags:
        - users
      summary: Forgot Password
      description: >-
        Start password reset flow. Always return success to avoid user
        enumeration.


        Behavior:

        - If user exists, create a one-time token valid for 1 hour and store it.

        - In local environment, include the token in the response for easy
        testing.

        - In non-local envs, do not reveal token; a mailer integration can send
        it.
      operationId: forgot_password_auth_password_forgot_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ForgotPasswordRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/password/reset:
    post:
      tags:
        - users
      summary: Reset Password
      description: Complete password reset given a valid token and new password.
      operationId: reset_password_auth_password_reset_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResetPasswordRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/password/set:
    post:
      tags:
        - users
      summary: Set Password
      description: Set password post-signup given a one-time token and new password.
      operationId: set_password_auth_password_set_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetPasswordRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/mfa/email/request:
    post:
      tags:
        - users
      summary: Request Email Mfa Code
      description: >-
        Send a one-time MFA code to the user's email (idempotent and
        non-enumerating).
      operationId: request_email_mfa_code_auth_mfa_email_request_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmailMfaRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/webauthn/register/challenge:
    post:
      tags:
        - sso
      summary: Webauthn Register Challenge
      operationId: webauthn_register_challenge_auth_webauthn_register_challenge_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnChallengeRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/webauthn/register/verify:
    post:
      tags:
        - sso
      summary: Webauthn Register Verify
      operationId: webauthn_register_verify_auth_webauthn_register_verify_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnVerifyAttestationRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/webauthn/register/start:
    post:
      tags:
        - sso
      summary: Webauthn Register Start
      description: >-
        Deprecated alias for register/challenge; kept for test/backwards compat.


        Requires authentication. When called without a valid bearer token,
        FastAPI

        will return 401 via the get_security_context dependency.


        For authenticated callers, we simply acknowledge the endpoint without

        performing any registration logic (the SPA should use
        /webauthn/register/challenge).
      operationId: webauthn_register_start_auth_webauthn_register_start_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /auth/webauthn/login/challenge:
    post:
      tags:
        - sso
      summary: Webauthn Login Challenge
      operationId: webauthn_login_challenge_auth_webauthn_login_challenge_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnChallengeRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/webauthn/auth/start:
    post:
      tags:
        - sso
      summary: Webauthn Auth Start
      description: >-
        Backwards-compatible alias for login challenge used by tests.


        This implementation is intentionally lightweight and avoids DB
        dependencies

        so it can run in smoke/test environments even when PostgreSQL is

        unavailable. It returns a minimal WebAuthn options structure with a

        publicKey field so tests can validate shape.
      operationId: webauthn_auth_start_auth_webauthn_auth_start_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnChallengeRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/webauthn/login/verify:
    post:
      tags:
        - sso
      summary: Webauthn Login Verify
      operationId: webauthn_login_verify_auth_webauthn_login_verify_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnVerifyAssertionRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/login/google:
    post:
      tags:
        - sso
      summary: Login With Google
      description: Authenticate user via Google OAuth and return tokens
      operationId: login_with_google_auth_login_google_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ValidatedOAuthLoginRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /auth/api-key:
    post:
      tags:
        - api-keys
      summary: Create Api Key
      description: Create API key for programmatic access
      operationId: create_api_key_auth_api_key_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APIKeyRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /auth/totp/setup:
    post:
      tags:
        - mfa
      summary: Setup Totp
      description: >-
        Generate a new TOTP secret for authenticator app setup.


        Returns a QR code URI and secret for the user to configure their

        authenticator app. The setup is not complete until /totp/verify is
        called.
      operationId: setup_totp_auth_totp_setup_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TotpSetupResponse'
      security:
        - HTTPBearer: []
  /auth/totp/verify:
    post:
      tags:
        - mfa
      summary: Verify Totp
      description: |-
        Verify a TOTP code to complete authenticator setup.

        This is the final step of TOTP enrollment. The user must enter a valid
        code from their authenticator app to confirm the secret is correctly
        configured.

        Returns recovery codes that should be saved securely.
      operationId: verify_totp_auth_totp_verify_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpVerifyRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TotpVerifyResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /auth/totp/disable:
    post:
      tags:
        - mfa
      summary: Disable Totp
      description: |-
        Disable TOTP authentication.

        Requires the current TOTP code to confirm the user has access to
        their authenticator.
      operationId: disable_totp_auth_totp_disable_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TotpDisableRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /auth/mfa/status:
    get:
      tags:
        - mfa
      summary: Get Mfa Status
      description: |-
        Get current MFA configuration status for the authenticated user.

        Returns which MFA methods are enabled and whether MFA is required
        based on the user's permissions.
      operationId: get_mfa_status_auth_mfa_status_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MfaStatusResponse'
      security:
        - HTTPBearer: []
  /webhooks/{source}:
    post:
      tags:
        - webhooks
      summary: Receive Webhook
      description: Receive and process webhooks from monitoring systems.
      operationId: receive_webhook_webhooks__source__post
      parameters:
        - name: source
          in: path
          required: true
          schema:
            type: string
            title: Source
        - name: token
          in: query
          required: false
          schema:
            type: string
            title: Token
        - name: signature
          in: query
          required: false
          schema:
            type: string
            title: Signature
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /alerts:
    get:
      tags:
        - alerts
      summary: Get Alerts
      description: Get recent signals for the current tenant.
      operationId: get_alerts_alerts_get
      security:
        - HTTPBearer: []
      parameters:
        - name: page
          in: query
          required: false
          schema:
            type: integer
            default: 1
            title: Page
        - name: page_size
          in: query
          required: false
          schema:
            type: integer
            default: 50
            title: Page Size
        - name: status
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Status
        - name: service_name
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Service Name
        - name: severity
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Severity
        - name: sort
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Sort
        - name: sort_dir
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Sort Dir
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /alerts/services:
    get:
      tags:
        - alerts
      summary: Get Alert Services
      description: Get list of services that have generated signals
      operationId: get_alert_services_alerts_services_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /alerts/{alert_id}:
    get:
      tags:
        - alerts
      summary: Get Alert Details
      description: Get detailed information about a specific alert
      operationId: get_alert_details_alerts__alert_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: alert_id
          in: path
          required: true
          schema:
            type: string
            title: Alert Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /alerts/{alert_id}/acknowledge:
    post:
      tags:
        - alerts
      summary: Acknowledge Alert
      description: Acknowledge a signal
      operationId: acknowledge_alert_alerts__alert_id__acknowledge_post
      security:
        - HTTPBearer: []
      parameters:
        - name: alert_id
          in: path
          required: true
          schema:
            type: string
            title: Alert Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /automations/:
    get:
      tags:
        - automations
      summary: Get Automations
      description: Get recent automations for the current tenant.
      operationId: get_automations_automations__get
      security:
        - HTTPBearer: []
      parameters:
        - name: page
          in: query
          required: false
          schema:
            type: integer
            default: 1
            title: Page
        - name: page_size
          in: query
          required: false
          schema:
            type: integer
            default: 50
            title: Page Size
        - name: sort
          in: query
          required: false
          schema:
            type: string
            default: started_at
            title: Sort
        - name: sort_dir
          in: query
          required: false
          schema:
            type: string
            default: desc
            title: Sort Dir
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /automations/summary:
    get:
      tags:
        - automations
      summary: Get Automations Summary
      description: >-
        Summarize automations using AgentRun as the source of truth.


        Returns totals and status distribution for the selected window (default
        30d).
      operationId: get_automations_summary_automations_summary_get
      security:
        - HTTPBearer: []
      parameters:
        - name: hours
          in: query
          required: false
          schema:
            type: integer
            maximum: 4320
            minimum: 1
            default: 720
            title: Hours
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /automations/list:
    get:
      tags:
        - automations
      summary: List Automations Normalized
      description: >-
        Return normalized automation rows based on AgentRun for the current
        tenant.


        Shape is stable for UI consumption:
          - id, service_name, agent_name, action_type, status, started_at, completed_at, duration_seconds
      operationId: list_automations_normalized_automations_list_get
      security:
        - HTTPBearer: []
      parameters:
        - name: page
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            default: 1
            title: Page
        - name: page_size
          in: query
          required: false
          schema:
            type: integer
            maximum: 200
            minimum: 1
            default: 25
            title: Page Size
        - name: sort
          in: query
          required: false
          schema:
            type: string
            default: started_at
            title: Sort
        - name: sort_dir
          in: query
          required: false
          schema:
            type: string
            default: desc
            title: Sort Dir
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Service
        - name: status
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Status
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /automations/{automation_id}:
    get:
      tags:
        - automations
      summary: Get Automation Detail
      description: >-
        Fetch a single automation record including execution result (for
        debugging/visibility).
      operationId: get_automation_detail_automations__automation_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: automation_id
          in: path
          required: true
          schema:
            type: string
            title: Automation Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /automations/{automation_id}/feedback:
    post:
      tags:
        - automations
      summary: Submit Feedback
      description: |-
        Submit feedback for an automation execution.

        Body: { "useful": boolean, "comment": string }
      operationId: submit_feedback_automations__automation_id__feedback_post
      security:
        - HTTPBearer: []
      parameters:
        - name: automation_id
          in: path
          required: true
          schema:
            type: string
            title: Automation Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Feedback
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /services/supported:
    get:
      tags:
        - services
      summary: Get Supported Services
      description: Get list of supported services and their metadata (registry-driven).
      operationId: get_supported_services_services_supported_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /services/{service_name}/status:
    get:
      tags:
        - services
      summary: Get Service Status
      description: Get status and simple stats for a service
      operationId: get_service_status_services__service_name__status_get
      security:
        - HTTPBearer: []
      parameters:
        - name: service_name
          in: path
          required: true
          schema:
            type: string
            title: Service Name
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /incidents/:
    get:
      tags:
        - incidents
      summary: Get Active Incidents
      description: List active or recent complex incidents (orchestrations).
      operationId: get_active_incidents_incidents__get
      security:
        - HTTPBearer: []
      parameters:
        - name: status
          in: query
          required: false
          schema:
            type: string
            title: Status
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 50
            title: Limit
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /incidents/complex:
    post:
      tags:
        - incidents
      summary: Handle Complex Incident
      description: Handle complex multi-service incidents with orchestration
      operationId: handle_complex_incident_incidents_complex_post
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: true
              type: object
              title: Incident Data
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /incidents/{incident_id}/status:
    get:
      tags:
        - incidents
      summary: Get Incident Status
      description: Get status of complex incident orchestration
      operationId: get_incident_status_incidents__incident_id__status_get
      security:
        - HTTPBearer: []
      parameters:
        - name: incident_id
          in: path
          required: true
          schema:
            type: string
            title: Incident Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /incidents/{incident_id}/report:
    post:
      tags:
        - incidents
      summary: Generate Incident Report
      description: Generate comprehensive incident report
      operationId: generate_incident_report_incidents__incident_id__report_post
      security:
        - HTTPBearer: []
      parameters:
        - name: incident_id
          in: path
          required: true
          schema:
            type: string
            title: Incident Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /incidents/{incident_id}:
    get:
      tags:
        - incidents
      summary: Get Incident Overview
      description: >-
        Proxy convenience endpoint returning the current incident status.


        Mirrors the data returned by `/incidents/{incident_id}/status` so
        clients

        using the shorter path keep working.
      operationId: get_incident_overview_incidents__incident_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: incident_id
          in: path
          required: true
          schema:
            type: string
            title: Incident Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /approvals/agents/propose:
    post:
      tags:
        - approvals
      summary: Propose Fix From Change Set
      description: >-
        Create an approval request from an SmartSRE change_set.


        This bridges advise → approval by packaging the change_set with minimal

        risk information so approvers can review and authorize remediation.


        Uses propose_changes permission (new) or falls back to manage_services
        (legacy).
      operationId: propose_fix_from_change_set_approvals_agents_propose_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProposeFixRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: >-
                  Response Propose Fix From Change Set Approvals Agents Propose
                  Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /approvals/pending:
    get:
      tags:
        - approvals
      summary: Get Pending Approvals
      description: Get pending approval requests for the current tenant.
      operationId: get_pending_approvals_approvals_pending_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                items:
                  additionalProperties: true
                  type: object
                type: array
                title: Response Get Pending Approvals Approvals Pending Get
      security:
        - HTTPBearer: []
  /approvals/{approval_id}/status:
    get:
      tags:
        - approvals
      summary: Get Approval Status
      description: Get status of specific approval request.
      operationId: get_approval_status_approvals__approval_id__status_get
      security:
        - HTTPBearer: []
      parameters:
        - name: approval_id
          in: path
          required: true
          schema:
            type: string
            title: Approval Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Get Approval Status Approvals  Approval Id  Status
                  Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /approvals/{approval_id}/decision:
    post:
      tags:
        - approvals
      summary: Process Approval Decision
      description: |-
        Process approval decision (approve/reject).

        Enforces maker-checker pattern: the user who requested the approval
        cannot be the same user who approves it (unless platform admin bypass).
      operationId: process_approval_decision_approvals__approval_id__decision_post
      security:
        - HTTPBearer: []
      parameters:
        - name: approval_id
          in: path
          required: true
          schema:
            type: string
            title: Approval Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Decision Data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Process Approval Decision Approvals  Approval Id 
                  Decision Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /approvals/{approval_id}/changeset:
    patch:
      tags:
        - approvals
      summary: Update Approval Changeset
      description: Update the stored change_set for a pending approval.
      operationId: update_approval_changeset_approvals__approval_id__changeset_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: approval_id
          in: path
          required: true
          schema:
            type: string
            title: Approval Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Body
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Update Approval Changeset Approvals  Approval Id 
                  Changeset Patch
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /approvals/{approval_id}/cancel:
    post:
      tags:
        - approvals
      summary: Cancel Approval
      description: Cancel a pending approval request.
      operationId: cancel_approval_approvals__approval_id__cancel_post
      security:
        - HTTPBearer: []
      parameters:
        - name: approval_id
          in: path
          required: true
          schema:
            type: string
            title: Approval Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Cancel Data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Cancel Approval Approvals  Approval Id  Cancel Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /approvals/{approval_id}/retry:
    post:
      tags:
        - approvals
      summary: Retry Approval Execution
      description: Retry execution for an approved but failed request.
      operationId: retry_approval_execution_approvals__approval_id__retry_post
      security:
        - HTTPBearer: []
      parameters:
        - name: approval_id
          in: path
          required: true
          schema:
            type: string
            title: Approval Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Retry Approval Execution Approvals  Approval Id 
                  Retry Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /approvals/history:
    get:
      tags:
        - approvals
      summary: Get Approval History
      description: Get approval history for the current tenant.
      operationId: get_approval_history_approvals_history_get
      security:
        - HTTPBearer: []
      parameters:
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 50
            title: Limit
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  additionalProperties: true
                title: Response Get Approval History Approvals History Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /approvals/metrics:
    get:
      tags:
        - approvals
      summary: Get Approval Metrics
      description: Get approval workflow metrics for the current tenant.
      operationId: get_approval_metrics_approvals_metrics_get
      security:
        - HTTPBearer: []
      parameters:
        - name: days
          in: query
          required: false
          schema:
            type: integer
            default: 30
            title: Days
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Approval Metrics Approvals Metrics Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rollback/automation/{automation_id}/request:
    post:
      tags:
        - rollbacks
      summary: Request Automation Rollback
      description: >-
        Request a rollback for a specific automation (step 1 of maker-checker).


        Creates a pending rollback request that must be approved before
        execution.
      operationId: >-
        request_automation_rollback_rollback_automation__automation_id__request_post
      security:
        - HTTPBearer: []
      parameters:
        - name: automation_id
          in: path
          required: true
          schema:
            type: string
            title: Automation Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Rollback Data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rollback/request/{request_id}/approve:
    post:
      tags:
        - rollbacks
      summary: Approve Rollback Request
      description: >-
        Approve a pending rollback request (step 2 of maker-checker).


        Enforces maker ≠ checker: the requester cannot approve their own
        request.
      operationId: approve_rollback_request_rollback_request__request_id__approve_post
      security:
        - HTTPBearer: []
      parameters:
        - name: request_id
          in: path
          required: true
          schema:
            type: string
            title: Request Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Approve Data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rollback/request/{request_id}/execute:
    post:
      tags:
        - rollbacks
      summary: Execute Approved Rollback
      description: |-
        Execute an approved rollback request (step 3 of maker-checker).

        Only approved rollback requests can be executed.
      operationId: execute_approved_rollback_rollback_request__request_id__execute_post
      security:
        - HTTPBearer: []
      parameters:
        - name: request_id
          in: path
          required: true
          schema:
            type: string
            title: Request Id
        - name: dry_run
          in: query
          required: false
          schema:
            type: boolean
            default: false
            title: Dry Run
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rollback/automation/{automation_id}/executor:
    post:
      tags:
        - rollbacks
      summary: Executor Rollback
      description: |-
        Trigger rollback via ChangeSetExecutor (legacy endpoint).

        RBAC: execute_rollbacks or (manage_services + approve_automations)
      operationId: executor_rollback_rollback_automation__automation_id__executor_post
      security:
        - HTTPBearer: []
      parameters:
        - name: automation_id
          in: path
          required: true
          schema:
            type: string
            title: Automation Id
        - name: dry_run
          in: query
          required: false
          schema:
            type: boolean
            default: false
            title: Dry Run
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rollback/orchestration/{orchestration_id}:
    post:
      tags:
        - rollbacks
      summary: Rollback Orchestration
      description: Rollback a complete orchestration
      operationId: rollback_orchestration_rollback_orchestration__orchestration_id__post
      security:
        - HTTPBearer: []
      parameters:
        - name: orchestration_id
          in: path
          required: true
          schema:
            type: string
            title: Orchestration Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Rollback Data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rollback/{rollback_id}/status:
    get:
      tags:
        - rollbacks
      summary: Get Rollback Status
      description: Get status of active rollback
      operationId: get_rollback_status_rollback__rollback_id__status_get
      security:
        - HTTPBearer: []
      parameters:
        - name: rollback_id
          in: path
          required: true
          schema:
            type: string
            title: Rollback Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rollback/checkpoints:
    get:
      tags:
        - rollbacks
      summary: List Checkpoints
      description: List available checkpoints for rollback
      operationId: list_checkpoints_rollback_checkpoints_get
      security:
        - HTTPBearer: []
      parameters:
        - name: resource_type
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Resource Type
        - name: resource_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Resource Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rollback/checkpoints/cleanup:
    post:
      tags:
        - rollbacks
      summary: Cleanup Expired Checkpoints
      description: Clean up expired checkpoints
      operationId: cleanup_expired_checkpoints_rollback_checkpoints_cleanup_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /tenants/:
    get:
      tags:
        - tenants
      summary: List Tenants
      description: List tenants visible to the current user.
      operationId: list_tenants_tenants__get
      security:
        - HTTPBearer: []
      parameters:
        - name: active_only
          in: query
          required: false
          schema:
            type: boolean
            default: true
            title: Active Only
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  additionalProperties: true
                title: Response List Tenants Tenants  Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
        - tenants
      summary: Create Tenant
      description: Create a new tenant.
      operationId: create_tenant_tenants__post
      security:
        - HTTPBearer: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Tenant Data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Create Tenant Tenants  Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}:
    get:
      tags:
        - tenants
      summary: Get Tenant Info
      description: >-
        Get tenant information and configuration.


        Platform admins can fetch any tenant even when their current token has
        no tenant_id set.

        Non-admin callers must match their own tenant.
      operationId: get_tenant_info_tenants__tenant_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Tenant Info Tenants  Tenant Id  Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/config:
    put:
      tags:
        - tenants
      summary: Update Tenant Config
      description: Update tenant configuration.
      operationId: update_tenant_config_tenants__tenant_id__config_put
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Config Data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Update Tenant Config Tenants  Tenant Id  Config Put
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/metrics:
    get:
      tags:
        - tenants
      summary: Get Tenant Metrics
      description: Get tenant usage metrics and analytics.
      operationId: get_tenant_metrics_tenants__tenant_id__metrics_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: months
          in: query
          required: false
          schema:
            type: integer
            default: 3
            title: Months
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Tenant Metrics Tenants  Tenant Id  Metrics Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/billing:
    get:
      tags:
        - tenants
      summary: Get Tenant Billing
      description: Get tenant billing information.
      operationId: get_tenant_billing_tenants__tenant_id__billing_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Tenant Billing Tenants  Tenant Id  Billing Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/upgrade:
    post:
      tags:
        - tenants
      summary: Upgrade Tenant
      description: Upgrade tenant to new subscription tier.
      operationId: upgrade_tenant_tenants__tenant_id__upgrade_post
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Upgrade Data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Upgrade Tenant Tenants  Tenant Id  Upgrade Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/suspend:
    post:
      tags:
        - tenants
      summary: Suspend Tenant
      description: Suspend tenant account.
      operationId: suspend_tenant_tenants__tenant_id__suspend_post
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Suspend Data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Suspend Tenant Tenants  Tenant Id  Suspend Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/admin/all:
    get:
      tags:
        - tenants
      summary: List All Tenants
      description: List all tenants (admin endpoint).
      operationId: list_all_tenants_tenants_admin_all_get
      security:
        - HTTPBearer: []
      parameters:
        - name: active_only
          in: query
          required: false
          schema:
            type: boolean
            default: true
            title: Active Only
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  additionalProperties: true
                title: Response List All Tenants Tenants Admin All Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/projects:
    get:
      tags:
        - tenants
      summary: List Tenant Projects
      description: List all GCP projects for a tenant.
      operationId: list_tenant_projects_tenants__tenant_id__projects_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/GcpProjectOut'
                title: Response List Tenant Projects Tenants  Tenant Id  Projects Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/notifications/settings:
    get:
      tags:
        - tenants
      summary: Get Notification Settings
      description: Get tenant notification preferences.
      operationId: get_notification_settings_tenants__tenant_id__notifications_settings_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationPreferences'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    put:
      tags:
        - tenants
      summary: Update Notification Settings
      description: Update tenant notification preferences.
      operationId: >-
        update_notification_settings_tenants__tenant_id__notifications_settings_put
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NotificationPreferences'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationPreferences'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/webhook-token:
    get:
      tags:
        - tenants
      summary: Get Webhook Token
      description: Return the current webhook token for this tenant (if any).
      operationId: get_webhook_token_tenants__tenant_id__webhook_token_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookTokenResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
        - tenants
      summary: Create Webhook Token
      description: Generate a webhook token for this tenant if one does not already exist.
      operationId: create_webhook_token_tenants__tenant_id__webhook_token_post
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookTokenResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/webhook-token/rotate:
    post:
      tags:
        - tenants
      summary: Rotate Webhook Token
      description: Rotate the webhook token for this tenant.
      operationId: rotate_webhook_token_tenants__tenant_id__webhook_token_rotate_post
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookTokenResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/projects/{project_id}:
    delete:
      tags:
        - tenants
      summary: Remove Tenant Project
      description: Remove a GCP project from a tenant.
      operationId: remove_tenant_project_tenants__tenant_id__projects__project_id__delete
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: project_id
          in: path
          required: true
          schema:
            type: string
            title: Project Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Remove Tenant Project Tenants  Tenant Id  Projects 
                  Project Id  Delete
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/projects/{project_id}/automation:
    patch:
      tags:
        - tenants
      summary: Update Project Automation
      description: Enable or disable automations for a specific GCP project.
      operationId: >-
        update_project_automation_tenants__tenant_id__projects__project_id__automation_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: project_id
          in: path
          required: true
          schema:
            type: string
            title: Project Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProjectAutomationRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Update Project Automation Tenants  Tenant Id 
                  Projects  Project Id  Automation Patch
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/projects/{project_id}/active:
    patch:
      tags:
        - tenants
      summary: Update Project Active Status
      description: Enable or disable a GCP project (active status).
      operationId: >-
        update_project_active_status_tenants__tenant_id__projects__project_id__active_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: project_id
          in: path
          required: true
          schema:
            type: string
            title: Project Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProjectActiveRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Update Project Active Status Tenants  Tenant Id 
                  Projects  Project Id  Active Patch
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/projects/{project_id}/sa-secret/test:
    post:
      tags:
        - tenants
      summary: Test Project Sa Secret
      description: Mint an ID token for the tenant service account.
      operationId: >-
        test_project_sa_secret_tenants__tenant_id__projects__project_id__sa_secret_test_post
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: project_id
          in: path
          required: true
          schema:
            type: string
            title: Project Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Test Project Sa Secret Tenants  Tenant Id  Projects 
                  Project Id  Sa Secret Test Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/projects/{project_id}/config:
    get:
      tags:
        - tenants
      summary: Get Project Config
      description: Admin endpoint to fetch current project configuration (for UI editing).
      operationId: get_project_config_tenants__tenant_id__projects__project_id__config_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: project_id
          in: path
          required: true
          schema:
            type: string
            title: Project Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Get Project Config Tenants  Tenant Id  Projects 
                  Project Id  Config Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/preferences:
    patch:
      tags:
        - tenants
      summary: Update Preferences
      description: |-
        Update persisted preferences such as persona.
        Stores values in Tenant.risk_config under `preferences`.
      operationId: update_preferences_tenants__tenant_id__preferences_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PreferencesRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Update Preferences Tenants  Tenant Id  Preferences
                  Patch
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/risk/guardrails:
    patch:
      tags:
        - tenants
      summary: Update Risk Guardrails
      description: >-
        Update per‑service risk guardrails for Cloud SQL (approval gating,
        allowed hours).
      operationId: update_risk_guardrails_tenants__tenant_id__risk_guardrails_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: >-
                #/components/schemas/src__api__routes__tenants__RiskGuardrailsRequest
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Update Risk Guardrails Tenants  Tenant Id  Risk
                  Guardrails Patch
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    get:
      tags:
        - tenants
      summary: Get Risk Guardrails
      description: Return current per‑service risk guardrails for the tenant (read‑only).
      operationId: get_risk_guardrails_tenants__tenant_id__risk_guardrails_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Get Risk Guardrails Tenants  Tenant Id  Risk
                  Guardrails Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/risk/global_settings:
    patch:
      tags:
        - tenants
      summary: Update Risk Global Settings
      description: Update tenant-level risk global settings.
      operationId: >-
        update_risk_global_settings_tenants__tenant_id__risk_global_settings_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RiskGlobalSettingsRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Update Risk Global Settings Tenants  Tenant Id  Risk
                  Global Settings Patch
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/scheduler:
    get:
      tags:
        - tenants
      summary: Get Scheduler Settings
      description: Return scheduler settings for a tenant (admin/platform-admin only).
      operationId: get_scheduler_settings_tenants__tenant_id__scheduler_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Get Scheduler Settings Tenants  Tenant Id  Scheduler
                  Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    patch:
      tags:
        - tenants
      summary: Update Scheduler Settings
      description: Update scheduler settings (admin/platform-admin).
      operationId: update_scheduler_settings_tenants__tenant_id__scheduler_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SchedulerSettingsRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Update Scheduler Settings Tenants  Tenant Id 
                  Scheduler Patch
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/users:
    get:
      tags:
        - tenants
      summary: List Tenant Users Endpoint
      description: List users and their roles for the tenant.
      operationId: list_tenant_users_endpoint_tenants__tenant_id__users_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response List Tenant Users Endpoint Tenants  Tenant Id  Users
                  Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/users/assign-role:
    post:
      tags:
        - tenants
      summary: Assign Tenant User Role Endpoint
      description: Assign or change a user's role within the tenant.
      operationId: >-
        assign_tenant_user_role_endpoint_tenants__tenant_id__users_assign_role_post
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssignRoleRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Assign Tenant User Role Endpoint Tenants  Tenant Id 
                  Users Assign Role Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/rbac/roles:
    get:
      tags:
        - tenants
      summary: List Roles Metadata
      description: List all roles and their permissions (admin/manage_users).
      operationId: list_roles_metadata_tenants__tenant_id__rbac_roles_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response List Roles Metadata Tenants  Tenant Id  Rbac Roles
                  Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/rbac/effective-permissions:
    get:
      tags:
        - tenants
      summary: Get Effective Permissions
      description: Get the effective role and permissions for a user within this tenant.
      operationId: >-
        get_effective_permissions_tenants__tenant_id__rbac_effective_permissions_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: user_email
          in: query
          required: true
          schema:
            type: string
            title: User Email
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Get Effective Permissions Tenants  Tenant Id  Rbac
                  Effective Permissions Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /monitoring/health:
    get:
      tags:
        - monitoring
      summary: Get System Health
      description: Get comprehensive system health dashboard
      operationId: get_system_health_monitoring_health_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /monitoring/dashboard/{tenant_id}:
    get:
      tags:
        - monitoring
      summary: Get Tenant Dashboard
      description: Get tenant-specific monitoring dashboard (custom per tenant)
      operationId: get_tenant_dashboard_monitoring_dashboard__tenant_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /monitoring/risk/analytics/{tenant_id}:
    get:
      tags:
        - monitoring
      summary: Get Risk Analytics
      description: Placeholder for risk analytics; see analytics routes for details
      operationId: get_risk_analytics_monitoring_risk_analytics__tenant_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            title: Tenant Id
        - name: days
          in: query
          required: false
          schema:
            type: integer
            default: 30
            title: Days
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /config/risk/profiles:
    get:
      tags:
        - configuration
      summary: Get Risk Profiles
      description: Get available risk profiles (system presets + custom)
      operationId: get_risk_profiles_config_risk_profiles_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /config/:
    get:
      tags:
        - configuration
      summary: Get Tenant Configuration
      description: Get all configuration for the current tenant
      operationId: get_tenant_configuration_config__get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /config/agent/{agent_type}:
    put:
      tags:
        - configuration
      summary: Update Agent Configuration
      description: Update configuration for a specific agent type
      operationId: update_agent_configuration_config_agent__agent_type__put
      security:
        - HTTPBearer: []
      parameters:
        - name: agent_type
          in: path
          required: true
          schema:
            type: string
            title: Agent Type
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Config Updates
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /config/defaults/{service_type}:
    get:
      tags:
        - configuration
      summary: Get Service Type Defaults
      description: Get default configuration for a service type
      operationId: get_service_type_defaults_config_defaults__service_type__get
      parameters:
        - name: service_type
          in: path
          required: true
          schema:
            type: string
            title: Service Type
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /config/cache/invalidate:
    post:
      tags:
        - configuration
      summary: Invalidate Configuration Cache
      description: Invalidate configuration cache for the current tenant
      operationId: invalidate_configuration_cache_config_cache_invalidate_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /admin/database/status:
    get:
      tags:
        - database
      summary: Get Database Status
      description: Get database status and migration information
      operationId: get_database_status_admin_database_status_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /admin/database/migrate:
    post:
      tags:
        - database
      summary: Run Database Migrations
      description: Run database migrations (admin only)
      operationId: run_database_migrations_admin_database_migrate_post
      security:
        - HTTPBearer: []
      parameters:
        - name: target_revision
          in: query
          required: false
          schema:
            type: string
            default: head
            title: Target Revision
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /admin/database/backup:
    post:
      tags:
        - database
      summary: Create Database Backup
      description: Create database backup (admin only)
      operationId: create_database_backup_admin_database_backup_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /admin/database/health/detailed:
    get:
      tags:
        - database
      summary: Get Detailed Database Health
      description: Get detailed database health metrics
      operationId: get_detailed_database_health_admin_database_health_detailed_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /admin/security/status:
    get:
      tags:
        - security
      summary: Get Security Status
      description: Get comprehensive security status (admin only)
      operationId: get_security_status_admin_security_status_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /admin/security/credentials:
    get:
      tags:
        - security
      summary: Get Credential Summary
      description: Get credential configuration summary (admin only)
      operationId: get_credential_summary_admin_security_credentials_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /admin/security/generate-secret:
    post:
      tags:
        - security
      summary: Generate Secure Secret
      description: Generate a cryptographically secure secret (admin only)
      operationId: generate_secure_secret_admin_security_generate_secret_post
      security:
        - HTTPBearer: []
      parameters:
        - name: length
          in: query
          required: false
          schema:
            type: integer
            default: 32
            title: Length
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /admin/security/audit/recent:
    get:
      tags:
        - security
      summary: Get Recent Security Events
      description: Get recent security events (admin only)
      operationId: get_recent_security_events_admin_security_audit_recent_get
      security:
        - HTTPBearer: []
      parameters:
        - name: hours
          in: query
          required: false
          schema:
            type: integer
            default: 24
            title: Hours
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /admin/security/users/passwords:
    get:
      tags:
        - security
      summary: List User Password Status
      description: >-
        List users with an indicator whether a password_hash is present (admin
        only).


        Returns up to `limit` users ordered by creation time desc with fields:

        - email

        - created_at

        - has_password_hash (bool)
      operationId: list_user_password_status_admin_security_users_passwords_get
      security:
        - HTTPBearer: []
      parameters:
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 100
            title: Limit
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /audit/events:
    get:
      tags:
        - audit
      summary: Get Audit Events
      description: Get audit events for the current tenant
      operationId: get_audit_events_audit_events_get
      security:
        - HTTPBearer: []
      parameters:
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 1000
            minimum: 1
            default: 100
            title: Limit
        - name: hours
          in: query
          required: false
          schema:
            type: integer
            maximum: 168
            minimum: 1
            default: 24
            title: Hours
        - name: category
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Category
        - name: level
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Level
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /audit/summary:
    get:
      tags:
        - audit
      summary: Get Audit Summary
      description: Get audit summary statistics
      operationId: get_audit_summary_audit_summary_get
      security:
        - HTTPBearer: []
      parameters:
        - name: days
          in: query
          required: false
          schema:
            type: integer
            maximum: 30
            minimum: 1
            default: 7
            title: Days
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /audit/categories:
    get:
      tags:
        - audit
      summary: Get Audit Categories
      description: Get available audit categories and levels
      operationId: get_audit_categories_audit_categories_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /audit/cleanup:
    post:
      tags:
        - audit
      summary: Cleanup Old Audit Events
      description: Clean up old audit events (admin only)
      operationId: cleanup_old_audit_events_audit_cleanup_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /audit/compliance/report:
    get:
      tags:
        - audit
      summary: Get Compliance Report
      description: Generate compliance audit report (admin only)
      operationId: get_compliance_report_audit_compliance_report_get
      security:
        - HTTPBearer: []
      parameters:
        - name: days
          in: query
          required: false
          schema:
            type: integer
            maximum: 365
            minimum: 1
            default: 30
            title: Days
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /ws/connections/stats:
    get:
      tags:
        - websocket
      summary: Get Websocket Stats
      description: Get WebSocket connection statistics
      operationId: get_websocket_stats_ws_connections_stats_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /analytics/cost/trends:
    get:
      tags:
        - analytics
      summary: Get Cost Trends
      description: Get cost trends and savings over time
      operationId: get_cost_trends_analytics_cost_trends_get
      security:
        - HTTPBearer: []
      parameters:
        - name: months
          in: query
          required: false
          schema:
            type: integer
            maximum: 12
            minimum: 1
            default: 3
            title: Months
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /analytics/performance/dashboard:
    get:
      tags:
        - analytics
      summary: Get Performance Dashboard
      description: Get performance dashboard data
      operationId: get_performance_dashboard_analytics_performance_dashboard_get
      security:
        - HTTPBearer: []
      parameters:
        - name: hours
          in: query
          required: false
          schema:
            type: integer
            maximum: 720
            minimum: 1
            default: 24
            title: Hours
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /analytics/cost/breakdown:
    get:
      tags:
        - analytics
      summary: Get Cost Breakdown
      description: Get detailed cost breakdown and analysis
      operationId: get_cost_breakdown_analytics_cost_breakdown_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /analytics/cost/automations:
    get:
      tags:
        - analytics
      summary: Get Cost Automations
      description: >-
        List recent automations with cost impact for cost history/accuracy
        views.
      operationId: get_cost_automations_analytics_cost_automations_get
      security:
        - HTTPBearer: []
      parameters:
        - name: days
          in: query
          required: false
          schema:
            type: integer
            maximum: 365
            minimum: 1
            default: 30
            title: Days
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Optional service filter (e.g., cloudrun, bigquery, gke, cloudsql)
            title: Service
          description: Optional service filter (e.g., cloudrun, bigquery, gke, cloudsql)
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 500
            minimum: 1
            default: 100
            title: Limit
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /analytics/alerts/analytics:
    get:
      tags:
        - analytics
      summary: Get Alert Analytics
      description: Get alert analytics and patterns
      operationId: get_alert_analytics_analytics_alerts_analytics_get
      security:
        - HTTPBearer: []
      parameters:
        - name: days
          in: query
          required: false
          schema:
            type: integer
            maximum: 30
            minimum: 1
            default: 7
            title: Days
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /analytics/health/overview:
    get:
      tags:
        - analytics
      summary: Get Health Overview
      description: Tenant-scoped health analytics built from agent runs and findings.
      operationId: get_health_overview_analytics_health_overview_get
      security:
        - HTTPBearer: []
      parameters:
        - name: days
          in: query
          required: false
          schema:
            type: integer
            maximum: 90
            minimum: 1
            default: 30
            title: Days
        - name: project_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by GCP project id/number when present in scan scope
            title: Project Id
          description: Filter by GCP project id/number when present in scan scope
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by agent service
            title: Service
          description: Filter by agent service
        - name: bucket
          in: query
          required: false
          schema:
            type: string
            pattern: ^(day|week)$
            description: Aggregation bucket for trend data
            default: day
            title: Bucket
          description: Aggregation bucket for trend data
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /recommendations/for-alert:
    post:
      tags:
        - recommendations
      summary: Recommend For Alert
      operationId: recommend_for_alert_recommendations_for_alert_post
      security:
        - HTTPBearer: []
      parameters:
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 10
            minimum: 1
            default: 5
            title: Limit
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Alert
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /recommendations/cost/predict:
    post:
      tags:
        - recommendations
      summary: Predict Cost
      operationId: predict_cost_recommendations_cost_predict_post
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: true
              type: object
              title: Payload
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /agents/heartbeat:
    post:
      tags:
        - agents
      summary: Agent Heartbeat
      operationId: agent_heartbeat_agents_heartbeat_post
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: true
              type: object
              title: Payload
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /agents/health:
    get:
      tags:
        - agents
      summary: Agent Health
      operationId: agent_health_agents_health_get
      security:
        - HTTPBearer: []
      parameters:
        - name: window_minutes
          in: query
          required: false
          schema:
            type: integer
            maximum: 120
            minimum: 1
            default: 10
            title: Window Minutes
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/catalog:
    get:
      tags:
        - agents
      summary: Agents Catalog
      description: Return a static catalog of supported services and tool types.
      operationId: agents_catalog_agents_catalog_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /agents/canonical-ops:
    get:
      tags:
        - agents
      summary: Canonical Ops
      description: Expose canonical operations per service for guardrail UIs.
      operationId: canonical_ops_agents_canonical_ops_get
      parameters:
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Service
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/quota/status:
    get:
      tags:
        - agents
      summary: Get Quota Status
      description: >-
        Get current quota usage status for the authenticated tenant.


        FIX Critical Bug C2: Previously called
        get_plan_limits(context.tenant_id) which

        expects a tier name. Also referenced undefined variables in response.


        Returns monthly or hourly advisor run quota usage and limits.
      operationId: get_quota_status_agents_quota_status_get
      security:
        - HTTPBearer: []
      parameters:
        - name: quota_type
          in: query
          required: false
          schema:
            type: string
            pattern: ^(monthly|hourly)$
            default: monthly
            title: Quota Type
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/{agent_type}/execute:
    post:
      tags:
        - agents
      summary: Execute Agent Action
      description: |-
        Execute an agent action. Used by internal automation runners.

        agent_type: one of [cloudrun, gke, bigquery, cloudsql]
        payload: normalized alert dict expected by the specific agent
      operationId: execute_agent_action_agents__agent_type__execute_post
      security:
        - HTTPBearer: []
      parameters:
        - name: agent_type
          in: path
          required: true
          schema:
            type: string
            title: Agent Type
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: true
              title: Payload
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/{agent_type}/health:
    get:
      tags:
        - agents
      summary: Agent Type Health
      description: >-
        Lightweight agent health endpoint for supervisory checks.


        This reflects whether we have a first-class in-process agent
        implementation

        for the given service key (e.g. cloudrun, bigquery, gke, cloudsql).
        Other

        services are handled via generic tooling pipelines and do not expose a

        dedicated agent health surface.
      operationId: agent_type_health_agents__agent_type__health_get
      parameters:
        - name: agent_type
          in: path
          required: true
          schema:
            type: string
            title: Agent Type
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/provision/{service}:
    post:
      tags:
        - agents
      summary: Provision Agent
      description: >-
        Provision/register an agent for a service.


        For now, this verifies local agent availability and returns a basic
        status. For

        advise-only services, it returns provisioned=true without performing
        external health probes.
      operationId: provision_agent_agents_provision__service__post
      parameters:
        - name: service
          in: path
          required: true
          schema:
            type: string
            title: Service
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/{service}/advise/async:
    post:
      tags:
        - agents
      summary: Advise Service Async
      description: |-
        Async advise endpoint with quota enforcement.

        Args:
            run_type: "monitoring" (unlimited) or "advisor" (metered, enforces quota)
      operationId: advise_service_async_agents__service__advise_async_post
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: path
          required: true
          schema:
            type: string
            title: Service
        - name: run_type
          in: query
          required: false
          schema:
            type: string
            pattern: ^(monitoring|advisor)$
            default: advisor
            title: Run Type
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AdviseRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AsyncJobResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/{service}/remediate/async:
    post:
      tags:
        - agents
      summary: Remediate Service Async
      description: |-
        Async remediation endpoint.

        - Performs synchronous guardrail checks (blast radius, basic shape) so
          obviously unsafe change sets fail fast.
        - Enforces plan gating and usage limits before enqueueing work.
        - Enqueues a remediation job for background execution.
      operationId: remediate_service_async_agents__service__remediate_async_post
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: path
          required: true
          schema:
            type: string
            title: Service
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemediateRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AsyncJobResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/runs/{run_id}/artifacts:
    get:
      tags:
        - agents
      summary: Get Run Artifacts
      description: Return stored artifacts (diagnostics, prompts, reports) for a run.
      operationId: get_run_artifacts_agents_runs__run_id__artifacts_get
      security:
        - HTTPBearer: []
      parameters:
        - name: run_id
          in: path
          required: true
          schema:
            type: string
            title: Run Id
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 200
            minimum: 1
            default: 50
            title: Limit
        - name: offset
          in: query
          required: false
          schema:
            type: integer
            minimum: 0
            default: 0
            title: Offset
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/change-sets/{change_set_id}:
    patch:
      tags:
        - agents
      summary: Patch Change Set
      description: |-
        Edit a pending change set.
        Resets approval status and updates the plan steps.
      operationId: patch_change_set_agents_change_sets__change_set_id__patch
      security:
        - HTTPBearer: []
      parameters:
        - name: change_set_id
          in: path
          required: true
          schema:
            type: string
            title: Change Set Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChangeSetPatchRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/runs/{run_id}/summary:
    get:
      tags:
        - agents
      summary: Get Run Summary
      description: >-
        Fetch a comprehensive summary of a run, including its children (if any).

        Aggregates risk, findings, change sets, and artifacts into a single
        view.
      operationId: get_run_summary_agents_runs__run_id__summary_get
      security:
        - HTTPBearer: []
      parameters:
        - name: run_id
          in: path
          required: true
          schema:
            type: string
            title: Run Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/runs/{run_id}/view:
    get:
      tags:
        - agents
      summary: Get Run View
      description: >-
        Return the materialized run_view snapshot. If since_version is provided
        and

        the snapshot has not advanced, return an unchanged marker.
      operationId: get_run_view_agents_runs__run_id__view_get
      security:
        - HTTPBearer: []
      parameters:
        - name: run_id
          in: path
          required: true
          schema:
            type: string
            title: Run Id
        - name: since_version
          in: query
          required: false
          schema:
            anyOf:
              - type: integer
              - type: 'null'
            title: Since Version
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/runs/{run_id}:
    get:
      tags:
        - agents
      summary: Get Agent Run
      description: Fetch a single agent run by internal UUID or external run id.
      operationId: get_agent_run_agents_runs__run_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: run_id
          in: path
          required: true
          schema:
            type: string
            title: Run Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/runs/{run_id}/change-set:
    get:
      tags:
        - agents
      summary: Get Run Change Set
      description: Fetch the change set for a specific run.
      operationId: get_run_change_set_agents_runs__run_id__change_set_get
      security:
        - HTTPBearer: []
      parameters:
        - name: run_id
          in: path
          required: true
          schema:
            type: string
            title: Run Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/findings:
    get:
      tags:
        - agents
      summary: List Findings
      description: >-
        List findings for the current tenant (RBAC: view_analytics or
        read_automations).
      operationId: list_findings_agents_findings_get
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Service
        - name: severity
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Severity
        - name: run
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Run UUID or external id
            title: Run
          description: Run UUID or external id
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 500
            minimum: 1
            default: 50
            title: Limit
        - name: offset
          in: query
          required: false
          schema:
            type: integer
            minimum: 0
            default: 0
            title: Offset
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/platform/tenants/{tenant_id}/runs/latest:
    get:
      tags:
        - agents
      summary: Get Platform Latest Runs
      description: 'Platform admin dashboard: latest agent runs with findings/artifacts.'
      operationId: >-
        get_platform_latest_runs_agents_platform_tenants__tenant_id__runs_latest_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: per_service
          in: query
          required: false
          schema:
            type: integer
            maximum: 5
            minimum: 1
            default: 1
            title: Per Service
        - name: finding_limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 50
            minimum: 0
            default: 10
            title: Finding Limit
        - name: artifact_limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 20
            minimum: 0
            default: 5
            title: Artifact Limit
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/runs:
    get:
      tags:
        - agents
      summary: List Runs
      description: >-
        List agent runs for the current tenant (RBAC: view_analytics or
        read_automations).
      operationId: list_runs_agents_runs_get
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Service
        - name: status
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Status
        - name: scope_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by Scope ID
            title: Scope Id
          description: Filter by Scope ID
        - name: parent_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by parent run id
            title: Parent Id
          description: Filter by parent run id
        - name: root_only
          in: query
          required: false
          schema:
            type: boolean
            description: If true, only runs without a parent (parent_run_id is null)
            default: false
            title: Root Only
          description: If true, only runs without a parent (parent_run_id is null)
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 500
            minimum: 1
            default: 50
            title: Limit
        - name: offset
          in: query
          required: false
          schema:
            type: integer
            minimum: 0
            default: 0
            title: Offset
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/schemas:
    get:
      tags:
        - agents
      summary: Get Agent Schemas
      description: |-
        Return JSON Schemas for advise/remediate contracts.

        Useful for clients and for validating SmartSRE tool outputs.
      operationId: get_agent_schemas_agents_schemas_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /agents/risk/simulate:
    post:
      tags:
        - agents
      summary: Simulate Risk Decision
      description: >-
        Simulate how the current risk configuration would treat a proposed
        change.


        Uses the authoritative AdvancedRiskEngine to determine the decision,
        ensuring

        parity with actual workflow execution logic (Profiles + Financial Limits
        + Heuristics).
      operationId: simulate_risk_decision_agents_risk_simulate_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RiskSimulationRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Simulate Risk Decision Agents Risk Simulate Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /agents/runs/{run_id}/synthesize:
    post:
      tags:
        - agents
      summary: Trigger Synthesis
      description: |-
        Manually trigger the synthesis process for a run.
        Useful if the auto-trigger failed or to retry analysis.
      operationId: trigger_synthesis_agents_runs__run_id__synthesize_post
      security:
        - HTTPBearer: []
      parameters:
        - name: run_id
          in: path
          required: true
          schema:
            type: string
            title: Run Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /agents/feedback:
    post:
      tags:
        - agents
      summary: Submit Agent Feedback
      description: |-
        Submit user feedback on a specific agent synthesis pattern.
        This feedback is used to improve future synthesis prompts.
      operationId: submit_agent_feedback_agents_feedback_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AgentFeedbackRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /reports/generate:
    get:
      tags:
        - reports
      summary: Generate Monthly Report
      operationId: generate_monthly_report_reports_generate_get
      security:
        - HTTPBearer: []
      parameters:
        - name: months
          in: query
          required: false
          schema:
            type: integer
            maximum: 12
            minimum: 1
            default: 1
            title: Months
        - name: email_to
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Email To
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /reports/summary:
    get:
      tags:
        - reports
      summary: Get Latest Report Summary
      operationId: get_latest_report_summary_reports_summary_get
      security:
        - HTTPBearer: []
      parameters:
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 12
            minimum: 1
            default: 1
            title: Limit
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /reports/schedule:
    get:
      tags:
        - reports
      summary: Get Report Schedule
      description: Return saved report schedule from tenant risk_config (preferences).
      operationId: get_report_schedule_reports_schedule_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
    post:
      tags:
        - reports
      summary: Save Report Schedule
      description: Persist report schedule under tenant.risk_config.report_schedule.
      operationId: save_report_schedule_reports_schedule_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReportSchedule'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /reports/schedule/test:
    post:
      tags:
        - reports
      summary: Send Test Report
      description: Send a one-off preview report to the provided email.
      operationId: send_test_report_reports_schedule_test_post
      security:
        - HTTPBearer: []
      parameters:
        - name: to
          in: query
          required: true
          schema:
            type: string
            title: To
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/status:
    get:
      tags:
        - onboarding
      summary: Get Onboarding Status Authenticated
      description: |-
        Return onboarding status for the authenticated tenant (SPA flow).

        Mirrors the information shape expected by the frontend:
        - tenant_id, completion_percentage, steps, current_step, total_steps
      operationId: get_onboarding_status_authenticated_onboarding_status_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /onboarding/step/{step_id}:
    post:
      tags:
        - onboarding
      summary: Update Onboarding Step Authenticated
      description: Update onboarding step for the authenticated tenant (SPA flow).
      operationId: update_onboarding_step_authenticated_onboarding_step__step_id__post
      security:
        - HTTPBearer: []
      parameters:
        - name: step_id
          in: path
          required: true
          schema:
            type: string
            title: Step Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StepUpdate'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/signup:
    post:
      tags:
        - onboarding
      summary: Customer Signup
      description: |-
        Self-service customer signup with automated tenant creation
        Creates tenant, sends welcome email, and starts onboarding flow
      operationId: customer_signup_onboarding_signup_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignupRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignupResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/signup/status:
    get:
      tags:
        - onboarding
      summary: Signup Status
      description: >-
        Return tenant metadata for a given GCP project (dev/test helper guarded
        by reset token).
      operationId: signup_status_onboarding_signup_status_get
      parameters:
        - name: gcp_project_id
          in: query
          required: true
          schema:
            type: string
            title: Gcp Project Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignupStatusResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/signup/google:
    post:
      tags:
        - onboarding
      summary: Customer Signup Google
      description: Google OAuth-based signup that auto-creates a tenant.
      operationId: customer_signup_google_onboarding_signup_google_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GoogleSignupRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/detect-services:
    post:
      tags:
        - onboarding
      summary: Detect Services
      description: >-
        Detect active services in the specified GCP project.


        This endpoint now returns immediately (202 Accepted) and performs
        discovery in the background.
      operationId: detect_services_onboarding_detect_services_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceDetectionRequest'
        required: true
      responses:
        '202':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /onboarding/auto-setup:
    post:
      tags:
        - onboarding
      summary: Automated Setup Authenticated
      description: Trigger the automated validation and discovery saga in the background.
      operationId: automated_setup_authenticated_onboarding_auto_setup_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AutoSetupRequest'
        required: true
      responses:
        '202':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /onboarding/gcp-setup:
    post:
      tags:
        - onboarding
      summary: Automated Gcp Setup Authenticated
      operationId: automated_gcp_setup_authenticated_onboarding_gcp_setup_post
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: true
              type: object
              title: Gcp Data
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /onboarding/gcp-validate:
    post:
      tags:
        - onboarding
      summary: Validate Gcp Authenticated
      operationId: validate_gcp_authenticated_onboarding_gcp_validate_post
      security:
        - HTTPBearer: []
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: >-
                #/components/schemas/Body_validate_gcp_authenticated_onboarding_gcp_validate_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    get:
      tags:
        - onboarding
      summary: Validate Gcp Authenticated Get
      description: |-
        GET variant of GCP validation to support simple curl/browser calls.

        Uses the authenticated tenant from the SecurityContext. The optional
        customer_id query parameter is accepted for compatibility but is not
        required and is ignored if it does not match the authenticated tenant.
      operationId: validate_gcp_authenticated_get_onboarding_gcp_validate_get
      security:
        - HTTPBearer: []
      parameters:
        - name: customer_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Customer Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/gcp-setup-script:
    get:
      tags:
        - onboarding
      summary: Get Gcp Setup Script
      operationId: get_gcp_setup_script_onboarding_gcp_setup_script_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /onboarding/gcp-automation-upgrade:
    get:
      tags:
        - onboarding
      summary: Get Gcp Automation Upgrade
      description: >-
        Return an automation-focused setup script for a single service.


        This is used when a tenant initially configured discovery-only access
        and

        later opts into automation for a specific service. The script is
        idempotent

        and safe to re-run; it reuses the same impersonation-based model as the

        primary GCP setup flow.
      operationId: get_gcp_automation_upgrade_onboarding_gcp_automation_upgrade_get
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: query
          required: true
          schema:
            type: string
            description: >-
              Service key to enable automation for (e.g. cloudrun, bigquery,
              cloudsql)
            title: Service
          description: >-
            Service key to enable automation for (e.g. cloudrun, bigquery,
            cloudsql)
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/risk-config:
    get:
      tags:
        - onboarding
      summary: Get Risk Config
      description: Get current risk configuration for the tenant
      operationId: get_risk_config_onboarding_risk_config_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
    post:
      tags:
        - onboarding
      summary: Save Risk Config
      description: Save risk configuration during onboarding
      operationId: save_risk_config_onboarding_risk_config_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RiskConfigRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /onboarding/compliance-review:
    get:
      tags:
        - onboarding
      summary: Get Compliance Checklist
      description: Get compliance checklist status for enterprise tier
      operationId: get_compliance_checklist_onboarding_compliance_review_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
    post:
      tags:
        - onboarding
      summary: Save Compliance Checklist
      description: Save compliance checklist for enterprise tier
      operationId: save_compliance_checklist_onboarding_compliance_review_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ComplianceChecklist'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /onboarding/invitations:
    get:
      tags:
        - onboarding
      summary: List Invitations
      description: List invitations for the current tenant.
      operationId: list_invitations_onboarding_invitations_get
      security:
        - HTTPBearer: []
      parameters:
        - name: status
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Status
        - name: page
          in: query
          required: false
          schema:
            type: integer
            minimum: 1
            default: 1
            title: Page
        - name: page_size
          in: query
          required: false
          schema:
            type: integer
            maximum: 100
            minimum: 1
            default: 25
            title: Page Size
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
        - onboarding
      summary: Send Invitation
      description: Send a team invitation.
      operationId: send_invitation_onboarding_invitations_post
      security:
        - HTTPBearer: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TeamInviteRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/invitations/{invitation_id}/accept:
    post:
      tags:
        - onboarding
      summary: Accept Invitation
      description: Accept an invitation and provision the user in the tenant.
      operationId: accept_invitation_onboarding_invitations__invitation_id__accept_post
      security:
        - HTTPBearer: []
      parameters:
        - name: invitation_id
          in: path
          required: true
          schema:
            type: string
            title: Invitation Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/invitations/{invitation_id}/decline:
    post:
      tags:
        - onboarding
      summary: Decline Invitation
      description: Decline an invitation.
      operationId: decline_invitation_onboarding_invitations__invitation_id__decline_post
      security:
        - HTTPBearer: []
      parameters:
        - name: invitation_id
          in: path
          required: true
          schema:
            type: string
            title: Invitation Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/invitations/{invitation_id}/revoke:
    post:
      tags:
        - onboarding
      summary: Revoke Invitation
      description: Revoke an invitation.
      operationId: revoke_invitation_onboarding_invitations__invitation_id__revoke_post
      security:
        - HTTPBearer: []
      parameters:
        - name: invitation_id
          in: path
          required: true
          schema:
            type: string
            title: Invitation Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/invitations/{invitation_id}/resend:
    post:
      tags:
        - onboarding
      summary: Resend Invitation
      description: Resend an invitation.
      operationId: resend_invitation_onboarding_invitations__invitation_id__resend_post
      security:
        - HTTPBearer: []
      parameters:
        - name: invitation_id
          in: path
          required: true
          schema:
            type: string
            title: Invitation Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /onboarding/risk-guardrails:
    post:
      tags:
        - onboarding
      summary: Save Risk Guardrails Onboarding
      description: |-
        Save risk guardrails during onboarding.
        Bypasses the 'manage_risk_config' permission check (which requires MFA)
        as this is part of the initial setup flow for authenticated admins.
      operationId: save_risk_guardrails_onboarding_onboarding_risk_guardrails_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: >-
                #/components/schemas/src__api__routes__onboarding__RiskGuardrailsRequest
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: >-
                  Response Save Risk Guardrails Onboarding Onboarding Risk
                  Guardrails Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /workflows/:
    get:
      tags:
        - workflows
      summary: List Workflows
      description: List all workflows for the current tenant
      operationId: list_workflows_workflows__get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
    post:
      tags:
        - workflows
      summary: Create Workflow
      description: Create a new custom workflow
      operationId: create_workflow_workflows__post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowDefinition'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /workflows/{workflow_id}:
    get:
      tags:
        - workflows
      summary: Get Workflow
      description: Get a specific workflow by ID
      operationId: get_workflow_workflows__workflow_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: workflow_id
          in: path
          required: true
          schema:
            type: string
            title: Workflow Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    put:
      tags:
        - workflows
      summary: Update Workflow
      description: Update an existing workflow
      operationId: update_workflow_workflows__workflow_id__put
      security:
        - HTTPBearer: []
      parameters:
        - name: workflow_id
          in: path
          required: true
          schema:
            type: string
            title: Workflow Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowDefinition'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    delete:
      tags:
        - workflows
      summary: Delete Workflow
      description: Delete a workflow
      operationId: delete_workflow_workflows__workflow_id__delete
      security:
        - HTTPBearer: []
      parameters:
        - name: workflow_id
          in: path
          required: true
          schema:
            type: string
            title: Workflow Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /workflows/execute:
    post:
      tags:
        - workflows
      summary: Execute Workflow Endpoint
      description: Execute a workflow (Saved only for V2 engine)
      operationId: execute_workflow_endpoint_workflows_execute_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkflowExecutionRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /workflows/executions/{execution_id}/resume:
    post:
      tags:
        - workflows
      summary: Resume Execution
      description: Resume a paused workflow execution (Human-in-the-Loop)
      operationId: resume_execution_workflows_executions__execution_id__resume_post
      security:
        - HTTPBearer: []
      parameters:
        - name: execution_id
          in: path
          required: true
          schema:
            type: string
            title: Execution Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResumeExecutionRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /workflows/executions/{execution_id}:
    get:
      tags:
        - workflows
      summary: Get Execution
      description: >-
        Get a single workflow execution by ID (detail view for E2E
        verification).
      operationId: get_execution_workflows_executions__execution_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: execution_id
          in: path
          required: true
          schema:
            type: string
            title: Execution Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /workflows/executions:
    get:
      tags:
        - workflows
      summary: List Executions
      description: List executions
      operationId: list_executions_workflows_executions_get
      security:
        - HTTPBearer: []
      parameters:
        - name: workflow_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Workflow Id
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            default: 50
            title: Limit
        - name: offset
          in: query
          required: false
          schema:
            type: integer
            default: 0
            title: Offset
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /workflow-templates/templates:
    get:
      tags:
        - workflow-templates
      summary: List Templates
      description: List available workflow templates.
      operationId: list_templates_workflow_templates_templates_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/WorkflowTemplateDto'
                type: array
                title: Response List Templates Workflow Templates Templates Get
      security:
        - HTTPBearer: []
    post:
      tags:
        - workflow-templates
      summary: Create Template
      description: Create a new custom workflow template for the tenant.
      operationId: create_template_workflow_templates_templates_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTemplateRequest'
        required: true
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowTemplateDto'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /workflow-templates/templates/{template_id}:
    get:
      tags:
        - workflow-templates
      summary: Get Template
      description: Get a specific workflow template.
      operationId: get_template_workflow_templates_templates__template_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: template_id
          in: path
          required: true
          schema:
            type: string
            title: Template Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowTemplateDto'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    put:
      tags:
        - workflow-templates
      summary: Update Template
      description: Update an existing custom workflow template.
      operationId: update_template_workflow_templates_templates__template_id__put
      security:
        - HTTPBearer: []
      parameters:
        - name: template_id
          in: path
          required: true
          schema:
            type: string
            title: Template Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTemplateRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowTemplateDto'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /support/diagnose:
    post:
      tags:
        - support
      summary: Diagnose Issue
      description: Automatically diagnose an issue and provide troubleshooting steps
      operationId: diagnose_issue_support_diagnose_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SupportRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /support/guides:
    get:
      tags:
        - support
      summary: Get Troubleshooting Guides
      description: Get available troubleshooting guides
      operationId: get_troubleshooting_guides_support_guides_get
      parameters:
        - name: category
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Category
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /support/ticket:
    post:
      tags:
        - support
      summary: Create Support Ticket
      description: Create a support ticket for complex issues
      operationId: create_support_ticket_support_ticket_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SupportRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /support/health-check/{tenant_id}:
    get:
      tags:
        - support
      summary: Perform Health Check
      description: Perform comprehensive health check for tenant setup
      operationId: perform_health_check_support_health_check__tenant_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /system/risk/profiles:
    get:
      tags:
        - system
      summary: Get Risk Profiles
      description: Get available risk safety profiles.
      operationId: get_risk_profiles_system_risk_profiles_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /system/health:
    get:
      tags:
        - system
      summary: Health Check
      description: Detailed health check with legacy-compatible shape.
      operationId: health_check_system_health_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /system/metrics:
    get:
      tags:
        - system
      summary: Metrics
      description: Prometheus metrics endpoint
      operationId: metrics_system_metrics_get
      responses:
        '200':
          description: Successful Response
          content:
            text/plain:
              schema:
                type: string
  /system/scheduler:
    get:
      tags:
        - system
      summary: Scheduler Info
      description: |-
        Expose scheduler status and advise interval for UI display.

        Reports the live scheduler state rather than a feature flag.
      operationId: scheduler_info_system_scheduler_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /system/scheduler/floor:
    get:
      tags:
        - system
      summary: Get Scheduler Floor
      description: Return platform-wide minimum advise interval in minutes (default 30).
      operationId: get_scheduler_floor_system_scheduler_floor_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
    patch:
      tags:
        - system
      summary: Set Scheduler Floor
      description: Set platform-wide minimum advise interval (platform admin only).
      operationId: set_scheduler_floor_system_scheduler_floor_patch
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: true
              type: object
              title: Payload
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /system/features:
    get:
      tags:
        - system
      summary: Feature Status
      description: >-
        Report diagnostic configuration based on runtime availability (no
        flags).
      operationId: feature_status_system_features_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /system/performance/stats:
    get:
      tags:
        - system
      summary: Get Performance Stats
      description: Get performance optimization statistics
      operationId: get_performance_stats_system_performance_stats_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /system/agents/pool/stats:
    get:
      tags:
        - system
      summary: Get Agent Pool Stats
      description: Get async agent pool statistics
      operationId: get_agent_pool_stats_system_agents_pool_stats_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /system/errors/summary:
    get:
      tags:
        - system
      summary: Get Error Summary
      description: Get error summary and statistics from agent pool
      operationId: get_error_summary_system_errors_summary_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /system/performance/database:
    get:
      tags:
        - system
      summary: Get Database Performance
      description: Get database performance statistics
      operationId: get_database_performance_system_performance_database_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /system/performance/cache:
    get:
      tags:
        - system
      summary: Get Cache Performance
      description: Get cache performance statistics
      operationId: get_cache_performance_system_performance_cache_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /system/performance/cache/warm:
    post:
      tags:
        - system
      summary: Warm Cache
      description: Manually trigger cache warming
      operationId: warm_cache_system_performance_cache_warm_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /system/performance/maintenance:
    post:
      tags:
        - system
      summary: Trigger Database Maintenance
      description: Trigger database maintenance tasks
      operationId: trigger_database_maintenance_system_performance_maintenance_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /system/performance/summary:
    get:
      tags:
        - system
      summary: Get Performance Summary
      description: Get comprehensive performance summary
      operationId: get_performance_summary_system_performance_summary_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /internal/dev/reset-db:
    post:
      tags:
        - internal
      summary: Internal Reset Db
      description: 'Deprecated helper endpoint: instructs developers to reset DB manually.'
      operationId: internal_reset_db_internal_dev_reset_db_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /internal/agents/enqueue-advise:
    post:
      tags:
        - internal
      summary: Internal Enqueue Advise
      description: |-
        Enqueue an advise job for the given service (internal only).

        Requires a valid access token with manage_services or read_automations.
      operationId: internal_enqueue_advise_internal_agents_enqueue_advise_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EnqueueAdviseRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnqueueResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /internal/alerts/pubsub-push:
    post:
      tags:
        - internal
      summary: Internal Pubsub Advise Push
      description: >-
        Pub/Sub push endpoint to enqueue advise from alerts.


        Expects Pub/Sub push JSON with base64-encoded message.data containing:

        { tenant_id, service, scope?, reason? }. Enqueues finalize via Cloud
        Tasks.
      operationId: internal_pubsub_advise_push_internal_alerts_pubsub_push_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /internal/metrics/snapshot:
    post:
      tags:
        - internal
      summary: Internal Metrics Snapshot
      description: >-
        Snapshot current Redis metrics to PostgreSQL.


        Called by Cloud Scheduler (hourly in production).

        Manually callable in local dev: curl -X POST
        http://localhost:8081/internal/metrics/snapshot


        Authorization: OIDC audience (Cloud Scheduler) or platform admin
      operationId: internal_metrics_snapshot_internal_metrics_snapshot_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /admin/prompts:
    get:
      tags:
        - admin
      summary: List Prompts
      operationId: list_prompts_admin_prompts_get
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Service
        - name: intent
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Intent
        - name: include_all_versions
          in: query
          required: false
          schema:
            type: boolean
            default: false
            title: Include All Versions
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PromptTemplateOut'
                title: Response List Prompts Admin Prompts Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
        - admin
      summary: Create Prompt Template
      operationId: create_prompt_template_admin_prompts_post
      security:
        - HTTPBearer: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PromptTemplateIn'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PromptTemplateOut'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /admin/prompts/seed-status:
    get:
      tags:
        - admin
      summary: Get Prompt Seed Status
      description: >-
        Report seeding status for known (service, intent) pairs.


        - has_db_template: a PromptTemplate exists in the database.

        - has_global_config: a GlobalConfiguration entry exists for
        prompts.{service}.{intent}.

        - has_file: on-disk Jinja templates exist for the pair.

        - seeded: synonym for has_db_template.
      operationId: get_prompt_seed_status_admin_prompts_seed_status_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/PromptSeedStatusOut'
                type: array
                title: Response Get Prompt Seed Status Admin Prompts Seed Status Get
      security:
        - HTTPBearer: []
  /admin/prompts/seed:
    post:
      tags:
        - admin
      summary: Seed Prompts
      description: >-
        Trigger seeding of prompt templates from on-disk Jinja files into the
        database.


        This uses the same resolution path as the runtime
        (ConfigurationService.get_prompt_template),

        but is exposed as an explicit admin operation instead of relying on
        first-use.
      operationId: seed_prompts_admin_prompts_seed_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/PromptSeedStatusOut'
                type: array
                title: Response Seed Prompts Admin Prompts Seed Post
      security:
        - HTTPBearer: []
  /admin/prompts/preview:
    post:
      tags:
        - admin
      summary: Preview Prompt
      operationId: preview_prompt_admin_prompts_preview_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PromptPreviewRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Preview Prompt Admin Prompts Preview Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /admin/prompts/resolved:
    get:
      tags:
        - admin
      summary: Get Resolved Prompt
      description: >-
        Return the resolved template text and source
        (tenant|global|global_config|file|none).
      operationId: get_resolved_prompt_admin_prompts_resolved_get
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: query
          required: true
          schema:
            type: string
            title: Service
        - name: intent
          in: query
          required: true
          schema:
            type: string
            title: Intent
        - name: tenant_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Tenant Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: Response Get Resolved Prompt Admin Prompts Resolved Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /admin/prompts/{template_id}:
    delete:
      tags:
        - admin
      summary: Deactivate Prompt Template
      operationId: deactivate_prompt_template_admin_prompts__template_id__delete
      security:
        - HTTPBearer: []
      parameters:
        - name: template_id
          in: path
          required: true
          schema:
            type: string
            title: Template Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
                title: >-
                  Response Deactivate Prompt Template Admin Prompts  Template
                  Id  Delete
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /admin/compression-config:
    get:
      tags:
        - admin
      summary: List Compression Configs
      description: |-
        List all compression configuration priorities.

        **Access**: Platform admin only
      operationId: list_compression_configs_admin_compression_config_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/CompressionConfigResponse'
                type: array
                title: Response List Compression Configs Admin Compression Config Get
      security:
        - HTTPBearer: []
  /admin/compression-config/{service}:
    get:
      tags:
        - admin
      summary: Get Compression Config
      description: |-
        Get compression configuration for a specific service.

        **Access**: Platform admin only
      operationId: get_compression_config_admin_compression_config__service__get
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: path
          required: true
          schema:
            type: string
            title: Service
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CompressionConfigResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    put:
      tags:
        - admin
      summary: Update Compression Config
      description: |-
        Update compression configuration for a service.

        Creates new config if it doesn't exist.

        **Access**: Platform admin only
      operationId: update_compression_config_admin_compression_config__service__put
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: path
          required: true
          schema:
            type: string
            title: Service
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CompressionConfigUpdate'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CompressionConfigResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    delete:
      tags:
        - admin
      summary: Delete Compression Config
      description: |-
        Delete compression configuration for a service.

        **Access**: Platform admin only
      operationId: delete_compression_config_admin_compression_config__service__delete
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: path
          required: true
          schema:
            type: string
            title: Service
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /scopes/:
    get:
      tags:
        - scopes
      summary: List Scopes
      description: List all scopes for the tenant, optionally filtered by service.
      operationId: list_scopes_scopes__get
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Service
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ScopeResponse'
                title: Response List Scopes Scopes  Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
        - scopes
      summary: Create Scope
      description: Create a new scope.
      operationId: create_scope_scopes__post
      security:
        - HTTPBearer: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopeCreate'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /scopes/coverage:
    get:
      tags:
        - scopes
      summary: Scope Coverage
      description: |-
        Return a lightweight coverage summary for scopes vs active inventory.

        This powers the Scopes Control Center view and is derived from the same
        matching logic used by the InventoryService, so UI coverage matches what
        the scheduler/executor will see.
      operationId: scope_coverage_scopes_coverage_get
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Optional service key (e.g. cloudrun, bigquery)
            title: Service
          description: Optional service key (e.g. cloudrun, bigquery)
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /scopes/diagnose:
    post:
      tags:
        - scopes
      summary: Diagnose Scope Policy
      description: >-
        Diagnose how scopes and their policies apply to a specific resource.


        This endpoint is a thin wrapper around
        InventoryService.test_policy_for_resource

        and merge_scope_policies. It answers:


        - Which scopes match this resource?

        - What is the effective merged scope policy?

        - For each simulated action, is it allowed by the effective allowed_ops
          intersection, and which scopes contribute to that decision?
      operationId: diagnose_scope_policy_scopes_diagnose_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopeDiagnoseRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeDiagnoseResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /scopes/{scope_id}:
    put:
      tags:
        - scopes
      summary: Update Scope
      description: Update an existing scope.
      operationId: update_scope_scopes__scope_id__put
      security:
        - HTTPBearer: []
      parameters:
        - name: scope_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Scope Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopeUpdate'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    delete:
      tags:
        - scopes
      summary: Delete Scope
      description: Delete a scope.
      operationId: delete_scope_scopes__scope_id__delete
      security:
        - HTTPBearer: []
      parameters:
        - name: scope_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Scope Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /scopes/{scope_id}/default:
    put:
      tags:
        - scopes
      summary: Set Default Scope
      description: Set a specific scope as default for its service.
      operationId: set_default_scope_scopes__scope_id__default_put
      security:
        - HTTPBearer: []
      parameters:
        - name: scope_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Scope Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /scopes/{scope_id}/policy:
    patch:
      tags:
        - scopes
      summary: Patch Scope Policy
      description: |-
        Apply a targeted patch to a scope's policy.

        Currently supports add_allowed_op for policy.allowed_ops so that UIs
        can relax guardrails safely without rewriting the entire Scope.
      operationId: patch_scope_policy_scopes__scope_id__policy_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: scope_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Scope Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopePolicyPatch'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /scope-sagas:
    post:
      tags:
        - scopes
      summary: Create Scope Saga
      operationId: create_scope_saga_scope_sagas_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopeSagaCreateRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeSagaResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /scope-sagas/{saga_id}:
    get:
      tags:
        - scopes
      summary: Get Scope Saga
      operationId: get_scope_saga_scope_sagas__saga_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: saga_id
          in: path
          required: true
          schema:
            type: string
            title: Saga Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeSagaResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /scope-sagas/{saga_id}/step/target:
    patch:
      tags:
        - scopes
      summary: Update Scope Saga Target Step
      operationId: update_scope_saga_target_step_scope_sagas__saga_id__step_target_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: saga_id
          in: path
          required: true
          schema:
            type: string
            title: Saga Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TargetStepPayload'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeSagaResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /scope-sagas/{saga_id}/step/governance:
    patch:
      tags:
        - scopes
      summary: Update Scope Saga Governance Step
      operationId: >-
        update_scope_saga_governance_step_scope_sagas__saga_id__step_governance_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: saga_id
          in: path
          required: true
          schema:
            type: string
            title: Saga Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GovernanceStepPayload'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeSagaResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /scope-sagas/{saga_id}/step/schedule:
    patch:
      tags:
        - scopes
      summary: Update Scope Saga Schedule Step
      operationId: >-
        update_scope_saga_schedule_step_scope_sagas__saga_id__step_schedule_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: saga_id
          in: path
          required: true
          schema:
            type: string
            title: Saga Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScheduleStepPayload'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeSagaResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /scope-sagas/{saga_id}/commit:
    post:
      tags:
        - scopes
      summary: Commit Scope Saga
      operationId: commit_scope_saga_scope_sagas__saga_id__commit_post
      security:
        - HTTPBearer: []
      parameters:
        - name: saga_id
          in: path
          required: true
          schema:
            type: string
            title: Saga Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScopeSagaCommitResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /inventory/resources:
    get:
      tags:
        - inventory
      summary: List Inventory Resources
      description: List discovered/active/ignored resources for the current tenant.
      operationId: list_inventory_resources_inventory_resources_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tab
          in: query
          required: false
          schema:
            type: string
            pattern: ^(discovered|active|ignored|all)$
            default: discovered
            title: Tab
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Service
        - name: environment
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Environment
        - name: status
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Status
        - name: search
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Search
        - name: project_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Project Id
        - name: region
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Region
        - name: dataset_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Dataset Id
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 100
            minimum: 1
            default: 25
            title: Limit
        - name: offset
          in: query
          required: false
          schema:
            type: integer
            minimum: 0
            default: 0
            title: Offset
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InventoryListResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /inventory/resources/{discovered_scope_id}:
    get:
      tags:
        - inventory
      summary: Get Inventory Resource
      description: Return a single inventory resource with effective configuration.
      operationId: get_inventory_resource_inventory_resources__discovered_scope_id__get
      security:
        - HTTPBearer: []
      parameters:
        - name: discovered_scope_id
          in: path
          required: true
          schema:
            type: string
            title: Discovered Scope Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /inventory/resources/bulk-status:
    patch:
      tags:
        - inventory
      summary: Bulk Update Inventory Status
      description: Bulk update status (pending/active/ignored) for discovered resources.
      operationId: bulk_update_inventory_status_inventory_resources_bulk_status_patch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkStatusUpdate'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /inventory/resources/{discovered_scope_id}/export:
    get:
      tags:
        - inventory
      summary: Export Inventory Resource
      description: Export a JSON snapshot for a single inventory resource.
      operationId: >-
        export_inventory_resource_inventory_resources__discovered_scope_id__export_get
      security:
        - HTTPBearer: []
      parameters:
        - name: discovered_scope_id
          in: path
          required: true
          schema:
            type: string
            title: Discovered Scope Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /inventory/policy-diagnostics:
    get:
      tags:
        - inventory
      summary: Policy Diagnostics
      description: |-
        Return merged scope policy and matching scopes for a given service.

        This endpoint is intended for debugging scope overlaps and understanding
        which guardrails apply before automation is executed. It currently
        resolves policies at the service level; future revisions may accept
        resource identifiers to provide per-resource diagnostics.
      operationId: policy_diagnostics_inventory_policy_diagnostics_get
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: query
          required: true
          schema:
            type: string
            description: Service key (e.g. cloudrun, bigquery)
            title: Service
          description: Service key (e.g. cloudrun, bigquery)
        - name: project_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Optional GCP project id for context
            title: Project Id
          description: Optional GCP project id for context
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /inventory/policy-test:
    post:
      tags:
        - inventory
      summary: Policy Test
      description: >-
        Policy Tester endpoint.


        Given a hypothetical resource (service + project + optional
        region/dataset),

        return which scopes would match it and the merged effective scope
        policy.
      operationId: policy_test_inventory_policy_test_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyTestRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /teams/:
    get:
      tags:
        - teams
      summary: List Teams
      description: List all teams in the tenant.
      operationId: list_teams_teams__get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/TeamResponse'
                type: array
                title: Response List Teams Teams  Get
      security:
        - HTTPBearer: []
    post:
      tags:
        - teams
      summary: Create Team
      description: Create a new team.
      operationId: create_team_teams__post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TeamCreate'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /teams/{team_id}:
    put:
      tags:
        - teams
      summary: Update Team
      description: Update a team.
      operationId: update_team_teams__team_id__put
      security:
        - HTTPBearer: []
      parameters:
        - name: team_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Team Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TeamUpdate'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    delete:
      tags:
        - teams
      summary: Delete Team
      description: Delete a team.
      operationId: delete_team_teams__team_id__delete
      security:
        - HTTPBearer: []
      parameters:
        - name: team_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Team Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /teams/{team_id}/members:
    get:
      tags:
        - teams
      summary: List Team Members
      description: List members of a team.
      operationId: list_team_members_teams__team_id__members_get
      security:
        - HTTPBearer: []
      parameters:
        - name: team_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Team Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/TeamMemberResponse'
                title: Response List Team Members Teams  Team Id  Members Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
        - teams
      summary: Add Team Member
      description: Add a user to a team.
      operationId: add_team_member_teams__team_id__members_post
      security:
        - HTTPBearer: []
      parameters:
        - name: team_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Team Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TeamMemberAdd'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamMemberResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /teams/{team_id}/members/{user_id}:
    delete:
      tags:
        - teams
      summary: Remove Team Member
      description: Remove a user from a team.
      operationId: remove_team_member_teams__team_id__members__user_id__delete
      security:
        - HTTPBearer: []
      parameters:
        - name: team_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Team Id
        - name: user_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: User Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rbac/roles:
    get:
      tags:
        - rbac
      summary: List Roles
      description: List all roles with their permissions.
      operationId: list_roles_rbac_roles_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/RoleWithPermissions'
                type: array
                title: Response List Roles Rbac Roles Get
      security:
        - HTTPBearer: []
  /rbac/roles/{role_name}/permissions:
    get:
      tags:
        - rbac
      summary: Get Role Permissions
      description: Get permissions for a specific role.
      operationId: get_role_permissions_rbac_roles__role_name__permissions_get
      security:
        - HTTPBearer: []
      parameters:
        - name: role_name
          in: path
          required: true
          schema:
            type: string
            title: Role Name
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
                title: >-
                  Response Get Role Permissions Rbac Roles  Role Name 
                  Permissions Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rbac/users:
    get:
      tags:
        - rbac
      summary: List Users With Roles
      description: List all users with their roles for the current tenant.
      operationId: list_users_with_roles_rbac_users_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/UserWithRole'
                type: array
                title: Response List Users With Roles Rbac Users Get
      security:
        - HTTPBearer: []
  /rbac/users/{user_id}/role:
    put:
      tags:
        - rbac
      summary: Update User Role
      description: Update a user's role.
      operationId: update_user_role_rbac_users__user_id__role_put
      security:
        - HTTPBearer: []
      parameters:
        - name: user_id
          in: path
          required: true
          schema:
            type: string
            title: User Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateUserRoleRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rbac/team-scopes:
    get:
      tags:
        - rbac
      summary: List Team Scopes
      description: List team-scope assignments.
      operationId: list_team_scopes_rbac_team_scopes_get
      security:
        - HTTPBearer: []
      parameters:
        - name: team_id
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Team Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/TeamScopeInfo'
                title: Response List Team Scopes Rbac Team Scopes Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
        - rbac
      summary: Add Team Scope
      description: Add a scope to a team.
      operationId: add_team_scope_rbac_team_scopes_post
      security:
        - HTTPBearer: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddTeamScopeRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamScopeInfo'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rbac/team-scopes/{team_scope_id}:
    delete:
      tags:
        - rbac
      summary: Remove Team Scope
      description: Remove a scope from a team.
      operationId: remove_team_scope_rbac_team_scopes__team_scope_id__delete
      security:
        - HTTPBearer: []
      parameters:
        - name: team_scope_id
          in: path
          required: true
          schema:
            type: string
            title: Team Scope Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rbac/audit:
    get:
      tags:
        - rbac
      summary: List Maker Checker Audit
      description: List maker-checker audit log entries.
      operationId: list_maker_checker_audit_rbac_audit_get
      security:
        - HTTPBearer: []
      parameters:
        - name: entity_type
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by entity type (change, rollback)
            title: Entity Type
          description: Filter by entity type (change, rollback)
        - name: action
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by action (propose, approve, execute, reject)
            title: Action
          description: Filter by action (propose, approve, execute, reject)
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 200
            default: 50
            title: Limit
        - name: offset
          in: query
          required: false
          schema:
            type: integer
            default: 0
            title: Offset
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/MakerCheckerAuditEntry'
                title: Response List Maker Checker Audit Rbac Audit Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /rbac/available-roles:
    get:
      tags:
        - rbac
      summary: Get Available Roles
      description: Get list of available roles for assignment.
      operationId: get_available_roles_rbac_available_roles_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                items:
                  additionalProperties: true
                  type: object
                type: array
                title: Response Get Available Roles Rbac Available Roles Get
      security:
        - HTTPBearer: []
  /api/notifications:
    get:
      tags:
        - notifications
        - notifications
      summary: List Notifications
      description: Get notifications for the current user.
      operationId: list_notifications_api_notifications_get
      security:
        - HTTPBearer: []
      parameters:
        - name: event_types
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Comma-separated event types to filter
            title: Event Types
          description: Comma-separated event types to filter
        - name: unread_only
          in: query
          required: false
          schema:
            type: boolean
            description: Only return unread notifications
            default: false
            title: Unread Only
          description: Only return unread notifications
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 100
            minimum: 1
            default: 50
            title: Limit
        - name: offset
          in: query
          required: false
          schema:
            type: integer
            minimum: 0
            default: 0
            title: Offset
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationListResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/notifications/unread-count:
    get:
      tags:
        - notifications
        - notifications
      summary: Get Unread Count
      description: Get count of unread notifications.
      operationId: get_unread_count_api_notifications_unread_count_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnreadCountResponse'
      security:
        - HTTPBearer: []
  /api/notifications/{notification_id}/read:
    patch:
      tags:
        - notifications
        - notifications
      summary: Mark Notification Read
      description: Mark a notification as read.
      operationId: mark_notification_read_api_notifications__notification_id__read_patch
      security:
        - HTTPBearer: []
      parameters:
        - name: notification_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Notification Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MarkReadResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/notifications/mark-all-read:
    patch:
      tags:
        - notifications
        - notifications
      summary: Mark All Read
      description: Mark all notifications as read.
      operationId: mark_all_read_api_notifications_mark_all_read_patch
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkActionResponse'
      security:
        - HTTPBearer: []
  /api/notifications/{notification_id}:
    delete:
      tags:
        - notifications
        - notifications
      summary: Dismiss Notification
      description: Dismiss (soft-delete) a notification.
      operationId: dismiss_notification_api_notifications__notification_id__delete
      security:
        - HTTPBearer: []
      parameters:
        - name: notification_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Notification Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MarkReadResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/notifications/clear-all:
    delete:
      tags:
        - notifications
        - notifications
      summary: Clear All Notifications
      description: Clear (dismiss) all notifications.
      operationId: clear_all_notifications_api_notifications_clear_all_delete
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkActionResponse'
      security:
        - HTTPBearer: []
  /api/notifications/preferences:
    get:
      tags:
        - notifications
        - notifications
      summary: Get Preferences
      description: Get notification preferences for the current user.
      operationId: get_preferences_api_notifications_preferences_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PreferencesResponse'
      security:
        - HTTPBearer: []
    patch:
      tags:
        - notifications
        - notifications
      summary: Update Preferences
      description: Update notification preferences for the current user.
      operationId: update_preferences_api_notifications_preferences_patch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PreferencesUpdateRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PreferencesResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /findings/{finding_id}/severity-feedback:
    post:
      tags:
        - findings
      summary: Submit Severity Feedback
      description: |-
        Submit feedback about a finding's severity.

        This feedback is used to:
        1. Identify findings that need reclassification
        2. Train ML models (Phase 3)
        3. Aggregate patterns across tenants

        **Permissions**: Any authenticated user can submit feedback on findings
        they have access to (tenant-scoped).
      operationId: submit_severity_feedback_findings__finding_id__severity_feedback_post
      security:
        - HTTPBearer: []
      parameters:
        - name: finding_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Finding Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SeverityFeedbackRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SeverityFeedbackResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /admin/severity-feedback/summary:
    get:
      tags:
        - admin
        - severity-feedback
      summary: Get Feedback Summary
      description: |-
        Get overall feedback statistics.

        **Requires**: Platform admin access
      operationId: get_feedback_summary_admin_severity_feedback_summary_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FeedbackSummary'
      security:
        - HTTPBearer: []
  /admin/severity-feedback/by-type:
    get:
      tags:
        - admin
        - severity-feedback
      summary: Get Feedback By Type
      description: |-
        Get aggregated feedback grouped by finding type.

        **Requires**: Platform admin access
      operationId: get_feedback_by_type_admin_severity_feedback_by_type_get
      security:
        - HTTPBearer: []
      parameters:
        - name: disputed_only
          in: query
          required: false
          schema:
            type: boolean
            description: Only show disputed finding types
            default: false
            title: Disputed Only
          description: Only show disputed finding types
        - name: min_feedback_count
          in: query
          required: false
          schema:
            type: integer
            description: Minimum feedback count to include
            default: 1
            title: Min Feedback Count
          description: Minimum feedback count to include
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 100
            description: Max results
            default: 50
            title: Limit
          description: Max results
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/FindingTypeFeedbackDetail'
                title: >-
                  Response Get Feedback By Type Admin Severity Feedback By Type
                  Get
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /admin/severity-feedback/metadata/update:
    post:
      tags:
        - admin
        - severity-feedback
      summary: Update Severity Metadata
      description: |-
        Update finding type severity metadata based on reviewed feedback.

        **Requires**: Platform admin access
      operationId: update_severity_metadata_admin_severity_feedback_metadata_update_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateMetadataRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
  /tenants/{tenant_id}/join-requests:
    get:
      tags:
        - join-requests
      summary: List Join Requests
      description: |-
        List all join requests for a tenant.
        Requires 'manage_users' permission (admin role).
      operationId: list_join_requests_tenants__tenant_id__join_requests_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: status_filter
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Status Filter
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/join-requests/{request_id}/approve:
    post:
      tags:
        - join-requests
      summary: Approve Join Request
      description: Approve a join request - adds the user to the tenant with 'user' role.
      operationId: >-
        approve_join_request_tenants__tenant_id__join_requests__request_id__approve_post
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: request_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Request Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /tenants/{tenant_id}/join-requests/{request_id}/reject:
    post:
      tags:
        - join-requests
      summary: Reject Join Request
      description: Reject a join request.
      operationId: >-
        reject_join_request_tenants__tenant_id__join_requests__request_id__reject_post
      security:
        - HTTPBearer: []
      parameters:
        - name: tenant_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Tenant Id
        - name: request_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Request Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RejectRequestPayload'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/metrics/cost-summary:
    get:
      tags:
        - metrics
      summary: Get Cost Summary
      description: |-
        Get cost summary by tier.

        Returns LLM token usage, cache stats, and estimated COGS.

        **Access**: Platform admin only
      operationId: get_cost_summary_api_metrics_cost_summary_get
      security:
        - HTTPBearer: []
      parameters:
        - name: tier
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by tier (free/team/pro/enterprise)
            title: Tier
          description: Filter by tier (free/team/pro/enterprise)
        - name: time_window
          in: query
          required: false
          schema:
            type: string
            pattern: ^(1h|24h|7d|30d)$
            default: 7d
            title: Time Window
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/metrics/cache-performance:
    get:
      tags:
        - metrics
      summary: Get Cache Performance
      description: |-
        Get cache performance by service.

        Returns hit rates, miss counts, and scan efficiency.

        **Access**: Platform admin only
      operationId: get_cache_performance_api_metrics_cache_performance_get
      security:
        - HTTPBearer: []
      parameters:
        - name: service
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by service
            title: Service
          description: Filter by service
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/metrics/quota-health:
    get:
      tags:
        - metrics
      summary: Get Quota Health
      description: |-
        Get quota health across all tiers.

        Returns usage, limits, and exceeded events.

        **Access**: Platform admin only
      operationId: get_quota_health_api_metrics_quota_health_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
      security:
        - HTTPBearer: []
  /api/public/config/pricing:
    get:
      tags:
        - public-config
        - config
      summary: Get Pricing
      description: >-
        Get tier pricing configuration for signup page.


        Returns all tier configurations from service_ops.yaml tier_config
        section.

        Used to render the pricing matrix during signup.


        Response includes:

        - tiers: Dict mapping tier names to their full configuration

        - tier_order: List of tier keys in display order
      operationId: get_pricing_api_public_config_pricing_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Get Pricing Api Public Config Pricing Get
  /api/public/config/services:
    get:
      tags:
        - public-config
        - config
      summary: Get Services
      description: |-
        Get all service metadata for landing page.

        Returns the __metadata__ section from service_ops.yaml.
      operationId: get_services_api_public_config_services_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Get Services Api Public Config Services Get
  /api/public/config/llm-models:
    get:
      tags:
        - public-config
        - config
      summary: Get Llm Models
      description: >-
        Get LLM model configuration.


        Returns the phase-to-model mapping from service_ops.yaml llm_config
        section.

        Primarily for observability and debugging purposes.
      operationId: get_llm_models_api_public_config_llm_models_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Get Llm Models Api Public Config Llm Models Get
  /health:
    get:
      summary: Health Check
      description: >-
        Root health check for Docker/LB compatibility.


        Delegates to the detailed /system/health endpoint so callers always
        receive

        the same JSON shape (including legacy "checks" metadata).
      operationId: health_check_health_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /metrics:
    get:
      summary: Metrics
      description: Root Prometheus metrics endpoint (delegates to /system/metrics).
      operationId: metrics_metrics_get
      responses:
        '200':
          description: Successful Response
          content:
            text/plain:
              schema:
                type: string
  /:
    get:
      summary: Root
      description: Redirect to dashboard (legacy behavior)
      operationId: root__get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /api:
    get:
      summary: Api Info
      description: API info endpoint
      operationId: api_info_api_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
components:
  schemas:
    APIKeyRequest:
      properties:
        description:
          type: string
          title: Description
          default: ''
      type: object
      title: APIKeyRequest
    ActionDecision:
      properties:
        op:
          type: string
          title: Op
        canonical_op:
          anyOf:
            - type: string
            - type: 'null'
          title: Canonical Op
        allowed:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Allowed
        reason:
          anyOf:
            - type: string
            - type: 'null'
          title: Reason
        blocking_scopes:
          items:
            type: string
          type: array
          title: Blocking Scopes
          default: []
        allowed_scopes:
          items:
            type: string
          type: array
          title: Allowed Scopes
          default: []
        effective_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Effective Allowed Ops
      type: object
      required:
        - op
      title: ActionDecision
    AddTeamScopeRequest:
      properties:
        team_id:
          type: string
          title: Team Id
        scope_id:
          type: string
          title: Scope Id
      type: object
      required:
        - team_id
        - scope_id
      title: AddTeamScopeRequest
      description: Request to add a scope to a team.
    AdviseRequest:
      properties:
        tenant_id:
          type: string
          title: Tenant Id
        service:
          type: string
          enum:
            - cloudrun
            - gke
            - bigquery
            - cloudsql
            - gcs
            - gce
            - pubsub
            - secretmgr
          title: Service
        scope:
          anyOf:
            - $ref: '#/components/schemas/ScopeSelector'
            - type: 'null'
        scope_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Scope Id
        options:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Options
        run_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Run Id
      type: object
      required:
        - tenant_id
        - service
      title: AdviseRequest
    AgentFeedbackRequest:
      properties:
        run_id:
          type: string
          title: Run Id
          description: Run ID this feedback applies to
        pattern_id:
          type: string
          pattern: ^[a-z0-9_]+_[a-f0-9]{8}$
          title: Pattern Id
          description: Canonical pattern ID (service_hash)
        sentiment:
          type: string
          pattern: ^(useful|not_useful)$
          title: Sentiment
          description: Sentiment
        reason:
          anyOf:
            - type: string
            - type: 'null'
          title: Reason
          description: Reason for negative feedback
        comment:
          anyOf:
            - type: string
            - type: 'null'
          title: Comment
          description: Free text comment
      type: object
      required:
        - run_id
        - pattern_id
        - sentiment
      title: AgentFeedbackRequest
    AssignRoleRequest:
      properties:
        user_email:
          type: string
          title: User Email
          description: User email to assign role to
        role_name:
          type: string
          title: Role Name
          description: Role name to assign (e.g., user, viewer, admin, platform_admin)
      type: object
      required:
        - user_email
        - role_name
      title: AssignRoleRequest
    AsyncJobResponse:
      properties:
        job_id:
          type: string
          title: Job Id
        run_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Run Id
        status:
          type: string
          title: Status
          default: queued
      type: object
      required:
        - job_id
      title: AsyncJobResponse
    AutoSetupRequest:
      properties:
        project_id:
          type: string
          title: Project Id
      type: object
      required:
        - project_id
      title: AutoSetupRequest
    Body_validate_gcp_authenticated_onboarding_gcp_validate_post:
      properties:
        credentials:
          anyOf:
            - type: string
              format: binary
            - type: 'null'
          title: Credentials
        project_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Project Id
      type: object
      title: Body_validate_gcp_authenticated_onboarding_gcp_validate_post
    BulkActionResponse:
      properties:
        success:
          type: boolean
          title: Success
        affected_count:
          type: integer
          title: Affected Count
      type: object
      required:
        - success
        - affected_count
      title: BulkActionResponse
    BulkStatusUpdate:
      properties:
        ids:
          items:
            type: string
          type: array
          title: Ids
        status:
          type: string
          title: Status
      type: object
      required:
        - ids
        - status
      title: BulkStatusUpdate
    ChangeSet:
      properties:
        steps:
          items:
            $ref: '#/components/schemas/ChangeSetStep'
          type: array
          title: Steps
        summary:
          anyOf:
            - type: string
            - type: 'null'
          title: Summary
      type: object
      title: ChangeSet
    ChangeSetPatchRequest:
      properties:
        steps:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Steps
          description: Full list of steps to replace current steps
        reason:
          anyOf:
            - type: string
            - type: 'null'
          title: Reason
          description: Reason for the edit
      type: object
      required:
        - steps
      title: ChangeSetPatchRequest
    ChangeSetStep:
      properties:
        id:
          type: string
          title: Id
        service:
          type: string
          enum:
            - cloudrun
            - gke
            - bigquery
            - cloudsql
            - gcs
            - gce
            - pubsub
            - secretmgr
          title: Service
        resource_ref:
          $ref: '#/components/schemas/ResourceRef'
        action:
          type: string
          title: Action
        params:
          additionalProperties: true
          type: object
          title: Params
        dry_run_cmd:
          anyOf:
            - type: string
            - type: 'null'
          title: Dry Run Cmd
        apply_cmd:
          anyOf:
            - type: string
            - type: 'null'
          title: Apply Cmd
        equivalent_command:
          anyOf:
            - type: string
            - type: 'null'
          title: Equivalent Command
        prechecks:
          items:
            $ref: '#/components/schemas/Precheck'
          type: array
          title: Prechecks
        rollback:
          anyOf:
            - $ref: '#/components/schemas/RollbackPlan'
            - type: 'null'
        idempotency_key:
          type: string
          title: Idempotency Key
      type: object
      required:
        - id
        - service
        - resource_ref
        - action
        - idempotency_key
      title: ChangeSetStep
    ComplianceChecklist:
      properties:
        sso_configured:
          type: boolean
          title: Sso Configured
          default: false
        mfa_enforced:
          type: boolean
          title: Mfa Enforced
          default: false
        audit_logging_enabled:
          type: boolean
          title: Audit Logging Enabled
          default: true
        data_retention_days:
          type: integer
          title: Data Retention Days
          default: 2555
        encryption_at_rest:
          type: boolean
          title: Encryption At Rest
          default: true
        encryption_in_transit:
          type: boolean
          title: Encryption In Transit
          default: true
        principle_of_least_privilege:
          type: boolean
          title: Principle Of Least Privilege
          default: false
        regular_access_reviews:
          type: boolean
          title: Regular Access Reviews
          default: false
        gdpr_compliant:
          type: boolean
          title: Gdpr Compliant
          default: false
        soc2_compliant:
          type: boolean
          title: Soc2 Compliant
          default: false
        iso27001_compliant:
          type: boolean
          title: Iso27001 Compliant
          default: false
        incident_response_plan:
          type: boolean
          title: Incident Response Plan
          default: false
        security_contacts_configured:
          type: boolean
          title: Security Contacts Configured
          default: false
      type: object
      title: ComplianceChecklist
      description: Compliance checklist items for enterprise tier
    CompressionConfigResponse:
      properties:
        service:
          type: string
          title: Service
        priority_keys:
          items:
            type: string
          type: array
          title: Priority Keys
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        created_at:
          type: string
          title: Created At
        updated_at:
          type: string
          title: Updated At
      type: object
      required:
        - service
        - priority_keys
        - description
        - created_at
        - updated_at
      title: CompressionConfigResponse
      description: Response model for compression config.
    CompressionConfigUpdate:
      properties:
        service:
          type: string
          title: Service
        priority_keys:
          items:
            type: string
          type: array
          title: Priority Keys
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
      type: object
      required:
        - service
        - priority_keys
      title: CompressionConfigUpdate
      description: Request model for updating compression config.
    CreateTemplateRequest:
      properties:
        name:
          type: string
          title: Name
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        definition:
          additionalProperties: true
          type: object
          title: Definition
      type: object
      required:
        - name
        - description
        - definition
      title: CreateTemplateRequest
    EmailMfaRequest:
      properties:
        email:
          type: string
          title: Email
      type: object
      required:
        - email
      title: EmailMfaRequest
    EnqueueAdviseRequest:
      properties:
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
        service:
          type: string
          title: Service
          description: Target service key, e.g. cloudrun
        scope:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Scope
        reason:
          anyOf:
            - type: string
            - type: 'null'
          title: Reason
        trigger:
          anyOf:
            - type: string
            - type: 'null'
          title: Trigger
          description: manual|schedule|alert
        selectors:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Selectors
        idempotency_key:
          anyOf:
            - type: string
            - type: 'null'
          title: Idempotency Key
          description: Optional client-supplied id to dedupe requests
        priority:
          anyOf:
            - type: string
            - type: 'null'
          title: Priority
          description: >-
            Optional priority hint: 'low' routes to low-priority queue if
            configured
        schedule_seconds:
          anyOf:
            - type: integer
            - type: 'null'
          title: Schedule Seconds
          description: Optionally delay execution by N seconds (jitter)
      type: object
      required:
        - service
      title: EnqueueAdviseRequest
    EnqueueResponse:
      properties:
        job_id:
          type: string
          title: Job Id
        run_id:
          type: string
          title: Run Id
        status:
          type: string
          title: Status
          default: queued
      type: object
      required:
        - job_id
        - run_id
      title: EnqueueResponse
    FeedbackSummary:
      properties:
        total_feedback_count:
          type: integer
          title: Total Feedback Count
        unique_findings_with_feedback:
          type: integer
          title: Unique Findings With Feedback
        disputed_finding_types:
          type: integer
          title: Disputed Finding Types
        avg_feedback_per_finding_type:
          type: number
          title: Avg Feedback Per Finding Type
        feedback_by_status:
          additionalProperties: true
          type: object
          title: Feedback By Status
        suggestions_by_severity:
          additionalProperties: true
          type: object
          title: Suggestions By Severity
      type: object
      required:
        - total_feedback_count
        - unique_findings_with_feedback
        - disputed_finding_types
        - avg_feedback_per_finding_type
        - feedback_by_status
        - suggestions_by_severity
      title: FeedbackSummary
      description: Overall feedback statistics.
    FindingTypeFeedbackDetail:
      properties:
        service:
          type: string
          title: Service
        kind:
          type: string
          title: Kind
        current_severity:
          anyOf:
            - type: string
            - type: 'null'
          title: Current Severity
        feedback_count:
          type: integer
          title: Feedback Count
        suggested_severities:
          additionalProperties: true
          type: object
          title: Suggested Severities
        most_common_suggestion:
          type: string
          title: Most Common Suggestion
        agreement_percentage:
          type: number
          title: Agreement Percentage
        reasons:
          additionalProperties: true
          type: object
          title: Reasons
        is_disputed:
          type: boolean
          title: Is Disputed
        sample_comments:
          items:
            type: string
          type: array
          title: Sample Comments
      type: object
      required:
        - service
        - kind
        - current_severity
        - feedback_count
        - suggested_severities
        - most_common_suggestion
        - agreement_percentage
        - reasons
        - is_disputed
        - sample_comments
      title: FindingTypeFeedbackDetail
      description: Feedback aggregation for a specific finding type.
    ForgotPasswordRequest:
      properties:
        email:
          type: string
          title: Email
      type: object
      required:
        - email
      title: ForgotPasswordRequest
    GcpProjectOut:
      properties:
        project_id:
          type: string
          title: Project Id
        project_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Project Name
        region:
          anyOf:
            - type: string
            - type: 'null'
          title: Region
        environment:
          anyOf:
            - type: string
            - type: 'null'
          title: Environment
        is_active:
          type: boolean
          title: Is Active
          default: true
        service_account_email:
          anyOf:
            - type: string
            - type: 'null'
          title: Service Account Email
        project_config:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Project Config
        automations_enabled:
          type: boolean
          title: Automations Enabled
          default: false
        last_quick_discovery_at:
          anyOf:
            - {}
            - type: 'null'
          title: Last Quick Discovery At
        last_quick_discovery_summary:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Last Quick Discovery Summary
        monthly_budget_usd:
          anyOf:
            - type: number
            - type: 'null'
          title: Monthly Budget Usd
      type: object
      required:
        - project_id
      title: GcpProjectOut
    GoogleSignupRequest:
      properties:
        id_token:
          type: string
          title: Id Token
        organization_name:
          type: string
          title: Organization Name
        admin_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Admin Name
        subscription_tier:
          type: string
          title: Subscription Tier
          default: starter
        company_size:
          anyOf:
            - type: string
            - type: 'null'
          title: Company Size
        use_case:
          anyOf:
            - type: string
            - type: 'null'
          title: Use Case
        referral_source:
          anyOf:
            - type: string
            - type: 'null'
          title: Referral Source
      type: object
      required:
        - id_token
        - organization_name
      title: GoogleSignupRequest
      description: Signup payload when using Google OAuth
    GovernanceStepPayload:
      properties:
        risk_profile:
          anyOf:
            - type: string
            - type: 'null'
          title: Risk Profile
        policy:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Policy
        owner_team_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Owner Team Id
        extra:
          additionalProperties: true
          type: object
          title: Extra
      type: object
      title: GovernanceStepPayload
    Guardrails:
      properties:
        dry_run:
          type: boolean
          title: Dry Run
          default: true
        max_concurrency:
          anyOf:
            - type: integer
            - type: 'null'
          title: Max Concurrency
        blast_radius_limit:
          anyOf:
            - type: integer
            - type: 'null'
          title: Blast Radius Limit
          description: Max resources to change in one execution
      type: object
      title: Guardrails
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    InventoryListResponse:
      properties:
        items:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Items
        total:
          type: integer
          title: Total
      type: object
      required:
        - items
        - total
      title: InventoryListResponse
    MagicLinkRequest:
      properties:
        email:
          type: string
          title: Email
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
        send_email:
          type: boolean
          title: Send Email
          default: true
      type: object
      required:
        - email
      title: MagicLinkRequest
    MakerCheckerAuditEntry:
      properties:
        id:
          type: string
          title: Id
        entity_type:
          type: string
          title: Entity Type
        entity_id:
          type: string
          title: Entity Id
        action:
          type: string
          title: Action
        performed_by:
          anyOf:
            - type: string
            - type: 'null'
          title: Performed By
        performed_by_email:
          anyOf:
            - type: string
            - type: 'null'
          title: Performed By Email
        performed_at:
          type: string
          title: Performed At
        is_emergency_bypass:
          type: boolean
          title: Is Emergency Bypass
          default: false
        bypass_reason:
          anyOf:
            - type: string
            - type: 'null'
          title: Bypass Reason
        notes:
          anyOf:
            - type: string
            - type: 'null'
          title: Notes
      type: object
      required:
        - id
        - entity_type
        - entity_id
        - action
        - performed_at
      title: MakerCheckerAuditEntry
      description: Maker-checker audit log entry.
    MarkReadResponse:
      properties:
        success:
          type: boolean
          title: Success
        notification_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Notification Id
      type: object
      required:
        - success
      title: MarkReadResponse
    MfaStatusResponse:
      properties:
        mfa_enabled:
          type: boolean
          title: Mfa Enabled
        totp_enabled:
          type: boolean
          title: Totp Enabled
        webauthn_enabled:
          type: boolean
          title: Webauthn Enabled
        recovery_codes_remaining:
          type: integer
          title: Recovery Codes Remaining
        mfa_required:
          type: boolean
          title: Mfa Required
          description: True if user has elevated permissions requiring MFA
      type: object
      required:
        - mfa_enabled
        - totp_enabled
        - webauthn_enabled
        - recovery_codes_remaining
        - mfa_required
      title: MfaStatusResponse
      description: MFA configuration status for current user.
    NotificationChannelConfig:
      properties:
        enabled:
          type: boolean
          title: Enabled
          default: false
        recipients:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Recipients
        webhook_url:
          anyOf:
            - type: string
            - type: 'null'
          title: Webhook Url
      type: object
      title: NotificationChannelConfig
    NotificationListResponse:
      properties:
        notifications:
          items:
            $ref: '#/components/schemas/NotificationResponse'
          type: array
          title: Notifications
        unread_count:
          type: integer
          title: Unread Count
        total:
          type: integer
          title: Total
      type: object
      required:
        - notifications
        - unread_count
        - total
      title: NotificationListResponse
    NotificationPreferences:
      properties:
        email_alerts:
          type: boolean
          title: Email Alerts
          default: false
        slack_integration:
          type: boolean
          title: Slack Integration
          default: false
        sms_alerts:
          type: boolean
          title: Sms Alerts
          default: false
        channels:
          anyOf:
            - additionalProperties:
                $ref: '#/components/schemas/NotificationChannelConfig'
              type: object
            - type: 'null'
          title: Channels
      type: object
      title: NotificationPreferences
    NotificationResponse:
      properties:
        id:
          type: string
          title: Id
        tenant_id:
          type: string
          title: Tenant Id
        user_id:
          anyOf:
            - type: string
            - type: 'null'
          title: User Id
        event_type:
          type: string
          title: Event Type
        severity:
          type: string
          title: Severity
        title:
          type: string
          title: Title
        message:
          anyOf:
            - type: string
            - type: 'null'
          title: Message
        resource_type:
          anyOf:
            - type: string
            - type: 'null'
          title: Resource Type
        resource_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Resource Id
        action_url:
          anyOf:
            - type: string
            - type: 'null'
          title: Action Url
        read:
          type: boolean
          title: Read
        metadata:
          additionalProperties: true
          type: object
          title: Metadata
        created_at:
          type: string
          title: Created At
      type: object
      required:
        - id
        - tenant_id
        - event_type
        - severity
        - title
        - read
        - created_at
      title: NotificationResponse
    PolicyTestRequest:
      properties:
        service:
          type: string
          title: Service
        project_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Project Id
        region:
          anyOf:
            - type: string
            - type: 'null'
          title: Region
        dataset_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Dataset Id
        resource_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Resource Id
        resource_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Resource Name
      type: object
      required:
        - service
      title: PolicyTestRequest
    Precheck:
      properties:
        id:
          type: string
          title: Id
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        required:
          type: boolean
          title: Required
          default: true
      type: object
      required:
        - id
      title: Precheck
    PreferencesRequest:
      properties:
        persona:
          anyOf:
            - type: string
            - type: 'null'
          title: Persona
          description: sre | finops | executive
      type: object
      title: PreferencesRequest
      description: >-
        Patchable preferences for a tenant/user context.

        Currently only persona is supported; stored under
        risk_config.preferences.persona
    PreferencesResponse:
      properties:
        id:
          anyOf:
            - type: string
            - type: 'null'
          title: Id
        tenant_id:
          type: string
          title: Tenant Id
        user_id:
          anyOf:
            - type: string
            - type: 'null'
          title: User Id
        in_app_enabled:
          type: boolean
          title: In App Enabled
        email_enabled:
          type: boolean
          title: Email Enabled
        email_digest_frequency:
          type: string
          title: Email Digest Frequency
        event_preferences:
          additionalProperties: true
          type: object
          title: Event Preferences
        service_preferences:
          additionalProperties: true
          type: object
          title: Service Preferences
        quiet_hours_enabled:
          type: boolean
          title: Quiet Hours Enabled
          default: false
        quiet_hours_start:
          anyOf:
            - type: string
            - type: 'null'
          title: Quiet Hours Start
        quiet_hours_end:
          anyOf:
            - type: string
            - type: 'null'
          title: Quiet Hours End
        quiet_hours_timezone:
          type: string
          title: Quiet Hours Timezone
          default: UTC
        min_severity:
          type: string
          title: Min Severity
          default: info
      type: object
      required:
        - tenant_id
        - in_app_enabled
        - email_enabled
        - email_digest_frequency
      title: PreferencesResponse
    PreferencesUpdateRequest:
      properties:
        in_app_enabled:
          anyOf:
            - type: boolean
            - type: 'null'
          title: In App Enabled
        email_enabled:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Email Enabled
        email_digest_frequency:
          anyOf:
            - type: string
            - type: 'null'
          title: Email Digest Frequency
        event_preferences:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Event Preferences
        service_preferences:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Service Preferences
        quiet_hours_enabled:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Quiet Hours Enabled
        quiet_hours_start:
          anyOf:
            - type: string
            - type: 'null'
          title: Quiet Hours Start
        quiet_hours_end:
          anyOf:
            - type: string
            - type: 'null'
          title: Quiet Hours End
        quiet_hours_timezone:
          anyOf:
            - type: string
            - type: 'null'
          title: Quiet Hours Timezone
        min_severity:
          anyOf:
            - type: string
            - type: 'null'
          title: Min Severity
      type: object
      title: PreferencesUpdateRequest
    ProjectActiveRequest:
      properties:
        is_active:
          type: boolean
          title: Is Active
      type: object
      required:
        - is_active
      title: ProjectActiveRequest
      description: Toggle per-project active status.
    ProjectAutomationRequest:
      properties:
        automations_enabled:
          type: boolean
          title: Automations Enabled
      type: object
      required:
        - automations_enabled
      title: ProjectAutomationRequest
      description: Toggle per-project automation enablement.
    PromptPreviewRequest:
      properties:
        service:
          type: string
          title: Service
        intent:
          type: string
          title: Intent
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
        template_text:
          anyOf:
            - type: string
            - type: 'null'
          title: Template Text
        scope:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Scope
        signals:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Signals
        caps:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Caps
        region:
          anyOf:
            - type: string
            - type: 'null'
          title: Region
      type: object
      required:
        - service
        - intent
      title: PromptPreviewRequest
    PromptSeedStatusOut:
      properties:
        service:
          type: string
          title: Service
        intent:
          type: string
          title: Intent
        has_db_template:
          type: boolean
          title: Has Db Template
        has_global_config:
          type: boolean
          title: Has Global Config
        has_file:
          type: boolean
          title: Has File
        seeded:
          type: boolean
          title: Seeded
      type: object
      required:
        - service
        - intent
        - has_db_template
        - has_global_config
        - has_file
        - seeded
      title: PromptSeedStatusOut
    PromptTemplateIn:
      properties:
        service:
          type: string
          title: Service
          description: cloudrun|bigquery|gke|cloud_sql
        intent:
          type: string
          title: Intent
          description: advise_change_set|cold_start|slot_optimization|...
        template_text:
          type: string
          title: Template Text
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
      type: object
      required:
        - service
        - intent
        - template_text
      title: PromptTemplateIn
    PromptTemplateOut:
      properties:
        template_id:
          type: string
          title: Template Id
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
        service:
          type: string
          title: Service
        intent:
          type: string
          title: Intent
        version:
          type: integer
          title: Version
        is_active:
          type: boolean
          title: Is Active
        updated_by:
          anyOf:
            - type: string
            - type: 'null'
          title: Updated By
        template_text:
          type: string
          title: Template Text
        created_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Created At
        updated_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Updated At
      type: object
      required:
        - template_id
        - tenant_id
        - service
        - intent
        - version
        - is_active
        - updated_by
        - template_text
        - created_at
        - updated_at
      title: PromptTemplateOut
    ProposeFixRequest:
      properties:
        service:
          type: string
          enum:
            - cloudrun
            - gke
            - bigquery
            - cloudsql
            - gcs
            - gce
            - pubsub
            - secretmgr
          title: Service
        change_set:
          $ref: '#/components/schemas/ChangeSet'
        title:
          anyOf:
            - type: string
            - type: 'null'
          title: Title
          description: Optional human-friendly title
        risk:
          anyOf:
            - $ref: '#/components/schemas/RiskInfo'
            - type: 'null'
        estimated_impact:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Estimated Impact
      type: object
      required:
        - service
        - change_set
      title: ProposeFixRequest
      description: Bridge request to create an approval for an SmartSRE change_set.
    RefreshTokenRequest:
      properties:
        refresh_token:
          anyOf:
            - type: string
            - type: 'null'
          title: Refresh Token
      type: object
      title: RefreshTokenRequest
    RejectRequestPayload:
      properties:
        reason:
          anyOf:
            - type: string
            - type: 'null'
          title: Reason
      type: object
      title: RejectRequestPayload
    RemediateRequest:
      properties:
        tenant_id:
          type: string
          title: Tenant Id
        service:
          type: string
          enum:
            - cloudrun
            - gke
            - bigquery
            - cloudsql
            - gcs
            - gce
            - pubsub
            - secretmgr
          title: Service
        approved_change_set:
          $ref: '#/components/schemas/ChangeSet'
        run_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Run Id
        guardrails:
          anyOf:
            - $ref: '#/components/schemas/Guardrails'
            - type: 'null'
        automation_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Automation Id
      type: object
      required:
        - tenant_id
        - service
        - approved_change_set
      title: RemediateRequest
    ReportSchedule:
      properties:
        recipients:
          items:
            type: string
          type: array
          title: Recipients
        cadence:
          type: string
          title: Cadence
          default: monthly
        day_of_month:
          type: integer
          maximum: 28
          minimum: 1
          title: Day Of Month
          default: 1
        time:
          type: string
          title: Time
          default: '09:00'
        timezone:
          type: string
          title: Timezone
          default: Asia/Kolkata
      type: object
      required:
        - recipients
      title: ReportSchedule
      description: Simple schedule for executive monthly report.
    ResetPasswordRequest:
      properties:
        token:
          type: string
          title: Token
        new_password:
          type: string
          title: New Password
      type: object
      required:
        - token
        - new_password
      title: ResetPasswordRequest
    ResourceRef:
      properties:
        service:
          type: string
          enum:
            - cloudrun
            - gke
            - bigquery
            - cloudsql
            - gcs
            - gce
            - pubsub
            - secretmgr
          title: Service
        name:
          type: string
          title: Name
          description: Human-friendly name or identifier
        full_path:
          anyOf:
            - type: string
            - type: 'null'
          title: Full Path
          description: Fully-qualified resource path, e.g. projects/<id>/...
      type: object
      required:
        - service
        - name
      title: ResourceRef
    ResumeExecutionRequest:
      properties:
        decision:
          type: string
          title: Decision
        state_updates:
          additionalProperties: true
          type: object
          title: State Updates
          default: {}
      type: object
      required:
        - decision
      title: ResumeExecutionRequest
    RiskConfigRequest:
      properties:
        auto_apply_cost_threshold:
          type: number
          title: Auto Apply Cost Threshold
          default: 50
        auto_apply_risk_level:
          type: string
          enum:
            - low
            - medium
            - high
          title: Auto Apply Risk Level
          default: low
        require_approval_for_production:
          type: boolean
          title: Require Approval For Production
          default: true
        require_approval_for_cost_above:
          type: number
          title: Require Approval For Cost Above
          default: 500
        approval_timeout_hours:
          type: integer
          title: Approval Timeout Hours
          default: 24
        allowed_services_for_auto_apply:
          items:
            type: string
          type: array
          title: Allowed Services For Auto Apply
          default:
            - cloudrun
            - gcs
        blocked_services:
          items:
            type: string
          type: array
          title: Blocked Services
          default: []
        notify_on_auto_apply:
          type: boolean
          title: Notify On Auto Apply
          default: true
        notify_channels:
          items:
            type: string
          type: array
          title: Notify Channels
          default:
            - email
      type: object
      title: RiskConfigRequest
      description: Risk and approval configuration for onboarding
    RiskGlobalSettingsRequest:
      properties:
        automation_enabled:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Automation Enabled
          description: Master switch for automation execution
        auto_execution_enabled:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Auto Execution Enabled
          description: Back-compat alias; many agents read this flag for auto-execution
        require_approval_for_high_risk:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Require Approval For High Risk
          description: If true, high/critical actions require explicit approval
        auto_approve_rollbacks:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Auto Approve Rollbacks
          description: If true, safe rollbacks may bypass approval
        business_hours_only:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Business Hours Only
          description: If true, automation only during business hours
        max_cost_impact_auto:
          anyOf:
            - type: number
            - type: 'null'
          title: Max Cost Impact Auto
          description: Maximum % cost impact allowed for auto-execution
        max_cost_impact_approval:
          anyOf:
            - type: number
            - type: 'null'
          title: Max Cost Impact Approval
          description: Maximum % cost impact allowed with approval
        risk_profile:
          anyOf:
            - type: string
            - type: 'null'
          title: Risk Profile
          description: Risk profile key (conservative|balanced|aggressive|custom)
      type: object
      title: RiskGlobalSettingsRequest
    RiskInfo:
      properties:
        level:
          type: string
          enum:
            - low
            - medium
            - high
          title: Level
        rationale:
          anyOf:
            - type: string
            - type: 'null'
          title: Rationale
      type: object
      required:
        - level
      title: RiskInfo
    RiskSimulationRequest:
      properties:
        service:
          type: string
          title: Service
          description: Service identifier, e.g. cloudrun, bigquery, gke, cloudsql, gcs
        change_description:
          type: string
          title: Change Description
          description: Human-readable description of the proposed change
        estimated_monthly_cost_change:
          anyOf:
            - type: number
            - type: 'null'
          title: Estimated Monthly Cost Change
          description: Estimated monthly cost delta in percent (positive for increase)
        risk_level_hint:
          anyOf:
            - type: string
            - type: 'null'
          title: Risk Level Hint
          description: Optional risk level hint if already assessed
      type: object
      required:
        - service
        - change_description
      title: RiskSimulationRequest
    RoleWithPermissions:
      properties:
        id:
          type: string
          title: Id
        name:
          type: string
          title: Name
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        permissions:
          items:
            type: string
          type: array
          title: Permissions
        is_system:
          type: boolean
          title: Is System
          default: true
      type: object
      required:
        - id
        - name
        - permissions
      title: RoleWithPermissions
      description: Role with its associated permissions.
    RollbackPlan:
      properties:
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        steps:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Steps
        manual:
          type: boolean
          title: Manual
          default: false
      type: object
      title: RollbackPlan
    ScheduleStepPayload:
      properties:
        scheduler_config:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Scheduler Config
        extra:
          additionalProperties: true
          type: object
          title: Extra
      type: object
      title: ScheduleStepPayload
    SchedulerSettingsRequest:
      properties:
        enabled:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Enabled
          description: Enable periodic scans
        services:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Services
          description: Subset of services, e.g., ['cloudrun','gcs','bigquery']
        interval_minutes:
          anyOf:
            - type: integer
            - type: 'null'
          title: Interval Minutes
          description: Advise interval minutes (tenant override)
      type: object
      title: SchedulerSettingsRequest
      description: >-
        Tenant-level scheduler configuration stored under risk_config.scheduler.


        - enabled: toggles periodic advise scheduling for this tenant

        - services: optional subset of services to schedule; defaults to backend
        defaults
    ScopeCreate:
      properties:
        service:
          anyOf:
            - type: string
            - type: 'null'
          title: Service
        params:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Params
        targets:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          title: Targets
        human_label:
          type: string
          title: Human Label
        is_default:
          type: boolean
          title: Is Default
          default: false
        risk_profile:
          anyOf:
            - type: string
            - type: 'null'
          title: Risk Profile
        policy:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Policy
        scheduler_config:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Scheduler Config
        owner_team_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Owner Team Id
      type: object
      required:
        - human_label
      title: ScopeCreate
    ScopeDiagnoseRequest:
      properties:
        service:
          type: string
          title: Service
        project_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Project Id
        region:
          anyOf:
            - type: string
            - type: 'null'
          title: Region
        dataset_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Dataset Id
        resource_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Resource Id
        resource_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Resource Name
        resource_key:
          anyOf:
            - type: string
            - type: 'null'
          title: Resource Key
        actions:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Actions
      type: object
      required:
        - service
      title: ScopeDiagnoseRequest
    ScopeDiagnoseResponse:
      properties:
        service:
          type: string
          title: Service
        project_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Project Id
        region:
          anyOf:
            - type: string
            - type: 'null'
          title: Region
        dataset_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Dataset Id
        resource_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Resource Id
        resource_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Resource Name
        effective_policy:
          additionalProperties: true
          type: object
          title: Effective Policy
        matched_scopes:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Matched Scopes
        actions:
          items:
            $ref: '#/components/schemas/ActionDecision'
          type: array
          title: Actions
      type: object
      required:
        - service
        - effective_policy
        - matched_scopes
        - actions
      title: ScopeDiagnoseResponse
    ScopePolicyPatch:
      properties:
        op:
          type: string
          const: add_allowed_op
          title: Op
          description: Patch operation type (currently only add_allowed_op)
        value:
          type: string
          title: Value
          description: Operation identifier to add to policy.allowed_ops
      type: object
      required:
        - op
        - value
      title: ScopePolicyPatch
      description: |-
        Partial updates to a Scope.policy block.

        Used by quick-fix guardrail flows to adjust allowed_ops without
        requiring the caller to send the full Scope payload.
    ScopeResponse:
      properties:
        scope_id:
          type: string
          title: Scope Id
        service:
          anyOf:
            - type: string
            - type: 'null'
          title: Service
        human_label:
          type: string
          title: Human Label
        params:
          additionalProperties: true
          type: object
          title: Params
          default: {}
        targets:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Targets
          default: []
        is_default:
          type: boolean
          title: Is Default
        risk_profile:
          anyOf:
            - type: string
            - type: 'null'
          title: Risk Profile
        policy:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Policy
        scheduler_config:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Scheduler Config
        owner_team_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Owner Team Id
        created_at:
          anyOf:
            - type: string
            - type: 'null'
          title: Created At
        updated_at:
          anyOf:
            - type: string
            - type: 'null'
          title: Updated At
      type: object
      required:
        - scope_id
        - human_label
        - is_default
      title: ScopeResponse
    ScopeSagaCommitResponse:
      properties:
        saga:
          $ref: '#/components/schemas/ScopeSagaResponse'
        scope_id:
          type: string
          title: Scope Id
      type: object
      required:
        - saga
        - scope_id
      title: ScopeSagaCommitResponse
    ScopeSagaCreateRequest:
      properties:
        initial_context:
          additionalProperties: true
          type: object
          title: Initial Context
        scope_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Scope Id
      type: object
      title: ScopeSagaCreateRequest
    ScopeSagaResponse:
      properties:
        id:
          type: string
          title: Id
        tenant_id:
          type: string
          title: Tenant Id
        scope_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Scope Id
        status:
          type: string
          title: Status
        current_step:
          type: string
          title: Current Step
        data:
          additionalProperties: true
          type: object
          title: Data
        validation_results:
          additionalProperties: true
          type: object
          title: Validation Results
        created_at:
          anyOf:
            - type: string
            - type: 'null'
          title: Created At
        updated_at:
          anyOf:
            - type: string
            - type: 'null'
          title: Updated At
      type: object
      required:
        - id
        - tenant_id
        - status
        - current_step
      title: ScopeSagaResponse
    ScopeSelector:
      properties:
        project_ids:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Project Ids
        labels:
          anyOf:
            - additionalProperties:
                type: string
              type: object
            - type: 'null'
          title: Labels
      additionalProperties: true
      type: object
      title: ScopeSelector
    ScopeUpdate:
      properties:
        human_label:
          anyOf:
            - type: string
            - type: 'null'
          title: Human Label
        params:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Params
        targets:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          title: Targets
        is_default:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Is Default
        risk_profile:
          anyOf:
            - type: string
            - type: 'null'
          title: Risk Profile
        policy:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Policy
        scheduler_config:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Scheduler Config
        owner_team_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Owner Team Id
      type: object
      title: ScopeUpdate
    SelectProjectRequest:
      properties:
        project_id:
          type: string
          title: Project Id
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
      type: object
      required:
        - project_id
      title: SelectProjectRequest
    SelectTenantRequest:
      properties:
        tenant_id:
          type: string
          title: Tenant Id
      type: object
      required:
        - tenant_id
      title: SelectTenantRequest
    ServiceDetectionRequest:
      properties:
        project_id:
          type: string
          title: Project Id
        services:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Services
      type: object
      required:
        - project_id
      title: ServiceDetectionRequest
    SetPasswordRequest:
      properties:
        token:
          type: string
          title: Token
        new_password:
          type: string
          title: New Password
      type: object
      required:
        - token
        - new_password
      title: SetPasswordRequest
    SeverityFeedbackRequest:
      properties:
        suggested_severity:
          type: string
          enum:
            - critical
            - high
            - medium
            - low
          title: Suggested Severity
        reason:
          type: string
          enum:
            - too_high
            - too_low
            - wrong_category
            - context_missing
            - other
          title: Reason
          description: Why the current severity is incorrect
        comment:
          anyOf:
            - type: string
              maxLength: 500
            - type: 'null'
          title: Comment
          description: Optional explanation
      type: object
      required:
        - suggested_severity
        - reason
      title: SeverityFeedbackRequest
      description: Request to submit severity feedback.
    SeverityFeedbackResponse:
      properties:
        id:
          type: string
          title: Id
        finding_id:
          type: string
          title: Finding Id
        suggested_severity:
          type: string
          title: Suggested Severity
        created_by:
          type: string
          title: Created By
        message:
          type: string
          title: Message
          default: >-
            Feedback submitted successfully. Thank you for helping improve
            severity classification!
      type: object
      required:
        - id
        - finding_id
        - suggested_severity
        - created_by
      title: SeverityFeedbackResponse
      description: Response after submitting feedback.
    SignupRequest:
      properties:
        organization_name:
          type: string
          title: Organization Name
        admin_email:
          type: string
          title: Admin Email
        admin_name:
          type: string
          title: Admin Name
        subscription_tier:
          type: string
          title: Subscription Tier
          default: starter
        company_size:
          anyOf:
            - type: string
            - type: 'null'
          title: Company Size
        use_case:
          anyOf:
            - type: string
            - type: 'null'
          title: Use Case
        referral_source:
          anyOf:
            - type: string
            - type: 'null'
          title: Referral Source
        password:
          anyOf:
            - type: string
            - type: 'null'
          title: Password
      type: object
      required:
        - organization_name
        - admin_email
        - admin_name
      title: SignupRequest
      description: Customer signup request model
    SignupResponse:
      properties:
        status:
          type: string
          const: success
          title: Status
          default: success
        tenant_id:
          type: string
          title: Tenant Id
        organization_name:
          type: string
          title: Organization Name
        estimated_setup_time:
          anyOf:
            - type: string
            - type: 'null'
          title: Estimated Setup Time
        next_url:
          anyOf:
            - type: string
            - type: 'null'
          title: Next Url
        next_steps:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Next Steps
      type: object
      required:
        - tenant_id
        - organization_name
      title: SignupResponse
      description: Minimal signup success payload returned to the SPA/tests.
    SignupStatusResponse:
      properties:
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
        organization_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Organization Name
        project_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Project Id
        completion_percentage:
          anyOf:
            - type: number
            - type: 'null'
          title: Completion Percentage
        current_step:
          anyOf:
            - type: integer
            - type: 'null'
          title: Current Step
        total_steps:
          anyOf:
            - type: integer
            - type: 'null'
          title: Total Steps
      type: object
      title: SignupStatusResponse
      description: >-
        Lightweight projection used by dev/test tooling to look up tenant info
        by project.
    StepUpdate:
      properties:
        status:
          type: string
          title: Status
          default: completed
        data:
          additionalProperties: true
          type: object
          title: Data
          default: {}
      type: object
      title: StepUpdate
    SupportRequest:
      properties:
        issue_description:
          type: string
          title: Issue Description
        error_message:
          anyOf:
            - type: string
            - type: 'null'
          title: Error Message
        context:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Context
        category:
          anyOf:
            - type: string
            - type: 'null'
          title: Category
      type: object
      required:
        - issue_description
      title: SupportRequest
    TargetStepPayload:
      properties:
        project_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Project Id
        service:
          anyOf:
            - type: string
            - type: 'null'
          title: Service
        region:
          anyOf:
            - type: string
            - type: 'null'
          title: Region
        dataset_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Dataset Id
        human_label:
          anyOf:
            - type: string
            - type: 'null'
          title: Human Label
        extra:
          additionalProperties: true
          type: object
          title: Extra
        targets:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          title: Targets
      type: object
      title: TargetStepPayload
    TeamCreate:
      properties:
        name:
          type: string
          title: Name
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
      type: object
      required:
        - name
      title: TeamCreate
    TeamInviteRequest:
      properties:
        email:
          type: string
          title: Email
        name:
          anyOf:
            - type: string
            - type: 'null'
          title: Name
        role:
          type: string
          enum:
            - user
            - viewer
            - admin
            - platform_admin
          title: Role
          default: user
      type: object
      required:
        - email
      title: TeamInviteRequest
    TeamMemberAdd:
      properties:
        user_id:
          type: string
          format: uuid
          title: User Id
        role:
          type: string
          title: Role
          default: member
      type: object
      required:
        - user_id
      title: TeamMemberAdd
    TeamMemberResponse:
      properties:
        user_id:
          type: string
          title: User Id
        email:
          type: string
          title: Email
        role:
          type: string
          title: Role
        joined_at:
          anyOf:
            - type: string
            - type: 'null'
          title: Joined At
      type: object
      required:
        - user_id
        - email
        - role
      title: TeamMemberResponse
    TeamResponse:
      properties:
        id:
          type: string
          title: Id
        name:
          type: string
          title: Name
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        member_count:
          type: integer
          title: Member Count
        created_at:
          anyOf:
            - type: string
            - type: 'null'
          title: Created At
      type: object
      required:
        - id
        - name
        - member_count
      title: TeamResponse
    TeamScopeInfo:
      properties:
        id:
          type: string
          title: Id
        team_id:
          type: string
          title: Team Id
        team_name:
          type: string
          title: Team Name
        scope_id:
          type: string
          title: Scope Id
        scope_name:
          type: string
          title: Scope Name
        created_at:
          anyOf:
            - type: string
            - type: 'null'
          title: Created At
        created_by:
          anyOf:
            - type: string
            - type: 'null'
          title: Created By
      type: object
      required:
        - id
        - team_id
        - team_name
        - scope_id
        - scope_name
      title: TeamScopeInfo
      description: Team scope assignment information.
    TeamUpdate:
      properties:
        name:
          anyOf:
            - type: string
            - type: 'null'
          title: Name
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
      type: object
      title: TeamUpdate
    TotpDisableRequest:
      properties:
        code:
          type: string
          maxLength: 6
          minLength: 6
          title: Code
          description: Current TOTP code to confirm
      type: object
      required:
        - code
      title: TotpDisableRequest
      description: Request to disable TOTP.
    TotpSetupResponse:
      properties:
        qr_uri:
          type: string
          title: Qr Uri
          description: otpauth:// URI for QR code generation
        secret:
          type: string
          title: Secret
          description: Base32 secret for manual entry
        issuer:
          type: string
          title: Issuer
          description: Service name shown in authenticator
          default: SmartSRE
      type: object
      required:
        - qr_uri
        - secret
      title: TotpSetupResponse
      description: Response from TOTP setup endpoint.
    TotpVerifyRequest:
      properties:
        code:
          type: string
          maxLength: 6
          minLength: 6
          title: Code
          description: 6-digit TOTP code
      type: object
      required:
        - code
      title: TotpVerifyRequest
      description: Request to verify TOTP code during setup.
    TotpVerifyResponse:
      properties:
        status:
          type: string
          title: Status
          default: success
        recovery_codes:
          items:
            type: string
          type: array
          title: Recovery Codes
          description: One-time recovery codes
        message:
          type: string
          title: Message
          default: TOTP authentication enabled successfully
      type: object
      required:
        - recovery_codes
      title: TotpVerifyResponse
      description: Response from TOTP verification.
    UnreadCountResponse:
      properties:
        count:
          type: integer
          title: Count
      type: object
      required:
        - count
      title: UnreadCountResponse
    UpdateMetadataRequest:
      properties:
        service:
          type: string
          title: Service
        kind:
          type: string
          title: Kind
        new_severity:
          type: string
          enum:
            - critical
            - high
            - medium
            - low
          title: New Severity
        reason:
          type: string
          maxLength: 500
          title: Reason
          description: Why this change is being made
      type: object
      required:
        - service
        - kind
        - new_severity
        - reason
      title: UpdateMetadataRequest
      description: Request to update severity metadata based on feedback.
    UpdateTemplateRequest:
      properties:
        name:
          anyOf:
            - type: string
            - type: 'null'
          title: Name
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        definition:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Definition
      type: object
      required:
        - name
        - description
        - definition
      title: UpdateTemplateRequest
    UpdateUserRoleRequest:
      properties:
        role:
          type: string
          title: Role
          description: New role name or ID
      type: object
      required:
        - role
      title: UpdateUserRoleRequest
      description: Request to update a user's role.
    UserWithRole:
      properties:
        id:
          type: string
          title: Id
        email:
          type: string
          title: Email
        name:
          anyOf:
            - type: string
            - type: 'null'
          title: Name
        role:
          type: string
          title: Role
        role_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Role Id
        created_at:
          anyOf:
            - type: string
            - type: 'null'
          title: Created At
      type: object
      required:
        - id
        - email
        - role
      title: UserWithRole
      description: User with role information.
    ValidatedLoginRequest:
      properties:
        email:
          type: string
          title: Email
        password:
          type: string
          title: Password
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
      type: object
      required:
        - email
        - password
      title: ValidatedLoginRequest
    ValidatedOAuthLoginRequest:
      properties:
        id_token:
          type: string
          title: Id Token
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
      type: object
      required:
        - id_token
      title: ValidatedOAuthLoginRequest
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    WebAuthnChallengeRequest:
      properties:
        email:
          type: string
          title: Email
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
      type: object
      required:
        - email
      title: WebAuthnChallengeRequest
    WebAuthnVerifyAssertionRequest:
      properties:
        email:
          type: string
          title: Email
        assertion:
          additionalProperties: true
          type: object
          title: Assertion
        tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Tenant Id
      type: object
      required:
        - email
        - assertion
      title: WebAuthnVerifyAssertionRequest
    WebAuthnVerifyAttestationRequest:
      properties:
        email:
          type: string
          title: Email
        attestation:
          additionalProperties: true
          type: object
          title: Attestation
      type: object
      required:
        - email
        - attestation
      title: WebAuthnVerifyAttestationRequest
    WebhookTokenResponse:
      properties:
        webhook_token:
          anyOf:
            - type: string
            - type: 'null'
          title: Webhook Token
      type: object
      title: WebhookTokenResponse
    WorkflowDefinition:
      properties:
        name:
          type: string
          title: Name
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
          default: ''
        nodes:
          items:
            $ref: '#/components/schemas/WorkflowNodeDefinition'
          type: array
          title: Nodes
        edges:
          items:
            $ref: '#/components/schemas/WorkflowEdgeDefinition'
          type: array
          title: Edges
        enabled:
          type: boolean
          title: Enabled
          default: true
        tags:
          items:
            type: string
          type: array
          title: Tags
          default: []
        scope_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Scope Id
        state_schema:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: State Schema
      type: object
      required:
        - name
        - nodes
        - edges
      title: WorkflowDefinition
      description: Workflow definition model
    WorkflowEdgeDefinition:
      properties:
        source:
          type: string
          title: Source
        target:
          type: string
          title: Target
        condition:
          anyOf:
            - type: string
            - type: 'null'
          title: Condition
      type: object
      required:
        - source
        - target
      title: WorkflowEdgeDefinition
      description: Definition of a workflow edge (as stored in Workflow.definition.edges).
    WorkflowExecutionRequest:
      properties:
        workflow_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Workflow Id
        nodes:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          title: Nodes
        edges:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          title: Edges
        input:
          additionalProperties: true
          type: object
          title: Input
          default: {}
        trigger_data:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Trigger Data
      type: object
      title: WorkflowExecutionRequest
      description: Workflow execution request model
    WorkflowNodeDefinition:
      properties:
        id:
          type: string
          title: Id
        type:
          $ref: '#/components/schemas/WorkflowNodeType'
        config:
          additionalProperties: true
          type: object
          title: Config
        data:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Data
      type: object
      required:
        - id
        - type
      title: WorkflowNodeDefinition
      description: Definition of a workflow node (as stored in Workflow.definition.nodes).
    WorkflowNodeType:
      type: string
      enum:
        - AgentNode
        - LogicNode
        - ExecuteNode
        - RollbackNode
        - RiskCheckNode
        - HumanNode
        - RouterNode
      title: WorkflowNodeType
    WorkflowTemplateDto:
      properties:
        id:
          type: string
          title: Id
        name:
          type: string
          title: Name
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        definition:
          additionalProperties: true
          type: object
          title: Definition
        is_system:
          type: boolean
          title: Is System
        version:
          type: integer
          title: Version
      type: object
      required:
        - id
        - name
        - description
        - definition
        - is_system
        - version
      title: WorkflowTemplateDto
    src__api__routes__onboarding__CloudRunGuardrails:
      properties:
        allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Allowed Ops
        max_cost_impact_auto_percent:
          anyOf:
            - type: number
            - type: 'null'
          title: Max Cost Impact Auto Percent
          description: >-
            Optional per-service auto-execution cost impact limit (percent of
            baseline)
      type: object
      title: CloudRunGuardrails
      description: Nested Cloud Run guardrail configuration.
    src__api__routes__onboarding__GKEGuardrails:
      properties:
        min_nodes:
          anyOf:
            - type: integer
            - type: 'null'
          title: Min Nodes
        max_nodes:
          anyOf:
            - type: integer
            - type: 'null'
          title: Max Nodes
        max_hpa_max:
          anyOf:
            - type: integer
            - type: 'null'
          title: Max Hpa Max
        allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Allowed Ops
      type: object
      title: GKEGuardrails
      description: Nested GKE guardrail configuration.
    src__api__routes__onboarding__RiskGuardrailsRequest:
      properties:
        cloudsql_require_approval:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Cloudsql Require Approval
        cloudsql_allowed_hours:
          anyOf:
            - items:
                type: integer
              type: array
            - type: 'null'
          title: Cloudsql Allowed Hours
          description: '[start,end] in 0..24 UTC'
        gke_max_nodes:
          anyOf:
            - type: integer
            - type: 'null'
          title: Gke Max Nodes
        gke_min_nodes:
          anyOf:
            - type: integer
            - type: 'null'
          title: Gke Min Nodes
        gke_max_hpa_max:
          anyOf:
            - type: integer
            - type: 'null'
          title: Gke Max Hpa Max
        bigquery_max_slots:
          anyOf:
            - type: integer
            - type: 'null'
          title: Bigquery Max Slots
        bigquery_min_slots:
          anyOf:
            - type: integer
            - type: 'null'
          title: Bigquery Min Slots
        bigquery_require_approval:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Bigquery Require Approval
        cloudrun_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Cloudrun Allowed Ops
        bigquery_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Bigquery Allowed Ops
        gke_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Gke Allowed Ops
        cloudsql_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Cloudsql Allowed Ops
        gcs_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Gcs Allowed Ops
        secretmgr_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Secretmgr Allowed Ops
        cloud_sql:
          anyOf:
            - $ref: >-
                #/components/schemas/src__api__routes__tenants__CloudSQLGuardrails
            - type: 'null'
        bigquery:
          anyOf:
            - $ref: >-
                #/components/schemas/src__api__routes__tenants__BigQueryGuardrails
            - type: 'null'
        gke:
          anyOf:
            - $ref: '#/components/schemas/src__api__routes__onboarding__GKEGuardrails'
            - type: 'null'
        cloudrun:
          anyOf:
            - $ref: >-
                #/components/schemas/src__api__routes__onboarding__CloudRunGuardrails
            - type: 'null'
        gcs:
          anyOf:
            - $ref: >-
                #/components/schemas/src__api__routes__onboarding__SimpleOpsGuardrails
            - type: 'null'
        secretmgr:
          anyOf:
            - $ref: >-
                #/components/schemas/src__api__routes__onboarding__SimpleOpsGuardrails
            - type: 'null'
      type: object
      title: RiskGuardrailsRequest
    src__api__routes__onboarding__SimpleOpsGuardrails:
      properties:
        allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Allowed Ops
      type: object
      title: SimpleOpsGuardrails
      description: >-
        Nested guardrail configuration for services that only expose
        allowed_ops.
    src__api__routes__tenants__BigQueryGuardrails:
      properties:
        min_slots:
          anyOf:
            - type: integer
            - type: 'null'
          title: Min Slots
        max_slots:
          anyOf:
            - type: integer
            - type: 'null'
          title: Max Slots
        require_approval:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Require Approval
        allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Allowed Ops
        max_cost_impact_auto_percent:
          anyOf:
            - type: number
            - type: 'null'
          title: Max Cost Impact Auto Percent
          description: >-
            Optional per-service auto-execution cost impact limit (percent of
            baseline)
      type: object
      title: BigQueryGuardrails
      description: Nested BigQuery guardrail configuration.
    src__api__routes__tenants__CloudSQLGuardrails:
      properties:
        require_approval:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Require Approval
        allowed_hours:
          anyOf:
            - items:
                type: integer
              type: array
            - type: 'null'
          title: Allowed Hours
          description: '[start,end] in 0..24 UTC'
        allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Allowed Ops
      type: object
      title: CloudSQLGuardrails
      description: Nested Cloud SQL guardrail configuration.
    src__api__routes__tenants__RiskGuardrailsRequest:
      properties:
        cloudsql_require_approval:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Cloudsql Require Approval
        cloudsql_allowed_hours:
          anyOf:
            - items:
                type: integer
              type: array
            - type: 'null'
          title: Cloudsql Allowed Hours
          description: '[start,end] in 0..24 UTC'
        gke_max_nodes:
          anyOf:
            - type: integer
            - type: 'null'
          title: Gke Max Nodes
        gke_min_nodes:
          anyOf:
            - type: integer
            - type: 'null'
          title: Gke Min Nodes
        gke_max_hpa_max:
          anyOf:
            - type: integer
            - type: 'null'
          title: Gke Max Hpa Max
        bigquery_max_slots:
          anyOf:
            - type: integer
            - type: 'null'
          title: Bigquery Max Slots
        bigquery_min_slots:
          anyOf:
            - type: integer
            - type: 'null'
          title: Bigquery Min Slots
        bigquery_require_approval:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Bigquery Require Approval
        cloudrun_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Cloudrun Allowed Ops
        bigquery_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Bigquery Allowed Ops
        gke_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Gke Allowed Ops
        cloudsql_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Cloudsql Allowed Ops
        gcs_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Gcs Allowed Ops
        secretmgr_allowed_ops:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Secretmgr Allowed Ops
        cloud_sql:
          anyOf:
            - $ref: >-
                #/components/schemas/src__api__routes__tenants__CloudSQLGuardrails
            - type: 'null'
          description: Cloud SQL guardrails (nested shape)
        bigquery:
          anyOf:
            - $ref: >-
                #/components/schemas/src__api__routes__tenants__BigQueryGuardrails
            - type: 'null'
          description: BigQuery guardrails (nested shape)
        gke:
          anyOf:
            - $ref: '#/components/schemas/src__api__routes__onboarding__GKEGuardrails'
            - type: 'null'
          description: GKE guardrails (nested shape)
        cloudrun:
          anyOf:
            - $ref: >-
                #/components/schemas/src__api__routes__onboarding__CloudRunGuardrails
            - type: 'null'
          description: Cloud Run guardrails (nested shape)
        gcs:
          anyOf:
            - $ref: >-
                #/components/schemas/src__api__routes__onboarding__SimpleOpsGuardrails
            - type: 'null'
          description: Cloud Storage guardrails (nested shape)
        secretmgr:
          anyOf:
            - $ref: >-
                #/components/schemas/src__api__routes__onboarding__SimpleOpsGuardrails
            - type: 'null'
          description: Secret Manager guardrails (nested shape)
      type: object
      title: RiskGuardrailsRequest
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer
