{
  "components": {
    "schemas": {
      "ErrorResponse": {
        "properties": {
          "error": {
            "type": "string"
          }
        },
        "required": [
          "error"
        ],
        "type": "object"
      }
    },
    "securitySchemes": {
      "bearerAuth": {
        "description": "API token created under Settings, API tokens. Each token carries abilities: read, read:sensitive, write, write:sensitive, deploy and root.",
        "scheme": "bearer",
        "type": "http"
      },
      "sessionAuth": {
        "description": "Dashboard session cookie, set after signing in.",
        "in": "cookie",
        "name": "session_token",
        "type": "apiKey"
      }
    }
  },
  "info": {
    "contact": {
      "email": "support@levelrail.com",
      "name": "Levelrail",
      "url": "https://levelrail.com"
    },
    "description": "HTTP API of a self-hosted Levelrail control plane, generated from its route registrations. It lists every route with its method, path, path parameters and required token ability. Request and response bodies are not described yet, so they are left generic. Every instance also serves a route table at GET /api/v1/openapi.json.",
    "license": {
      "identifier": "Apache-2.0",
      "name": "Apache 2.0"
    },
    "title": "Levelrail control plane API",
    "version": "v1"
  },
  "openapi": "3.1.0",
  "paths": {
    "/.well-known/jwks.json": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleOIDCJWKS",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "OIDCJWKS",
        "tags": [
          "Other"
        ]
      }
    },
    "/api/v1/ai/sessions": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListAIChatSessions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List AI Chat Sessions",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "post": {
        "description": "AI assistant chat sessions (ai_chat.go): AbilityRoot throughout, not a lower tier, because a confirmed message can execute any mutating tool the platform exposes (deploy, rollback, restart, and so on) once a human approves it, the same blast radius as the scoped token itself would need to reach those actions directly.\n\nRequires the `root` ability.",
        "operationId": "handleCreateAIChatSession",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "AI assistant chat sessions (ai_chat.go): AbilityRoot throughout, not a lower tier, because a confirmed message can execute any mutating tool the platform exposes (deploy, rollback, restart, and so on) once a human approves it, the same blast radius as the scoped token itself would need to reach those actions directly.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/ai/sessions/{id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteAIChatSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete AI Chat Session",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGetAIChatSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Get AI Chat Session",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/ai/sessions/{id}/confirmations/{confirmation_id}": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleResolveAIChatConfirmation",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "confirmation_id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Resolve AI Chat Confirmation",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/ai/sessions/{id}/messages": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateAIChatMessage",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create AI Chat Message",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/alert-history": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAlertHistory",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Alert History",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/alert-maintenance-windows": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListMaintenanceWindows",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Maintenance Windows",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateMaintenanceWindow",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Maintenance Window",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/alert-maintenance-windows/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteMaintenanceWindow",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Maintenance Window",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleUpdateMaintenanceWindow",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Update Maintenance Window",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/alert-silences": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAlertSilences",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Alert Silences",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateAlertSilence",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Alert Silence",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/alert-silences/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleExpireAlertSilence",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Expire Alert Silence",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apply": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleIaCApply",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Ia C Apply",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apply/plan": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIaCPlan",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Ia C Plan",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apply/schema": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIaCSchema",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Ia C Schema",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps": {
      "get": {
        "description": "Apps CRUD. requireAbility accepts either a session (implicitly root, there is exactly one human identity in Phase 1) or a bearer token scoped to at least the named ability, so a read-only MCP-issued token is provably unable to reach a write/deploy route, not just conventionally discouraged from calling it.\n\nRequires the `read` ability.",
        "operationId": "handleListApps",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Apps CRUD.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateApp",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create App",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps-metrics": {
      "get": {
        "description": "Cross-app resource usage ranking (app_resource_usage.go): a literal segment, so Go's ServeMux resolves it ahead of the {name} wildcard on GET /api/v1/apps/{name} in routes.go.\n\nRequires the `read` ability.",
        "operationId": "handleBatchAppMetrics",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Cross-app resource usage ranking (app_resource_usage.go): a literal segment, so Go's ServeMux resolves it ahead of the {name} wildcard on GET /api/v1/apps/{name} in routes.go.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps-summary": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAppsSummary",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Apps Summary",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/bulk": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleBulkApps",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Bulk Apps",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/git-sources": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListGitSources",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Git Sources",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/resource-usage": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAppResourceUsage",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "App Resource Usage",
        "tags": [
          "Telemetry"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete App",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Resource-scoped (iam.go): a policy can Deny or narrowly Allow write/delete on one specific app by name, e.g. a token whose flat abilities grant write everywhere except an app: prod-web Deny policy attached to it. Every other per-app and per-database mutating route in this file and routes_platform.go is now on the same requireAbilityForResource gate; only POST /apps (creation, no existing resource to scope to) and GET .../terminal (websocket upgrade, not touched in this pass) remain on plain requireAbility.\n\nRequires the `read` ability.",
        "operationId": "handleGetApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Resource-scoped (iam.go): a policy can Deny or narrowly Allow write/delete on one specific app by name, e.g.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleUpdateApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Update App",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/alert-history": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAppAlertHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List App Alert History",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/alerts": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAlertRules",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Alert Rules",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Alerting: threshold and crashloop rules scoped to one app, fanned through a *alerting.DB when configured (see WithAlertRules).\n\nRequires the `write` ability.",
        "operationId": "handleCreateAlertRule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Alerting: threshold and crashloop rules scoped to one app, fanned through a *alerting.DB when configured (see WithAlertRules).",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/alerts/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteAlertRule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Alert Rule",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleUpdateAlertRule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Update Alert Rule",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/alerts/{id}/silence": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSilenceAlertRule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Silence Alert Rule",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/apply-pending": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleApplyPending",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Apply Pending",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/auto-rollback": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetAutoRollback",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Auto Rollback",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetAutoRollback",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Auto Rollback",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/auto-rollback-slo-burn": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetAutoRollbackSLOBurn",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Auto Rollback SLO Burn",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetAutoRollbackSLOBurn",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Auto Rollback SLO Burn",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/auto-update": {
      "get": {
        "description": "Restart (handleRestartApp's own doc comment): AbilityDeploy, the same boundary as the deploy trigger above, since forcing a container recreation is the same class of action as triggering a deploy, just without a new image.\n\nRequires the `read` ability.",
        "operationId": "handleGetImageAutoUpdate",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Restart (handleRestartApp's own doc comment): AbilityDeploy, the same boundary as the deploy trigger above, since forcing a container recreation is the same class of action as triggering a deploy, just without a new image.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetImageAutoUpdate",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Image Auto Update",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/auto-update/check": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleCheckImageAutoUpdate",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Check Image Auto Update",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/auto-update/webhook": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleRotateImageUpdateWebhook",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Rotate Image Update Webhook",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/badge": {
      "get": {
        "description": "Deploy status badge opt-in (app_badge.go): same GET-is-AbilityRead, PUT-is-AbilityRoot split as exec-access just above, since enabling it hands out an unauthenticated public view of this app's deploy status. GET .../badge.svg itself is registered unauthenticated on purpose (see publicRoutes in authz_matrix_test.go); it 404s on its own when the per-app flag is off, so it never needs this file's own IAM wrapper.\n\nRequires the `read` ability.",
        "operationId": "handleGetBadgeSettings",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Deploy status badge opt-in (app_badge.go): same GET-is-AbilityRead, PUT-is-AbilityRoot split as exec-access just above, since enabling it hands out an unauthenticated public view of this app's deploy status.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetBadgeSettings",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Badge Settings",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/badge.svg": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handlePublicAppBadge",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Public App Badge",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ]
      }
    },
    "/api/v1/apps/{name}/branch-env": {
      "get": {
        "description": "Branch-scoped env var overrides (apps_branch_env.go): a narrower, pattern-matched sibling of PUT/DELETE .../preview-env just above, only applied when a preview's own branch matches. POST can carry a secret-marked value, so it's gated at AbilityWriteSensitive, the same tier PUT .../secrets/{key} uses; GET and DELETE never expose or require a value, so they stay at AbilityRead/AbilityWrite.\n\nRequires the `read` ability.",
        "operationId": "handleListAppBranchEnv",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Branch-scoped env var overrides (apps_branch_env.go): a narrower, pattern-matched sibling of PUT/DELETE .../preview-env just above, only applied when a preview's own branch matches.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetAppBranchEnv",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set App Branch Env",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/branch-env/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteAppBranchEnv",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete App Branch Env",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/builds": {
      "post": {
        "description": "Manual build trigger (see Builder/WithBuilder above and handleTriggerBuild's own doc comment): builds an image from a git source through the same internal/deploy.Pipeline the webhook receiver uses, for an operator with no working git webhook configured. AbilityDeploy, the same boundary as the image-tag trigger above: this also ultimately writes desired state.\n\nRequires the `deploy` ability.",
        "operationId": "handleTriggerBuild",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Manual build trigger (see Builder/WithBuilder above and handleTriggerBuild's own doc comment): builds an image from a git source through the same internal/deploy.Pipeline the webhook receiver uses, for an operator with no working git webhook configured.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/canary": {
      "delete": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleAbortCanary",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Abort Canary",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetCanary",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Canary",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleStartCanary",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Start Canary",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetCanaryWeight",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Canary Weight",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/canary/promote": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handlePromoteCanary",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Promote Canary",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/cancel-superseded": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetCancelSuperseded",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Cancel Superseded",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetCancelSuperseded",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Cancel Superseded",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/changes": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAppChanges",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "App Changes",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/clone": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCloneApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Clone App",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/clone/preview": {
      "get": {
        "description": "Clone: duplicates an app's desired state under a new name. AbilityWrite, the same gate POST /api/v1/apps itself uses, since a clone is a creation shaped as \"copy {name}\" rather than \"start from scratch\": handleCloneApp's own doc comment covers what does and doesn't carry over.\n\nRequires the `read` ability.",
        "operationId": "handleClonePreview",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Clone: duplicates an app's desired state under a new name.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/compose": {
      "delete": {
        "description": "Same tier as DELETE /apps/{name}; ?volumes=true also needs write-sensitive, checked in the handler.\n\nRequires the `write` ability.",
        "operationId": "handleComposeDown",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Same tier as DELETE /apps/{name}; ?volumes=true also needs write-sensitive, checked in the handler.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetComposeStack",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Compose Stack",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Compose ingestion (apps_compose.go): fans a compose.yaml's services: out into one store.App plus its member services. AbilityDeploy, the same tier POST .../deploys uses: this creates and deploys, it's not ordinary config.\n\nRequires the `deploy` ability.",
        "operationId": "handleDeployCompose",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Compose ingestion (apps_compose.go): fans a compose.yaml's services: out into one store.App plus its member services.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/compose/redeploy": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleRedeployCompose",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Redeploy Compose",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/compose/revisions": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListComposeRevisions",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Compose Revisions",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/compose/revisions/{revision}": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetComposeRevision",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "revision",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Compose Revision",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/compose/rollback": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleRollbackCompose",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Rollback Compose",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/connectable-databases": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListConnectableDatabases",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Connectable Databases",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/connections": {
      "get": {
        "description": "Multi-connection app-to-database (apps_connections.go): the DatabaseEnv-map-backed sibling of PUT/DELETE .../database just above, for an app that connects to more than one managed database. Same AbilityWrite tier and \"config write, not a deploy trigger\" reasoning; GET is AbilityRead like any other app-detail read.\n\nRequires the `read` ability.",
        "operationId": "handleListAppConnections",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Multi-connection app-to-database (apps_connections.go): the DatabaseEnv-map-backed sibling of PUT/DELETE .../database just above, for an app that connects to more than one managed database.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateAppConnection",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create App Connection",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/connections/{env_var}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteAppConnection",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "env_var",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete App Connection",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/cost-estimate": {
      "get": {
        "description": "Read-only \"what this would cost elsewhere\" estimate (cost_estimate.go): compares the app's declared or observed CPU/memory against illustrative reference pricing. AbilityRead, same sensitivity as resource-recommendation above; never writes anything.\n\nRequires the `read` ability.",
        "operationId": "handleAppCostEstimate",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Read-only \"what this would cost elsewhere\" estimate (cost_estimate.go): compares the app's declared or observed CPU/memory against illustrative reference pricing.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/database": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleClearAppDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Clear App Database",
        "tags": [
          "App Storage / Database Attach"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Real app-to-database attachment (apps_database.go): AbilityWrite, not AbilityDeploy, since this is a config write, not itself a deploy trigger (the next reconcile picks up the change on its own schedule, the same \"desired state changes, containers converge later\" shape PUT .../storage/.../node/.../project already have).\n\nRequires the `write` ability.",
        "operationId": "handleSetAppDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Real app-to-database attachment (apps_database.go): AbilityWrite, not AbilityDeploy, since this is a config write, not itself a deploy trigger (the next reconcile picks up the change on its own schedule, the same \"desired state changes, containers converge later\" shape PUT .../storage/.../node/.../project already have).",
        "tags": [
          "App Storage / Database Attach"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/deploy-attempts": {
      "get": {
        "description": "Real deploy-attempt history (deploy_attempts.go): a row per trigger call across all three real trigger paths, additional to (not a replacement for) the reconcile-conditions route above. See DeployAttemptStore's own doc comment for why this is a separate endpoint rather than a change to GET .../deploys's existing response shape. AbilityRead, matching every other passive view of an app's own state.\n\nRequires the `read` ability.",
        "operationId": "handleListDeployAttempts",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Real deploy-attempt history (deploy_attempts.go): a row per trigger call across all three real trigger paths, additional to (not a replacement for) the reconcile-conditions route above.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/deploy-freeze": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetAppDeployFreeze",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get App Deploy Freeze",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handlePutAppDeployFreeze",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Put App Deploy Freeze",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/deploy-notify-targets": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListDeployNotifyTargets",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Deploy Notify Targets",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Deploy-outcome notifications (wave-2 roadmap item #5): a Slack/ Discord/Telegram/generic-webhook/email ping fired once per deploy attempt reaching a terminal state, distinct from the threshold/ crashloop alert rules just above (see internal/alerting/deploy_notify.go's own doc comment). Also fanned through *alerting.DB when configured (see WithDeployNotifyTargets).\n\nRequires the `write` ability.",
        "operationId": "handleCreateDeployNotifyTarget",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Deploy-outcome notifications (wave-2 roadmap item #5): a Slack/ Discord/Telegram/generic-webhook/email ping fired once per deploy attempt reaching a terminal state, distinct from the threshold/ crashloop alert rules just above (see internal/alerting/deploy_notify.go's own doc comment).",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/deploy-notify-targets/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteDeployNotifyTarget",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Deploy Notify Target",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/deploy-safety": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDeploySafety",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Deploy Safety",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Deploy tier, like auto-rollback: these thresholds decide when a release takes traffic and when it is rolled back.\n\nRequires the `deploy` ability.",
        "operationId": "handlePutDeploySafety",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Deploy tier, like auto-rollback: these thresholds decide when a release takes traffic and when it is rolled back.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/deploy-spec": {
      "post": {
        "description": "Multi-service fan-out (handleDeploySpec's own doc comment, apps_multi.go): one app.yaml's services: map, built and deployed as N independent services under one store.App named {name}. Same AbilityDeploy boundary as the manual build trigger above: this also ultimately writes desired state.\n\nRequires the `deploy` ability.",
        "operationId": "handleDeploySpec",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Multi-service fan-out (handleDeploySpec's own doc comment, apps_multi.go): one app.yaml's services: map, built and deployed as N independent services under one store.App named {name}.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/deployments/{id}/preview": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPreviewImage",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Preview Image",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/deployments/{id}/sbom": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetSBOM",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get SBOM",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/deployments/{id}/scan": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleScanDeployment",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Scan Deployment",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/deployments/{id}/vulnerabilities": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetVulnerabilities",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Vulnerabilities",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/deploys": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDeployHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Deploy History",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Deploys.\n\nRequires the `deploy` ability.",
        "operationId": "handleTriggerDeploy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Deploys.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/deploys/compare": {
      "get": {
        "description": "Deploy comparison (deploy_compare.go): a before/after diff between two attempts, or one attempt against the app's current live state when ?to is omitted. AbilityRead, same sensitivity as the deploy-attempts list above.\n\nRequires the `read` ability.",
        "operationId": "handleCompareDeploys",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Deploy comparison (deploy_compare.go): a before/after diff between two attempts, or one attempt against the app's current live state when ?to is omitted.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/deploys/{deployId}": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDeploy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "deployId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Deploy",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/deploys/{deployId}/cancel": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleCancelDeploy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "deployId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Cancel Deploy",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/deploys/{deployId}/gate": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDeployGate",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "deployId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Deploy Gate",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/deploys/{deployId}/logs": {
      "get": {
        "description": "Deploy-attempt build/log stream (deploy_attempts.go): SSE, serving either a live tail (attempt still running) or a full persisted replay (attempt already finished), the exact contract web/src/hooks/useDeployLogStream.ts was built against. AbilityRead: this is a read of one attempt's own output, the same sensitivity as the deploy-attempts list above.\n\nRequires the `read` ability.",
        "operationId": "handleDeployLogStream",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "deployId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Deploy-attempt build/log stream (deploy_attempts.go): SSE, serving either a live tail (attempt still running) or a full persisted replay (attempt already finished), the exact contract web/src/hooks/useDeployLogStream.ts was built against.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/deploys/{deployId}/logs/download": {
      "get": {
        "description": "Deploy-attempt log download (deploy_log_download.go): the same attempt's full log as a plain-text attachment instead of an SSE stream, mirroring /apps/{name}/logs/download for runtime logs.\n\nRequires the `read` ability.",
        "operationId": "handleDownloadDeployLog",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "deployId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Deploy-attempt log download (deploy_log_download.go): the same attempt's full log as a plain-text attachment instead of an SSE stream, mirroring /apps/{name}/logs/download for runtime logs.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/deploys/{deployId}/probes": {
      "get": {
        "description": "Deploy-attempt readiness-probe attempts (deploy_probes.go): plain polling JSON, not SSE, the individual probe attempts (internal/probe.WithOnAttempt) one deploy's cutover made. Same AbilityRead boundary as the step/log streams above.\n\nRequires the `read` ability.",
        "operationId": "handleListProbeAttempts",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "deployId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Deploy-attempt readiness-probe attempts (deploy_probes.go): plain polling JSON, not SSE, the individual probe attempts (internal/probe.WithOnAttempt) one deploy's cutover made.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/deploys/{deployId}/rollback": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleRollbackToDeploy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "deployId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Rollback To Deploy",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/deploys/{deployId}/steps": {
      "get": {
        "description": "Deploy-attempt step stream (deploy_steps.go): SSE, named pipeline-phase transitions (detecting/building/pushing/deploying) rather than raw log lines, for a checklist-style progress view. Same AbilityRead boundary as the log stream above.\n\nRequires the `read` ability.",
        "operationId": "handleDeployStepStream",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "deployId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Deploy-attempt step stream (deploy_steps.go): SSE, named pipeline-phase transitions (detecting/building/pushing/deploying) rather than raw log lines, for a checklist-style progress view.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/diagnose": {
      "get": {
        "description": "Read-only failure diagnosis (diagnose.go): synthesizes the app's newest (or ?deploy_id=-pinned) deploy attempt, current reconcile conditions, and crashloop state into a deterministic explanation. AbilityRead, same sensitivity as the routes above; never writes anything.\n\nRequires the `read` ability.",
        "operationId": "handleDiagnoseApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Read-only failure diagnosis (diagnose.go): synthesizes the app's newest (or ?deploy_id=-pinned) deploy attempt, current reconcile conditions, and crashloop state into a deterministic explanation.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/domains": {
      "patch": {
        "description": "Requires the `write` ability.",
        "operationId": "handleEditAppDomains",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Edit App Domains",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/domains/go-live/plan": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleGoLivePlan",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Go Live Plan",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/auth": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleClearDomainBasicAuth",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Clear Domain Basic Auth",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Domain basic auth (domain_basic_auth.go): HTTP Basic Auth protection on one app-owned domain, enforced by Caddy's authentication handler (internal/reconcile/ingress) on the next reconcile pass. GET is AbilityRead, the same passive-visibility tier GET /api/v1/settings/cloudflare-tunnel uses for its own has_token-shaped read. PUT/DELETE are AbilityRoot, matching PUT/ DELETE /api/v1/settings/cloudflare-tunnel: this changes how a live, currently-routed host is secured, the same \"real infrastructure, high blast radius\" class of change Cloudflare Tunnel/DNS and the ACME toggle already reserve AbilityRoot for.\n\nRequires the `read` ability.",
        "operationId": "handleGetDomainBasicAuth",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Domain basic auth (domain_basic_auth.go): HTTP Basic Auth protection on one app-owned domain, enforced by Caddy's authentication handler (internal/reconcile/ingress) on the next reconcile pass.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetDomainBasicAuth",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Domain Basic Auth",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/cache": {
      "delete": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleDeleteDomainPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Delete Domain Policy",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      },
      "get": {
        "description": "Ingress response cache rules, purge and per-domain stats.\n\nRequires the `read` ability.",
        "operationId": "handleGetDomainPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Ingress response cache rules, purge and per-domain stats.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetDomainPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Policy",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/cache/purge": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handlePurgeDomainCache",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Purge Domain Cache",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/cache/stats": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDomainCacheStats",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Domain Cache Stats",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/cert/renew": {
      "post": {
        "description": "Force re-issuance of domain's automatic certificate (domain_tls_cert.go's handleRenewDomainCertificate): deletes the stored certmagic entry and nudges the reconciler. AbilityRoot, same tier as PUT/DELETE .../tls-cert above: real infra, real blast radius.\n\nRequires the `root` ability.",
        "operationId": "handleRenewDomainCertificate",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Force re-issuance of domain's automatic certificate (domain_tls_cert.go's handleRenewDomainCertificate): deletes the stored certmagic entry and nudges the reconciler.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/check": {
      "get": {
        "description": "Domain DNS check (domain_check.go): the guidance layer on top of domain connection, so DomainEditor can show an operator the exact DNS record to add and watch it flip to \"connected\" once it actually resolves. AbilityRead, same passive-visibility tier as GET /apps/{name}/git-source: a live DNS lookup, no write.\n\nRequires the `read` ability.",
        "operationId": "handleCheckDomain",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Domain DNS check (domain_check.go): the guidance layer on top of domain connection, so DomainEditor can show an operator the exact DNS record to add and watch it flip to \"connected\" once it actually resolves.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/dns-records": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteDNSRecord",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete DNS Record",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "DNS records (dns_records.go): list/add/edit/delete the actual A/AAAA/CNAME/TXT/MX/SRV/CAA records in one app-owned domain's best-effort zone, via whichever ACME DNS-01 provider (Cloudflare or Route53) is configured. GET is AbilityRead: a live provider API read plus a DNS lookup, no write. POST/PUT/DELETE are AbilityRoot, the same \"real infrastructure, high blast radius\" tier PUT/DELETE .../tls-cert and .../auth already reserve: this writes directly to a live, externally visible DNS zone.\n\nRequires the `read` ability.",
        "operationId": "handleListDNSRecords",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "DNS records (dns_records.go): list/add/edit/delete the actual A/AAAA/CNAME/TXT/MX/SRV/CAA records in one app-owned domain's best-effort zone, via whichever ACME DNS-01 provider (Cloudflare or Route53) is configured.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateDNSRecord",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create DNS Record",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateDNSRecord",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update DNS Record",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/doctor": {
      "post": {
        "description": "Domain doctor: ordered DNS, CAA, port, TLS, HTTP, redirect and HSTS checks with one fix each. Read tier: it only reads and probes, and it connects only when the domain resolves to this server.\n\nRequires the `read` ability.",
        "operationId": "handleDomainDoctor",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Domain doctor: ordered DNS, CAA, port, TLS, HTTP, redirect and HSTS checks with one fix each.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/error-pages": {
      "delete": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleClearDomainErrorPages",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Clear Domain Error Pages",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      },
      "get": {
        "description": "Custom error pages (domain_error_pages.go): replaces Caddy's bare default error text, or whatever the backend itself returned, with the operator's own HTML for a fixed set of status codes (404, 500, 502, 503), enforced on the next ingress reconcile pass. GET is AbilityRead; PUT/DELETE are AbilityDeploy, the same tier PUT/DELETE .../waf already uses.\n\nRequires the `read` ability.",
        "operationId": "handleGetDomainErrorPages",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Custom error pages (domain_error_pages.go): replaces Caddy's bare default error text, or whatever the backend itself returned, with the operator's own HTML for a fixed set of status codes (404, 500, 502, 503), enforced on the next ingress reconcile pass.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetDomainErrorPage",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Error Page",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/forwarders": {
      "delete": {
        "description": "Requires the `deploy` ability.",
        "operationId": "DeleteDomainPolicyDeleteapiv1appsnamedomainsdomainforwarders",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Delete Domain Policy",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      },
      "get": {
        "description": "Ordered path forwarders to another app, an external URL, or a redirect.\n\nRequires the `read` ability.",
        "operationId": "GetDomainPolicyGetapiv1appsnamedomainsdomainforwarders",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Ordered path forwarders to another app, an external URL, or a redirect.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "SetDomainPolicyPutapiv1appsnamedomainsdomainforwarders",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Policy",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/geo": {
      "delete": {
        "description": "Requires the `deploy` ability.",
        "operationId": "DeleteDomainPolicyDeleteapiv1appsnamedomainsdomaingeo",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Delete Domain Policy",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      },
      "get": {
        "description": "Country allow or deny list.\n\nRequires the `read` ability.",
        "operationId": "GetDomainPolicyGetapiv1appsnamedomainsdomaingeo",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Country allow or deny list.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "SetDomainPolicyPutapiv1appsnamedomainsdomaingeo",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Policy",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/go-live": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGoLiveStatus",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Go Live Status",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGoLiveRun",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Go Live Run",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/headers": {
      "delete": {
        "description": "Requires the `deploy` ability.",
        "operationId": "DeleteDomainPolicyDeleteapiv1appsnamedomainsdomainheaders",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Delete Domain Policy",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      },
      "get": {
        "description": "Per-domain header rules and presets. Reads are AbilityRead; changes are AbilityDeploy like the other per-domain routing settings.\n\nRequires the `read` ability.",
        "operationId": "GetDomainPolicyGetapiv1appsnamedomainsdomainheaders",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Per-domain header rules and presets.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "SetDomainPolicyPutapiv1appsnamedomainsdomainheaders",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Policy",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/maintenance": {
      "delete": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleClearDomainMaintenance",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Clear Domain Maintenance",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      },
      "get": {
        "description": "Maintenance mode: GET is AbilityRead, matching the auth routes' own passive-visibility tier. PUT/DELETE are AbilityDeploy, not AbilityRoot: this changes an app's runtime routing behavior, the same \"app lifecycle\" tier POST .../stop and .../start already use, not a credential-bearing change like basic auth.\n\nRequires the `read` ability.",
        "operationId": "handleGetDomainMaintenance",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Maintenance mode: GET is AbilityRead, matching the auth routes' own passive-visibility tier.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetDomainMaintenance",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Maintenance",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/policies": {
      "get": {
        "description": "Every section plus status for the domain page, and a dry run preview.\n\nRequires the `read` ability.",
        "operationId": "handleGetDomainPolicies",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Every section plus status for the domain page, and a dry run preview.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/policies/preview": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handlePreviewDomainPolicies",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Preview Domain Policies",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/ports": {
      "get": {
        "description": "The app's raw streams; restricting a port writes firewall rules, so it needs AbilityWriteSensitive like the firewall routes.\n\nRequires the `read` ability.",
        "operationId": "handleGetDomainPorts",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "The app's raw streams; restricting a port writes firewall rules, so it needs AbilityWriteSensitive like the firewall routes.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/ports/{port}/restrict": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleUnrestrictDomainPort",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "port",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Unrestrict Domain Port",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write:sensitive"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleRestrictDomainPort",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "port",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Restrict Domain Port",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/redirect": {
      "delete": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleClearDomainRedirect",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Clear Domain Redirect",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      },
      "get": {
        "description": "Domain redirect (domain_redirect.go): points one app-owned domain at an arbitrary target URL, enforced by Caddy's static_response handler on the next ingress reconcile pass. GET is AbilityRead, matching the auth/maintenance/waf routes' own passive-visibility tier. PUT/DELETE are AbilityDeploy, the same \"app lifecycle, runtime routing behavior, not a credential\" tier PUT/DELETE .../maintenance and .../waf already use.\n\nRequires the `read` ability.",
        "operationId": "handleGetDomainRedirect",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Domain redirect (domain_redirect.go): points one app-owned domain at an arbitrary target URL, enforced by Caddy's static_response handler on the next ingress reconcile pass.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetDomainRedirect",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Redirect",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/redirects": {
      "delete": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleDeleteDomainRedirectSettings",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Delete Domain Redirect Settings",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      },
      "get": {
        "description": "Force HTTPS, trailing slash, lower case host, www and apex, aliases.\n\nRequires the `read` ability.",
        "operationId": "handleGetDomainRedirects",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Force HTTPS, trailing slash, lower case host, www and apex, aliases.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetDomainRedirectSettings",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Redirect Settings",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/redirects/aliases": {
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetDomainAliases",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Aliases",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/redirects/canonical": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetDomainCanonical",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Canonical",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/search-visibility": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDomainSearchVisibility",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Domain Search Visibility",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetDomainSearchVisibility",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain Search Visibility",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/tls-cert": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleClearDomainTLSCert",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Clear Domain TLS Cert",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "BYO TLS certificate upload (domain_tls_cert.go): an operator- supplied certificate/key pair used in place of Caddy's automatic ACME/internal issuance for one app-owned domain, enforced on the next ingress reconcile pass. GET is AbilityRead, matching the auth routes' own passive-visibility tier. PUT/DELETE are AbilityRoot, the same \"real infrastructure, high blast radius\" tier PUT/DELETE .../domains/{domain}/auth already reserves for a credential-bearing change.\n\nRequires the `read` ability.",
        "operationId": "handleGetDomainTLSCert",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "BYO TLS certificate upload (domain_tls_cert.go): an operator- supplied certificate/key pair used in place of Caddy's automatic ACME/internal issuance for one app-owned domain, enforced on the next ingress reconcile pass.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetDomainTLSCert",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Domain TLS Cert",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/domains/{domain}/waf": {
      "delete": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleClearDomainWAF",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Clear Domain WAF",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      },
      "get": {
        "description": "Opt-in WAF and rate limiting (domain_waf.go): OWASP Coraza and Caddy's rate_limit handler on one app-owned domain, enforced on the next ingress reconcile pass. GET is AbilityRead, matching the auth/maintenance routes' own passive-visibility tier. PUT/DELETE are AbilityDeploy, the same \"app lifecycle, runtime routing behavior, not a credential\" tier PUT/DELETE .../maintenance already uses: unlike basic auth or a BYO cert, nothing here is secret material.\n\nRequires the `read` ability.",
        "operationId": "handleGetDomainWAF",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Opt-in WAF and rate limiting (domain_waf.go): OWASP Coraza and Caddy's rate_limit handler on one app-owned domain, enforced on the next ingress reconcile pass.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetDomainWAF",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set Domain WAF",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/egress-policy": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleClearAppEgressPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Clear App Egress Policy",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Outbound network allowlist, per app (apps_egress.go): AbilityWriteSensitive for PUT/DELETE, the same tier PUT/DELETE .../storage above uses, since this changes an app's own network-exfiltration surface, the identical sensitivity class as which live bucket credentials it receives. GET is a real route here (unlike storage's reuse of handleGetApp), since an unconfigured policy is common enough (every app before this feature existed) to be worth its own explicit, ordinary AbilityRead response rather than folding it into the general app resource.\n\nRequires the `read` ability.",
        "operationId": "handleGetAppEgressPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Outbound network allowlist, per app (apps_egress.go): AbilityWriteSensitive for PUT/DELETE, the same tier PUT/DELETE .../storage above uses, since this changes an app's own network-exfiltration surface, the identical sensitivity class as which live bucket credentials it receives.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetAppEgressPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set App Egress Policy",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/environment": {
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetAppEnvironment",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set App Environment",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/environment-domains": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetAppEnvironmentDomains",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get App Environment Domains",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/exec": {
      "post": {
        "description": "One-off exec (handleExecApp's own doc comment): AbilityRoot, not AbilityDeploy. Secrets are injected as plaintext env vars into a container at create time and this package deliberately never decrypts one back into a response body anywhere else, see the secrets route above: \"never decrypts a value for a response body.\" Exec is the one route that can read them anyway, by running `env` inside the container, so it must sit behind the same tier that boundary already implies it needs, not the deploy tier. AbilityRoot is this project's existing \"breaks an assumption other tiers rely on\" boundary (see restore's own reasoning below).\n\nRequires the `root` ability.",
        "operationId": "handleExecApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "One-off exec (handleExecApp's own doc comment): AbilityRoot, not AbilityDeploy.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/exec-access": {
      "get": {
        "description": "Exec access opt-out (exec.go's requireExecAccess): a second, independent gate the two routes just above both check before attempting to reach a container, on top of (not instead of) their own AbilityRoot check. GET is AbilityRead, matching every other passive per-app setting view (e.g. GET .../auto-rollback above). PUT is AbilityRoot, the same tier exec/terminal themselves sit behind: flipping this back on hands back a root-tier capability, so re-enabling it needs the same tier as using it, an explicit, auditable, two-step action even for an already-root token.\n\nRequires the `read` ability.",
        "operationId": "handleGetExecAccess",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Exec access opt-out (exec.go's requireExecAccess): a second, independent gate the two routes just above both check before attempting to reach a container, on top of (not instead of) their own AbilityRoot check.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetExecAccess",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Exec Access",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/failure-context": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleFailureContext",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Failure Context",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/flags": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListFeatureFlags",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Feature Flags",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Feature flags (feature_flags.go): a boolean plus optional gradual rollout percentage a running app's own code reads live via the evaluate route below, never baked into a container at create time. CRUD sits at AbilityWrite/AbilityRead, the same ordinary config-mutation tier scheduled tasks above use. Evaluate is a separate, flat, AbilityRead-only route (no app name in its URL: see handleEvaluateFeatureFlag's own doc comment for why), the hot-path endpoint an app calls at runtime with a minimally-scoped read-only token, reusing the existing token/ability system with no new auth surface.\n\nRequires the `write` ability.",
        "operationId": "handleCreateFeatureFlag",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Feature flags (feature_flags.go): a boolean plus optional gradual rollout percentage a running app's own code reads live via the evaluate route below, never baked into a container at create time.",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/flags/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteFeatureFlag",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Feature Flag",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetFeatureFlag",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Feature Flag",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleUpdateFeatureFlag",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Update Feature Flag",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/git-source": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteGitSource",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete Git Source",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Git source (a deferred follow-up, git_sources.go): persist a repo/branch/build config per app so a git push can auto-deploy it, the multi-app evolution of internal/webhook's own single-app, env-var-configured Config. AbilityWriteSensitive for PUT/DELETE, matching PUT .../secrets/{key} above: connecting a repo accepts an optional live deploy token in the same request body.\n\nRequires the `read` ability.",
        "operationId": "handleGetGitSource",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Git source (a deferred follow-up, git_sources.go): persist a repo/branch/build config per app so a git push can auto-deploy it, the multi-app evolution of internal/webhook's own single-app, env-var-configured Config.",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetGitSource",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set Git Source",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/git-source/build": {
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetGitSourceBuild",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set Git Source Build",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/git-source/commits": {
      "get": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleListGitSourceCommits",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "List Git Source Commits",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/git-source/deploy-settings": {
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetGitDeploySettings",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set Git Deploy Settings",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/git-source/detect": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleDetectGitSourceBuild",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Detect Git Source Build",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/git-source/rotate-webhook-secret": {
      "post": {
        "description": "Rotate webhook secret (git_sources.go): mints a fresh secret without touching repo_url/branch/build config, the narrow alternative to a full DELETE-then-PUT reconnect. Same AbilityWriteSensitive tier as PUT .../git-source, since it's the identical class of credential write.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleRotateGitSourceWebhookSecret",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Rotate webhook secret (git_sources.go): mints a fresh secret without touching repo_url/branch/build config, the narrow alternative to a full DELETE-then-PUT reconnect.",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/group": {
      "get": {
        "description": "Stage 1 of multi-service apps (migrations/0039_apps.sql, apps_group.go): a service plus its siblings under the same store.App, with a worst-condition-wins rollup status. Additive, read-only; GET /api/v1/apps/{name} above is unchanged.\n\nRequires the `read` ability.",
        "operationId": "handleGetAppGroup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Stage 1 of multi-service apps (migrations/0039_apps.sql, apps_group.go): a service plus its siblings under the same store.App, with a worst-condition-wins rollup status.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/health": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleClearAppHealth",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Clear App Health",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetAppHealth",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get App Health",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetAppHealth",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set App Health",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/health-score": {
      "get": {
        "description": "Health \u0026 readiness score: a read-only synthesis of signals this router already exposes separately (deploys, crashloop, TLS, secrets, backups, health checks, alerting). See app_health_score.go's own doc comment.\n\nRequires the `read` ability.",
        "operationId": "handleGetAppHealthScore",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Health \u0026 readiness score: a read-only synthesis of signals this router already exposes separately (deploys, crashloop, TLS, secrets, backups, health checks, alerting).",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/health/discover": {
      "post": {
        "description": "Health check auto-detect (apps_health_discover.go): AbilityRead, the same tier GET .../diagnose already uses for an active probe against a running container (routes.go), since this changes nothing and only reads what the container's own HTTP port already exposes.\n\nRequires the `read` ability.",
        "operationId": "handleDiscoverAppHealth",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Health check auto-detect (apps_health_discover.go): AbilityRead, the same tier GET .../diagnose already uses for an active probe against a running container (routes.go), since this changes nothing and only reads what the container's own HTTP port already exposes.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/hook-runs": {
      "get": {
        "description": "Latest pre/post-deploy hook outcome (apps_hooks.go, internal/reconcile/application's own HookRunRecorder). Read-only, same ability tier as the group route just above.\n\nRequires the `read` ability.",
        "operationId": "handleGetAppHookRuns",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Latest pre/post-deploy hook outcome (apps_hooks.go, internal/reconcile/application's own HookRunRecorder).",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/images": {
      "get": {
        "description": "Previously-built image tags for this app's repo, so the deploy trigger form can offer a dropdown instead of a hand-typed tag (see ImageLister above). AbilityRead like every other passive view of an app's own state.\n\nRequires the `read` ability.",
        "operationId": "handleListImages",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Previously-built image tags for this app's repo, so the deploy trigger form can offer a dropdown instead of a hand-typed tag (see ImageLister above).",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/integrations": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAppIntegrations",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List App Integrations",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleAttachAppIntegration",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Attach App Integration",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/integrations/{id}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDetachAppIntegration",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Detach App Integration",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/investigate": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleInvestigate",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Investigate",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/job-runs": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListScheduledTaskRuns",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Scheduled Task Runs",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/listening-ports": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAppListeningPorts",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "App Listening Ports",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/loadbalancer": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteLoadBalancer",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Load Balancer",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetLoadBalancer",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Load Balancer",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetLoadBalancer",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Load Balancer",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/loadbalancer/check": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleLoadBalancerCheck",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Load Balancer Check",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/loadbalancer/export": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleExportLoadBalancer",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Export Load Balancer",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/loadbalancer/history": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleLoadBalancerHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Load Balancer History",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/loadbalancer/import": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleImportLoadBalancer",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Import Load Balancer",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/loadbalancer/status": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleLoadBalancerStatus",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Load Balancer Status",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/loadbalancer/upstreams/{id}": {
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetLoadBalancerUpstream",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Load Balancer Upstream",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/log-drain": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleClearAppLogDrain",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Clear App Log Drain",
        "tags": [
          "Audit Log / Log Drain"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Log drain (apps_log_drain.go): forwards an app's container logs to an external HTTP or syslog sink, additive to the existing node-local store. AbilityWriteSensitive for write/clear, the same tier as storage above (both configure where data leaves this control plane to); AbilityRead for the GET.\n\nRequires the `read` ability.",
        "operationId": "handleGetAppLogDrain",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Log drain (apps_log_drain.go): forwards an app's container logs to an external HTTP or syslog sink, additive to the existing node-local store.",
        "tags": [
          "Audit Log / Log Drain"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetAppLogDrain",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set App Log Drain",
        "tags": [
          "Audit Log / Log Drain"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/logs": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleQueryLogs",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Query Logs",
        "tags": [
          "Telemetry"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/logs/download": {
      "get": {
        "description": "Log export (a plain-text attachment of a bounded window, see logs_download.go): same AbilityRead boundary as the query/stream routes above, since it reads the same store through the same telemetry.QueryLogs call, nothing more sensitive than either.\n\nRequires the `read` ability.",
        "operationId": "handleDownloadLogs",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Log export (a plain-text attachment of a bounded window, see logs_download.go): same AbilityRead boundary as the query/stream routes above, since it reads the same store through the same telemetry.QueryLogs call, nothing more sensitive than either.",
        "tags": [
          "Telemetry"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/logs/stream": {
      "get": {
        "description": "Live log tail (additive to the historical search route just above, see handleLiveLogStream's own doc comment): AbilityRead, the same passive-visibility boundary as every other view of telemetry data in this router, including the deploy-log stream at GET .../deploys/{deployId}/logs above.\n\nRequires the `read` ability.",
        "operationId": "handleLiveLogStream",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Live log tail (additive to the historical search route just above, see handleLiveLogStream's own doc comment): AbilityRead, the same passive-visibility boundary as every other view of telemetry data in this router, including the deploy-log stream at GET .../deploys/{deployId}/logs above.",
        "tags": [
          "Telemetry"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/metrics": {
      "get": {
        "description": "Telemetry query: metrics and logs for one app, fanned out through a Federator (today, exactly one local source).\n\nRequires the `read` ability.",
        "operationId": "handleQueryMetrics",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Telemetry query: metrics and logs for one app, fanned out through a Federator (today, exactly one local source).",
        "tags": [
          "Telemetry"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/move": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleStartMove",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Start Move",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/move-with-volumes": {
      "post": {
        "description": "move-with-volumes: the same AbilityRoot tier as the plain node move above, since this both changes placement and does an in-place, full-overwrite restore of every named volume onto the destination node (the same risk class POST .../volumes/{volume}/restore already sits behind). The two GETs are AbilityRead, matching every other history listing in this file.\n\nRequires the `root` ability.",
        "operationId": "handleMoveAppWithVolumes",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "move-with-volumes: the same AbilityRoot tier as the plain node move above, since this both changes placement and does an in-place, full-overwrite restore of every named volume onto the destination node (the same risk class POST .../volumes/{volume}/restore already sits behind).",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/moves": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAppVolumeMoves",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List App Volume Moves",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/moves/{id}": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetAppVolumeMove",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get App Volume Move",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/network": {
      "get": {
        "description": "Live traffic path (network.go): declared container port plus the current Docker-assigned host port Caddy is actually proxying to, for the dashboard's Network tab. AbilityRead, same tier as images above.\n\nRequires the `read` ability.",
        "operationId": "handleGetAppNetwork",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Live traffic path (network.go): declared container port plus the current Docker-assigned host port Caddy is actually proxying to, for the dashboard's Network tab.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/node": {
      "put": {
        "description": "Placement: AbilityRoot, not AbilityWrite, matching the sensitivity of the standalone node routes above: moving a service between physical machines is infrastructure placement, not ordinary app config, even though it's reached through this app-scoped URL.\n\nRequires the `root` ability.",
        "operationId": "handleSetAppNode",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Placement: AbilityRoot, not AbilityWrite, matching the sensitivity of the standalone node routes above: moving a service between physical machines is infrastructure placement, not ordinary app config, even though it's reached through this app-scoped URL.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/pending-changes": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handlePendingChanges",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Pending Changes",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/pipeline-runs": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPipelineRuns",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Pipeline Runs",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/pipeline-runs/{id}": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPipelineRun",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Pipeline Run",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/pipeline-runs/{id}/approvals/{approval}": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleDecidePipelineApproval",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "approval",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Decide Pipeline Approval",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/pipeline-runs/{id}/cancel": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleCancelPipelineRun",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Cancel Pipeline Run",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/pipeline-runs/{id}/hold": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleDecidePipelineRunHold",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Decide Pipeline Run Hold",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/pipeline-runs/{id}/logs": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPipelineRunLogs",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Pipeline Run Logs",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/pipeline-runs/{id}/logs/stream": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleStreamPipelineRunLogs",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Stream Pipeline Run Logs",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/pipeline-runs/{id}/rerun": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleRerunPipelineRun",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Rerun Pipeline Run",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/pipeline-sync": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPipelineSync",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Pipeline Sync",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleRunPipelineSync",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Run Pipeline Sync",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetPipelineSync",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Pipeline Sync",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/pipeline-triggers": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPipelineTriggers",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Pipeline Triggers",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/pipelines": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPipelines",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Pipelines",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreatePipeline",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Pipeline",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/pipelines/{pname}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeletePipeline",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "pname",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Pipeline",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPipeline",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "pname",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Pipeline",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleUpdatePipeline",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "pname",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Update Pipeline",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/pipelines/{pname}/runs": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleStartPipelineRun",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "pname",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Start Pipeline Run",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/placement": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPlacement",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Placement",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetPlacement",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Placement",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/preflight": {
      "post": {
        "description": "Preflight checks (preflight.go): read-only probes of an existing app's stored config (AbilityRead, resource-scoped), or of a not yet created app described in the body (AbilityWrite, since the body names hosts the server will contact).\n\nRequires the `read` ability.",
        "operationId": "handlePreflightApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Preflight checks (preflight.go): read-only probes of an existing app's stored config (AbilityRead, resource-scoped), or of a not yet created app described in the body (AbilityWrite, since the body names hosts the server will contact).",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/preview": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPreview",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Preview",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handlePutPreview",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Put Preview",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/preview-env/{key}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleClearAppPreviewEnvOverride",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Clear App Preview Env Override",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "One preview-specific env var override at a time (apps_preview_env.go): same AbilityWrite tier and \"config write, not a deploy trigger\" reasoning as PUT/DELETE .../vault-env just above; only takes effect the next time a preview environment is created from this app.\n\nRequires the `write` ability.",
        "operationId": "handleSetAppPreviewEnvOverride",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "One preview-specific env var override at a time (apps_preview_env.go): same AbilityWrite tier and \"config write, not a deploy trigger\" reasoning as PUT/DELETE .../vault-env just above; only takes effect the next time a preview environment is created from this app.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/preview-policy": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPreviewPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Preview Policy",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetPreviewPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set Preview Policy",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/preview-settings": {
      "put": {
        "description": "Preview environments per pull request (preview_environments.go/ preview_environments_handlers.go): opt-in per app, off by default. AbilityWriteSensitive for the toggle, matching PUT .../git-source's own tier since it's the same connect-time-adjacent configuration surface; AbilityRead for the list, matching GET .../git-source; AbilityDeploy for the manual teardown, the same lifecycle-action tier POST .../restart and POST .../stop already use.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleSetPreviewEnabled",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Preview environments per pull request (preview_environments.go/ preview_environments_handlers.go): opt-in per app, off by default.",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/preview/capture": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCapturePreview",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Capture Preview",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/preview/history": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPreviews",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Previews",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/preview/prune": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handlePrunePreview",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Prune Preview",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/previews": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPreviewEnvironments",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Preview Environments",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/previews/{number}/approve": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleApprovePreviewEnvironment",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "number",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Approve Preview Environment",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/previews/{number}/extend": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleExtendPreviewEnvironment",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "number",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Extend Preview Environment",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/previews/{number}/teardown": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleTeardownPreviewEnvironment",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "number",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Teardown Preview Environment",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/project": {
      "put": {
        "description": "Move an app/database into (or out of, with project_id: \"\") a project: the project-kind counterpart to PUT /apps/{name}/node and PUT /databases/{name}/node above, same narrow-dedicated- mutation shape those routes establish (appResource/ databaseResource's own ProjectID field is response-only, exactly like NodeID, see handleSetAppProject's own doc comment for why). AbilityWrite, not AbilityRoot: project membership is an ordinary organizational edit, not infrastructure placement, so it sits at the same sensitivity as the rest of apps/databases CRUD rather than the node routes' fleet-level boundary.\n\nRequires the `write` ability.",
        "operationId": "handleSetAppProject",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Move an app/database into (or out of, with project_id: \"\") a project: the project-kind counterpart to PUT /apps/{name}/node and PUT /databases/{name}/node above, same narrow-dedicated- mutation shape those routes establish (appResource/ databaseResource's own ProjectID field is response-only, exactly like NodeID, see handleSetAppProject's own doc comment for why).",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/promote": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handlePromoteApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Promote App",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/promote/preview": {
      "get": {
        "description": "Promotion (promote.go): move a known-good image from this app to a sibling app tagged with another environment in the same project, through the exact same deploy path a plain trigger uses. Preview is AbilityRead like the comparison view above; the trigger itself is AbilityDeploy, matching POST .../deploys.\n\nRequires the `read` ability.",
        "operationId": "handlePromotePreview",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Promotion (promote.go): move a known-good image from this app to a sibling app tagged with another environment in the same project, through the exact same deploy path a plain trigger uses.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/requests": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleQueryRequests",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Query Requests",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/resource-recommendation": {
      "get": {
        "description": "Read-only resource right-sizing suggestion (resource_recommendation.go): synthesizes the app's historical CPU/memory usage and current limits into a deterministic raise/lower/keep suggestion per dimension. AbilityRead, same sensitivity as diagnose above; never writes anything, never applied automatically.\n\nRequires the `read` ability.",
        "operationId": "handleAppResourceRecommendation",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Read-only resource right-sizing suggestion (resource_recommendation.go): synthesizes the app's historical CPU/memory usage and current limits into a deterministic raise/lower/keep suggestion per dimension.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/restart": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleRestartApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Restart App",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/rollback-targets": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListRollbackTargets",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Rollback Targets",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/save-as-template": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSaveAppAsTemplate",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Save App As Template",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/schedule": {
      "get": {
        "description": "Scheduled deploys (app_schedule.go): a per-app cron schedule that redeploys the latest commit on a branch, checked by internal/scheduledeploy.Scheduler. Same GET=Read/PUT=WriteSensitive split as git-source just above.\n\nRequires the `read` ability.",
        "operationId": "handleGetAppSchedule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Scheduled deploys (app_schedule.go): a per-app cron schedule that redeploys the latest commit on a branch, checked by internal/scheduledeploy.Scheduler.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetAppSchedule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set App Schedule",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/schedule/history": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAppScheduleHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List App Schedule History",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/secrets": {
      "get": {
        "description": "List known secret keys (never values) and toggle a key's lock. GET at AbilityRead, matching GET .../git-source's own GET=Read/PUT=WriteSensitive split just below: a key NAME is no more sensitive than a git-source's connection config.\n\nRequires the `read` ability.",
        "operationId": "handleListSecrets",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List known secret keys (never values) and toggle a key's lock.",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/secrets/{key}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteSecret",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete Secret",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "write:sensitive"
      },
      "put": {
        "description": "Secrets. Set-only: there is deliberately no GET, returning a value (even to its own owner over an authenticated session) is exactly the kind of exposure envelope encryption exists to avoid.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleSetSecret",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Secrets.",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/secrets/{key}/lock": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetSecretLock",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set Secret Lock",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/sleep": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetAppSleep",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get App Sleep",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleSetAppSleep",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Set App Sleep",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/sleep/wake": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleWakeApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Wake App",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/slo-preview": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleSLOPreview",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "SLO Preview",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/start": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleStartApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Start App",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/stop": {
      "post": {
        "description": "Stop/start (handleStopApp/handleStartApp's own doc comments): same AbilityDeploy tier as restart above, the same class of lifecycle action.\n\nRequires the `deploy` ability.",
        "operationId": "handleStopApp",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Stop/start (handleStopApp/handleStartApp's own doc comments): same AbilityDeploy tier as restart above, the same class of lifecycle action.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/apps/{name}/storage": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleClearAppStorage",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Clear App Storage",
        "tags": [
          "App Storage / Database Attach"
        ],
        "x-required-ability": "write:sensitive"
      },
      "put": {
        "description": "Object-storage attachment, per app (apps_storage.go): which connected backup_targets bucket (the same S3-compatible connection a database's scheduled backups can already point at, reused rather than a second \"storage target\" concept) this app's own container gets S3_* credentials injected from at container-create time. AbilityWriteSensitive for both PUT and DELETE, the same tier scheduled backups and database public access above already use: this changes which live bucket credentials an app's own container receives, the identical sensitivity class. GET reuses handleGetApp's own existing AbilityRead response (appResource carries storage_target_id), the same \"no separate GET route\" reasoning the backup-schedule/public-access routes above already apply.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleSetAppStorage",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Object-storage attachment, per app (apps_storage.go): which connected backup_targets bucket (the same S3-compatible connection a database's scheduled backups can already point at, reused rather than a second \"storage target\" concept) this app's own container gets S3_* credentials injected from at container-create time.",
        "tags": [
          "App Storage / Database Attach"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/streams": {
      "get": {
        "description": "Streams (app_streams.go): raw TCP port forwards, host port to one container port, proxied by Caddy's layer4 app (internal/reconcile/ingress). AbilityWriteSensitive for create/ delete, the same tier as a firewall rule: a stream opens a new host port to raw TCP traffic. List is ordinary AbilityRead.\n\nRequires the `read` ability.",
        "operationId": "handleListAppStreams",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Streams (app_streams.go): raw TCP port forwards, host port to one container port, proxied by Caddy's layer4 app (internal/reconcile/ingress).",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCreateAppStream",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Create App Stream",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/streams/{id}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteAppStream",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete App Stream",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/supply-chain": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetSupplyChain",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Supply Chain",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handlePutSupplyChain",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Put Supply Chain",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/supply-chain/override": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSupplyChainOverride",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Supply Chain Override",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/tags": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAppTags",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List App Tags",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleAttachAppTag",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Attach App Tag",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/tags/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDetachAppTag",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Detach App Tag",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/terminal": {
      "get": {
        "description": "Interactive terminal (terminal.go): the same AbilityRoot tier as one-off exec above, since a shell can read the same secrets. A WebSocket rather than SSE, which that file's own doc comment argues for at length.\n\nRequires the `root` ability.",
        "operationId": "handleAppTerminal",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Interactive terminal (terminal.go): the same AbilityRoot tier as one-off exec above, since a shell can read the same secrets.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/timeline": {
      "get": {
        "description": "Timeline and pending changes (app_timeline.go, pending_changes.go).\n\nRequires the `read` ability.",
        "operationId": "handleAppTimeline",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Timeline and pending changes (app_timeline.go, pending_changes.go).",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/validate-spec": {
      "post": {
        "description": "Live app.yaml validation (apps_validate_spec.go): read-only, same AbilityRead/POST shape as preflight above. Never saves or deploys anything, only runs the submitted body through internal/spec's own Parse-time checks for an editor's earlier, friendlier feedback.\n\nRequires the `read` ability.",
        "operationId": "handleValidateSpec",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Live app.yaml validation (apps_validate_spec.go): read-only, same AbilityRead/POST shape as preflight above.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/vault-env/{key}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleClearAppVaultEnv",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Clear App Vault Env",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "One Vault-sourced env var declaration at a time (apps_vault_env.go): same AbilityWrite tier and \"config write, not a deploy trigger\" reasoning as PUT/DELETE .../database just above.\n\nRequires the `write` ability.",
        "operationId": "handleSetAppVaultEnv",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "One Vault-sourced env var declaration at a time (apps_vault_env.go): same AbilityWrite tier and \"config write, not a deploy trigger\" reasoning as PUT/DELETE .../database just above.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/volumes": {
      "put": {
        "description": "Attach/detach a named Docker volume outside a redeploy (apps_volumes_attach.go): AbilityWrite, the same tier health above uses, since this is an ordinary declarative resource, not a secret or network-exfiltration surface like egress-policy/storage.\n\nRequires the `write` ability.",
        "operationId": "handleSetAppVolumes",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Attach/detach a named Docker volume outside a redeploy (apps_volumes_attach.go): AbilityWrite, the same tier health above uses, since this is an ordinary declarative resource, not a secret or network-exfiltration surface like egress-policy/storage.",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/backup-policy": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetVolumeBackupPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Volume Backup Policy",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetVolumeBackupPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set Volume Backup Policy",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/backup-schedule": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleClearVolumeBackupSchedule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Clear Volume Backup Schedule",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetVolumeBackupSchedule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Volume Backup Schedule",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetVolumeBackupSchedule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set Volume Backup Schedule",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/backups": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListVolumeBackupHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Volume Backup History",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleTriggerVolumeBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Trigger Volume Backup",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/backups/{historyId}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteVolumeBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "historyId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete Volume Backup",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/backups/{historyId}/download": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleDownloadVolumeBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "historyId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Download Volume Backup",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/backups/{historyId}/verifications": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListVolumeBackupVerifications",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "historyId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Volume Backup Verifications",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/backups/{historyId}/verify": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleVerifyVolumeBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "historyId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Verify Volume Backup",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/clone-restores": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListVolumeCloneRestores",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Volume Clone Restores",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/restore": {
      "post": {
        "description": "AbilityRoot, matching the database restore route above exactly: see handleTriggerVolumeRestore's own doc comment for why this is not a lesser risk tier just because the target is a filesystem.\n\nRequires the `root` ability.",
        "operationId": "handleTriggerVolumeRestore",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "AbilityRoot, matching the database restore route above exactly: see handleTriggerVolumeRestore's own doc comment for why this is not a lesser risk tier just because the target is a filesystem.",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/restore-as-new": {
      "post": {
        "description": "Restore as a new volume (app_volume_clone_restore.go): the non-destructive counterpart just above, the same AbilityWriteSensitive tier the database clone-restore route below uses, see handleVolumeCloneRestore's own doc comment for why.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleVolumeCloneRestore",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Restore as a new volume (app_volume_clone_restore.go): the non-destructive counterpart just above, the same AbilityWriteSensitive tier the database clone-restore route below uses, see handleVolumeCloneRestore's own doc comment for why.",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/restore-to": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleVolumeRestoreTo",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Volume Restore To",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/apps/{name}/volumes/{volume}/restores": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListVolumeRestoreHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "volume",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Volume Restore History",
        "tags": [
          "App Volume Backups / Restore"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/webhook-deliveries": {
      "get": {
        "description": "Recent webhook deliveries (webhook_deliveries.go): real visibility into what a git provider actually sent, for the exact route above, plus a manual replay of a stored delivery. AbilityRead for the list, matching GET .../git-source; AbilityDeploy for replay, matching POST .../deploys, since a replay can trigger the same real build/deploy side effect.\n\nRequires the `read` ability.",
        "operationId": "handleListWebhookDeliveries",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Recent webhook deliveries (webhook_deliveries.go): real visibility into what a git provider actually sent, for the exact route above, plus a manual replay of a stored delivery.",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/apps/{name}/webhook-deliveries/{id}/replay": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleReplayWebhookDelivery",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Replay Webhook Delivery",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/attention/dismiss": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleAttentionDismiss",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Attention Dismiss",
        "tags": [
          "Other"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/attention/feed": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAttentionFeed",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Attention Feed",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/audit-log": {
      "get": {
        "description": "Audit log (audit.go): who did what, across every session and API token, docs/comparison.md's own \"no audit log exists anywhere in the codebase\" gap. AbilityRoot, the same tier as the node and GitHub App routes above: this is operational data about every other identity on this control plane, not an ordinary per-app read.\n\nRequires the `root` ability.",
        "operationId": "handleListAuditLog",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Audit log (audit.go): who did what, across every session and API token, docs/comparison.md's own \"no audit log exists anywhere in the codebase\" gap.",
        "tags": [
          "Audit Log / Log Drain"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/audit-log/export": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleExportAuditLog",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Export Audit Log",
        "tags": [
          "Audit Log / Log Drain"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/audit-log/purge": {
      "post": {
        "description": "Manual retention purge (audit_retention.go): runs the same operator-configured retention window PurgeOldAuditEntries' own periodic sweep uses, on demand instead of waiting for its next tick. AbilityRoot, matching the read route above: clearing audit history is at least as sensitive as reading it.\n\nRequires the `root` ability.",
        "operationId": "handlePurgeAuditLog",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Manual retention purge (audit_retention.go): runs the same operator-configured retention window PurgeOldAuditEntries' own periodic sweep uses, on demand instead of waiting for its next tick.",
        "tags": [
          "Audit Log / Log Drain"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/auth/2fa": {
      "get": {
        "description": "Two-factor auth (twofactor.go). /2fa/verify is necessarily public (it's step two of login, before a session exists), rate-limited by rt.mfaVerify instead of a session/ability check. Every other route here acts on the caller's own account, so requireAuth (session-only, matching handleChangePassword's own reasoning).\n\nRequires a signed-in dashboard session.",
        "operationId": "Getapiv1auth2fa",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Two-factor auth (twofactor.go).",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/2fa/confirm": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "Postapiv1auth2faconfirm",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "POST /api/v1/auth/2fa/confirm",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/2fa/disable": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "Postapiv1auth2fadisable",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "POST /api/v1/auth/2fa/disable",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/2fa/recovery-codes/regenerate": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "Postapiv1auth2farecoverycodesregenerate",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "POST /api/v1/auth/2fa/recovery-codes/regenerate",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/2fa/setup": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "Postapiv1auth2fasetup",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "POST /api/v1/auth/2fa/setup",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/2fa/verify": {
      "post": {
        "description": "No authentication required.",
        "operationId": "Postapiv1auth2faverify",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "POST /api/v1/auth/2fa/verify",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/device/activity": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDeviceActivity",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Device Activity",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/auth/device/pending-summary": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDevicePendingSummary",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Device Pending Summary",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/auth/device/requests": {
      "get": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleListDeviceAuthRequests",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "List Device Auth Requests",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/device/start": {
      "post": {
        "description": "CLI device login (device_auth.go): \"levelrail-cli auth login --device\" prints a code, the operator approves it here. start/token are necessarily public (no credential exists yet); requests/ approve/deny are requireAuth session-only, the same tier tokens.go's own session-only routes use, since approving a device only ever mints a token scoped to the approving operator's own abilities.\n\nNo authentication required.",
        "operationId": "handleDeviceAuthStart",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "CLI device login (device_auth.go): \"levelrail-cli auth login --device\" prints a code, the operator approves it here.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/device/token": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleDeviceAuthToken",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Device Auth Token",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/device/{user_code}/approve": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleApproveDeviceAuthRequest",
        "parameters": [
          {
            "in": "path",
            "name": "user_code",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Approve Device Auth Request",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/device/{user_code}/deny": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleDenyDeviceAuthRequest",
        "parameters": [
          {
            "in": "path",
            "name": "user_code",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Deny Device Auth Request",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/forgot-password": {
      "post": {
        "description": "Forgot/reset password: necessarily unauthenticated, gated by possession of the emailed token instead of a session or ability.\n\nNo authentication required.",
        "operationId": "handleForgotPassword",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Forgot/reset password: necessarily unauthenticated, gated by possession of the emailed token instead of a session or ability.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/login": {
      "post": {
        "description": "Auth. Login and first-run registration are necessarily public; everything else requires an existing session.\n\nNo authentication required.",
        "operationId": "handleLogin",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Auth.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/login-approval/poll": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handlePollLoginApproval",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Poll Login Approval",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/login-approvals/{id}/approve": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleApproveLoginApproval",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Approve Login Approval",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/login-approvals/{id}/deny": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleDenyLoginApproval",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Deny Login Approval",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/login-code/redeem": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleRedeemLoginCode",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Redeem Login Code",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/login-code/request": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleRequestLoginCode",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Request Login Code",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/login-options": {
      "get": {
        "description": "Sign in with a code and new-device approval (login_code.go, login_approval.go). Request, redeem and poll are public and bound to a browser cookie; the rest act only on the caller's own account.\n\nNo authentication required.",
        "operationId": "handleLoginOptions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Sign in with a code and new-device approval (login_code.go, login_approval.go).",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/logout": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleLogout",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Logout",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/oauth/providers": {
      "get": {
        "description": "OAuth sign-in (Google, GitHub). /providers, /start, /callback are all necessarily public; /link/start is requireAuth-gated (see its own doc comment).\n\nNo authentication required.",
        "operationId": "handleListPublicOAuthProviders",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "OAuth sign-in (Google, GitHub).",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/oauth/{provider}/callback": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleOAuthCallback",
        "parameters": [
          {
            "in": "path",
            "name": "provider",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "O Auth Callback",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/oauth/{provider}/link/start": {
      "get": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleOAuthLinkStart",
        "parameters": [
          {
            "in": "path",
            "name": "provider",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "O Auth Link Start",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/oauth/{provider}/start": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleOAuthStart",
        "parameters": [
          {
            "in": "path",
            "name": "provider",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "O Auth Start",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/passkey-login/begin": {
      "post": {
        "description": "No authentication required.",
        "operationId": "Postapiv1authpasskeyloginbegin",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "POST /api/v1/auth/passkey-login/begin",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/passkey-login/finish": {
      "post": {
        "description": "No authentication required.",
        "operationId": "Postapiv1authpasskeyloginfinish",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "POST /api/v1/auth/passkey-login/finish",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/passkeys": {
      "get": {
        "description": "Passkeys (WebAuthn, passkeys.go). Registration acts on the caller's own account, so requireAuth like the 2FA routes above. /passkey-login/... is the sign-in ceremony, necessarily public, same shape as /2fa/verify.\n\nRequires a signed-in dashboard session.",
        "operationId": "Getapiv1authpasskeys",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Passkeys (WebAuthn, passkeys.go).",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/passkeys/register/begin": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "Postapiv1authpasskeysregisterbegin",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "POST /api/v1/auth/passkeys/register/begin",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/passkeys/register/finish": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "Postapiv1authpasskeysregisterfinish",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "POST /api/v1/auth/passkeys/register/finish",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/passkeys/{id}": {
      "delete": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "Deleteapiv1authpasskeysid",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "DELETE /api/v1/auth/passkeys/{id}",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      },
      "patch": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "Patchapiv1authpasskeysid",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "PATCH /api/v1/auth/passkeys/{id}",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/password": {
      "put": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleChangePassword",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Change Password",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/register": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleRegister",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Register",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/reset-password": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleResetPassword",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Reset Password",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/session": {
      "get": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleGetSession",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Get Session",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/session-links": {
      "post": {
        "description": "Session links (session_links.go): a short-lived, single-use, URL-embeddable token for browser automation to skip manual login. Minting is root-equivalent since the resulting session inherits the minting caller's own abilities; consuming is necessarily unauthenticated, gated by possession of the token itself, same shape as reset-password below.\n\nRequires the `root` ability.",
        "operationId": "handleMintSessionLink",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Session links (session_links.go): a short-lived, single-use, URL-embeddable token for browser automation to skip manual login.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/auth/session-links/{token}/consume": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleConsumeSessionLink",
        "parameters": [
          {
            "in": "path",
            "name": "token",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Consume Session Link",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/sessions/revoke-others": {
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleRevokeOtherSessions",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Revoke Other Sessions",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/setup-status": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleSetupStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Setup Status",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/sign-in-alert/disown": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleDisownSignIn",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Disown Sign In",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/sign-in-requests": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleListSignInRequests",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "List Sign In Requests",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/sign-in-requests/codes/{id}/reveal": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleRevealLoginCode",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Reveal Login Code",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/tokens": {
      "get": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleListTokens",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "List Tokens",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      },
      "post": {
        "description": "API tokens: create/revoke are session-only, deliberately never bearer-token authenticated (list also takes a root token). A token cannot mint or revoke another token on its own behalf; only an interactive human session can manage the token set, the same boundary that stops a leaked scoped token from escalating itself by minting a broader one.\n\nRequires a signed-in dashboard session.",
        "operationId": "handleCreateToken",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "API tokens: create/revoke are session-only, deliberately never bearer-token authenticated (list also takes a root token).",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/tokens/{id}": {
      "delete": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleRevokeToken",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Revoke Token",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/auth/trusted-devices": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleListTrustedDevices",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "List Trusted Devices",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/trusted-devices/{id}": {
      "delete": {
        "description": "No authentication required.",
        "operationId": "handleRevokeTrustedDevice",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Revoke Trusted Device",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/auth/users": {
      "post": {
        "description": "Multi-user: creating another local-password user (see handleRegister's own doc comment) is AbilityRoot, not merely requireAuth: the caller also picks the new user's Abilities, so anyone able to reach this route can mint access at any tier, themselves included, only a root caller may do that. Listing stays AbilityRead, same tier as every other passive view.\n\nRequires the `root` ability.",
        "operationId": "handleCreateUser",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Multi-user: creating another local-password user (see handleRegister's own doc comment) is AbilityRoot, not merely requireAuth: the caller also picks the new user's Abilities, so anyone able to reach this route can mint access at any tier, themselves included, only a root caller may do that.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/auth/whoami": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleWhoami",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Whoami",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/backup-targets": {
      "get": {
        "description": "Backup targets (connected S3-compatible buckets a database backup can be uploaded to). Create and delete need AbilityWriteSensitive: create because its request body carries live bucket credentials, delete because it gates access to the same. List/get are ordinary AbilityRead, the same boundary handleListCertificates/ handleListStaticSites already draw between visibility and mutation.\n\nRequires the `read` ability.",
        "operationId": "handleListBackupTargets",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Backup targets (connected S3-compatible buckets a database backup can be uploaded to).",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCreateBackupTarget",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Create Backup Target",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/backup-targets/{id}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteBackupTarget",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete Backup Target",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetBackupTarget",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Backup Target",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleUpdateBackupTarget",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Update Backup Target",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/backup-targets/{id}/test": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleTestBackupTarget",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Test Backup Target",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/backups": {
      "get": {
        "description": "Instance-wide backup history across every database and app volume, the aggregated counterpart of the per-resource routes above and below: ordinary AbilityRead, same tier as those, since this is only ever a merged read of history metadata already visible per-resource.\n\nRequires the `read` ability.",
        "operationId": "handleListAllBackups",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Instance-wide backup history across every database and app volume, the aggregated counterpart of the per-resource routes above and below: ordinary AbilityRead, same tier as those, since this is only ever a merged read of history metadata already visible per-resource.",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/backups/drills": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListBackupDrills",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Backup Drills",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleStartBackupDrill",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Start Backup Drill",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/backups/drills/{id}": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetBackupDrill",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Backup Drill",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/backups/health": {
      "get": {
        "description": "App service volume backups (app_volume_backups.go/ app_volume_backup_download.go/app_volume_backup_verify.go): the exact same ability tiers as the database routes just above, applied to a service's named volume instead of a managed database. See those handlers' own doc comments for the per-route reasoning this mirrors.\n\nRequires the `read` ability.",
        "operationId": "handleBackupHealth",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "App service volume backups (app_volume_backups.go/ app_volume_backup_download.go/app_volume_backup_verify.go): the exact same ability tiers as the database routes just above, applied to a service's named volume instead of a managed database.",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/backups/protection/refresh": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleRefreshBackupProtection",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Refresh Backup Protection",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/bitbucket-app": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisconnectBitbucketApp",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disconnect Bitbucket App",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Bitbucket App: the OAuth-consumer counterpart of the GitLab App routes above, same ability tiers for the same reasons, same two-step \"configure, then authorize\" shape. Cloud only, no instance_url (docs/design/git-provider-integrations.md section 3).\n\nRequires the `root` ability.",
        "operationId": "handleGetBitbucketAppStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Bitbucket App: the OAuth-consumer counterpart of the GitLab App routes above, same ability tiers for the same reasons, same two-step \"configure, then authorize\" shape.",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleConnectBitbucketApp",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Connect Bitbucket App",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/bitbucket-app/callback": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleBitbucketAppCallback",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Bitbucket App Callback",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/bitbucket-app/connect": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleStartBitbucketAppConnect",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Start Bitbucket App Connect",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/bitbucket-app/repos": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListBitbucketAppRepos",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Bitbucket App Repos",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/bitbucket-app/repos/{workspace}/{repoSlug}/branches": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListBitbucketAppBranches",
        "parameters": [
          {
            "in": "path",
            "name": "workspace",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "repoSlug",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Bitbucket App Branches",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/bitbucket-app/repos/{workspace}/{repoSlug}/use-as-source": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleUseBitbucketRepoAsSource",
        "parameters": [
          {
            "in": "path",
            "name": "workspace",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "repoSlug",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Use Bitbucket Repo As Source",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/brand": {
      "get": {
        "description": "Public: the frontend needs branding before a session exists (e.g. on the login screen itself).\n\nNo authentication required.",
        "operationId": "handleBrand",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Public: the frontend needs branding before a session exists (e.g.",
        "tags": [
          "System"
        ]
      }
    },
    "/api/v1/build-cache": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteBuildCache",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Build Cache",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListBuildCache",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Build Cache",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetBuildCache",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Build Cache",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/build-cache/clear": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleClearBuildCache",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Clear Build Cache",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/build-cache/stats": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleBuildCacheStats",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Build Cache Stats",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/build/detect": {
      "post": {
        "description": "Framework pre-flight detection (handleDetectFramework's own doc comment): also not scoped to an existing app, same AbilityDeploy boundary as the branch listing above.\n\nRequires the `deploy` ability.",
        "operationId": "handleDetectFramework",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Framework pre-flight detection (handleDetectFramework's own doc comment): also not scoped to an existing app, same AbilityDeploy boundary as the branch listing above.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/certificates": {
      "get": {
        "description": "Certificates (TLS renewal visibility): this project treats \"a cert renewal fails silently at 3am\" as its central risk to catch before it bites a real user, and until now nothing in the API surfaced certificate state at all. Read-only, so AbilityRead like handleSystemStatus/handleGetNodeHealth, not AbilityRoot: seeing whether a domain's certificate is about to expire is ordinary operator visibility, not a fleet-admin mutation the way the node routes above are.\n\nRequires the `read` ability.",
        "operationId": "handleListCertificates",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Certificates (TLS renewal visibility): this project treats \"a cert renewal fails silently at 3am\" as its central risk to catch before it bites a real user, and until now nothing in the API surfaced certificate state at all.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/changelog": {
      "get": {
        "description": "\"What's new\" dashboard panel: recent entries parsed from the repo's own CHANGELOG.md, AbilityRead like updates above.\n\nRequires the `read` ability.",
        "operationId": "handleGetChangelog",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "\"What's new\" dashboard panel: recent entries parsed from the repo's own CHANGELOG.md, AbilityRead like updates above.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/compose": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListComposeStacks",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Compose Stacks",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/compose/preview": {
      "post": {
        "description": "Parse only, nothing saved; deploy tier so the endpoint is not a free YAML parser for read-only tokens.\n\nRequires the `deploy` ability.",
        "operationId": "handlePreviewCompose",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Parse only, nothing saved; deploy tier so the endpoint is not a free YAML parser for read-only tokens.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/database-engines": {
      "get": {
        "description": "Databases CRUD, the database-kind counterpart to apps CRUD above. No PUT (full-replace update) yet: unlike a service's image/port/ domains, none of engine/version/name are meant to change in place once created (an engine or major-version change is a migration, not a config edit), so there is nothing for an update endpoint to legitimately do yet. Read-only, ahead of the CRUD routes below since it's not scoped to any one database: every engine this control plane can create at all, backed by the embedded database_engines.yaml registry rather than a hardcoded list, see handleListDatabaseEngines' own doc comment.\n\nRequires the `read` ability.",
        "operationId": "handleListDatabaseEngines",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Databases CRUD, the database-kind counterpart to apps CRUD above.",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListDatabases",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Databases",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateDatabase",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Database",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/databases/upgrade-summary": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDatabaseUpgradeSummary",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Database Upgrade Summary",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Database",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Resource-scoped, same reasoning as the apps routes above.\n\nRequires the `read` ability.",
        "operationId": "handleGetDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Resource-scoped, same reasoning as the apps routes above.",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/access/grants": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGrantDatabaseAccess",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Grant Database Access",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/access/grants/{policy_id}/{principal_type}/{principal_id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRevokeDatabaseGrant",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "policy_id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "principal_type",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "principal_id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Revoke Database Grant",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/access/principals": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleDatabaseWhoCanAccess",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Database Who Can Access",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/access/temp": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListDatabaseTempCredentials",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Database Temp Credentials",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleIssueDatabaseTempCredential",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Issue Database Temp Credential",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/access/temp/{id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRevokeDatabaseTempCredential",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Revoke Database Temp Credential",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/backup-schedule": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleClearBackupSchedule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Clear Backup Schedule",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      },
      "put": {
        "description": "Scheduled backup config, per database (wave-2 roadmap item 6): which backup target, cron schedule, and retention count internal/backup.Scheduler uses for this database, if any. AbilityWriteSensitive for both PUT and DELETE, the same tier the manual trigger route above already uses: this is the config that decides where an unattended, recurring backup ends up, a live bucket with previously-stored credentials, the identical sensitivity class. GET reuses handleGetDatabase's own existing AbilityRead response (databaseResource already carries these three fields, see that handler's own file), so there is no separate GET route here.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleSetBackupSchedule",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Scheduled backup config, per database (wave-2 roadmap item 6): which backup target, cron schedule, and retention count internal/backup.Scheduler uses for this database, if any.",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/backups": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListBackupHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Backup History",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Backup history and manual trigger, per database. Trigger needs AbilityWriteSensitive: it starts real work against a live bucket using a previously-stored credential, the same sensitivity class creating or deleting the backup target itself already carries. History listing is ordinary AbilityRead.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleTriggerBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Backup history and manual trigger, per database.",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/backups/{historyId}": {
      "delete": {
        "description": "Delete one specific archived backup on demand, rather than waiting for retention (BackupRetain/BackupRetainDays above) to age it out. AbilityWriteSensitive, matching the manual trigger route above: this destroys a real stored artifact, the same sensitivity class as triggering a backup or deleting the backup target itself, not the AbilityRoot tier restore below uses, since nothing here touches a live database's own data. See handleDeleteBackup's own doc comment.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleDeleteBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "historyId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete one specific archived backup on demand, rather than waiting for retention (BackupRetain/BackupRetainDays above) to age it out.",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/backups/{historyId}/download": {
      "get": {
        "description": "Download one succeeded backup's own object, streamed straight to the browser. AbilityReadSensitive, not AbilityRead: this returns the actual dump bytes, a full database's worth of content, not metadata about an attempt the way history listing above does; it's also not a mutation, so AbilityWriteSensitive (the tier the trigger route above uses) would overstate it. Not AbilityRoot either, unlike restore.go's own explicit \"single most destructive endpoint\" reasoning for that tier: restore is irreversible, in-place destruction of live data, a materially worse risk class than a read-only fetch from a bucket, even though this route is a genuine full-database exfiltration primitive on the confidentiality axis. Today every session is implicitly root (requireAbility only gates scoped bearer/MCP tokens), so this choice mainly matters once Phase 4 mints scoped automation tokens against this ability tier. See handleDownloadBackup's own doc comment for the full reasoning.\n\nRequires the `read:sensitive` ability.",
        "operationId": "handleDownloadBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "historyId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Download one succeeded backup's own object, streamed straight to the browser.",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/backups/{historyId}/verifications": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListBackupVerifications",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "historyId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Backup Verifications",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/backups/{historyId}/verify": {
      "post": {
        "description": "Backup verification: re-download a succeeded backup and confirm it is still intact (checksum, size, and a lightweight structural check), without ever attempting a live restore. AbilityWriteSensitive for the trigger, matching the manual backup trigger route above exactly (see handleVerifyBackup's own doc comment for why); listing past attempts is ordinary AbilityRead, matching history listing above.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleVerifyBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "historyId",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Backup verification: re-download a succeeded backup and confirm it is still intact (checksum, size, and a lightweight structural check), without ever attempting a live restore.",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/base-backups": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListBaseBackupHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Base Backup History",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleTriggerBaseBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Trigger Base Backup",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/clone-restores": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListCloneRestores",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Clone Restores",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/environment": {
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetDatabaseEnvironment",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Database Environment",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/databases/{name}/explain": {
      "post": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleDatabaseExplain",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Database Explain",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/key": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleGetDatabaseKey",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Get Database Key",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/keys": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleScanDatabaseKeys",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Scan Database Keys",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/logs": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleQueryDatabaseLogs",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Query Database Logs",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/logs/stream": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleLiveDatabaseLogStream",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Live Database Log Stream",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/major-upgrade": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleMajorUpgrade",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Major Upgrade",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/major-upgrades": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListMajorUpgrades",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Major Upgrades",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/major-upgrades/{id}/rollback": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRollbackMajorUpgrade",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Rollback Major Upgrade",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/major-upgrades/{id}/snapshot": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDiscardMajorUpgradeSnapshot",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Discard Major Upgrade Snapshot",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/metrics": {
      "get": {
        "description": "Telemetry query, the database counterpart to GET /apps/{name}/metrics, /logs, /logs/stream above: same TelemetryQuerier/logBroadcaster gating (501 when unconfigured). database_metrics.go/database_logs.go share the actual query/stream logic with their app equivalents via queryResourceMetrics/ queryResourceLogs/streamResourceLogs (metrics.go/logs.go/ live_logs.go), parameterized on a resourceLookup, not a hand-copied duplicate.\n\nRequires the `read` ability.",
        "operationId": "handleQueryDatabaseMetrics",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Telemetry query, the database counterpart to GET /apps/{name}/metrics, /logs, /logs/stream above: same TelemetryQuerier/logBroadcaster gating (501 when unconfigured).",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/move": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "StartMovePostapiv1databasesnamemove",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Start Move",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/network": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDatabaseNetwork",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Database Network",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/network/make-private": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleMakeDatabasePrivate",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Make Database Private",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/network/rules": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRemoveDatabaseRules",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Remove Database Rules",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleApplyDatabaseRules",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Apply Database Rules",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/network/rules/preview": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handlePreviewDatabaseRules",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Preview Database Rules",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/network/scope": {
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetDatabaseScope",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Database Scope",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/network/tls": {
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetDatabaseTLS",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Database TLS",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/node": {
      "put": {
        "description": "Placement, the database counterpart to PUT /apps/{name}/node above: same AbilityRoot gating.\n\nRequires the `root` ability.",
        "operationId": "handleSetDatabaseNode",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Placement, the database counterpart to PUT /apps/{name}/node above: same AbilityRoot gating.",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/pitr": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDisablePITR",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Disable PITR",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPITRStatus",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get PITR Status",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Point-in-time restore (pitr.go): enabling/disabling PITR is AbilityWriteSensitive, the same tier creating a backup target or triggering an ordinary backup already uses; base backups are the physical counterpart of an ordinary backup, same tier again. Triggering an actual PITR restore is AbilityRoot, matching the ordinary restore route above for the identical reason: it overwrites a live database's actual data with no way back.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleEnablePITR",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Point-in-time restore (pitr.go): enabling/disabling PITR is AbilityWriteSensitive, the same tier creating a backup target or triggering an ordinary backup already uses; base backups are the physical counterpart of an ordinary backup, same tier again.",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/pitr-restore": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleTriggerPITRRestore",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Trigger PITR Restore",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/pitr-restores": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPITRRestoreHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List PITR Restore History",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/placement": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "GetPlacementGetapiv1databasesnameplacement",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Placement",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "SetPlacementPutapiv1databasesnameplacement",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Placement",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/project": {
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetDatabaseProject",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Database Project",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/databases/{name}/public-access": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleClearDatabasePublicAccess",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Clear Database Public Access",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      },
      "put": {
        "description": "Public/host-exposed access, per database (database_public_access.go): whether this database's container port is bound to a host port so an operator's own database GUI tool can connect directly. AbilityWriteSensitive for both PUT and DELETE, the same tier scheduled backups above already use: this changes real network exposure, the identical sensitivity class as where an unattended backup ends up. GET reuses handleGetDatabase's own existing AbilityRead response (databaseResource already carries publicly_accessible/public_port), the same \"no separate GET route\" reasoning the backup-schedule routes above already apply.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleSetDatabasePublicAccess",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Public/host-exposed access, per database (database_public_access.go): whether this database's container port is bound to a host port so an operator's own database GUI tool can connect directly.",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/query": {
      "post": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleDatabaseQuery",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Database Query",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/query-history": {
      "delete": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleClearDatabaseQueryHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Clear Database Query History",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      },
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListDatabaseQueryHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Database Query History",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/query/write": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDatabaseQueryWrite",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Database Query Write",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/resource-recommendation": {
      "get": {
        "description": "Resource right-sizing, the database counterpart to GET /apps/{name}/resource-recommendation above (database_resource_recommendation.go).\n\nRequires the `read` ability.",
        "operationId": "handleDatabaseResourceRecommendation",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Resource right-sizing, the database counterpart to GET /apps/{name}/resource-recommendation above (database_resource_recommendation.go).",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/resources": {
      "put": {
        "description": "Set (or clear, with a nil body field) a database's resource limits: databaseResource's own Resources field doc comment explains why this is a dedicated route rather than folded into handleUpdateApp's general-PUT equivalent, which has no database counterpart. AbilityWrite, the same ordinary-config-edit sensitivity as the project routes just above, not AbilityRoot: a resource cap is not fleet-level placement.\n\nRequires the `write` ability.",
        "operationId": "handleSetDatabaseResources",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set (or clear, with a nil body field) a database's resource limits: databaseResource's own Resources field doc comment explains why this is a dedicated route rather than folded into handleUpdateApp's general-PUT equivalent, which has no database counterpart.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/databases/{name}/restore": {
      "post": {
        "description": "Restore, per database (restore.go). AbilityRoot, not AbilityWriteSensitive: see handleTriggerRestore's own doc comment for why this, alone among every backup-related route, needs the same top tier as node management and placement. History listing is ordinary AbilityRead, the same boundary the backup history route above already draws.\n\nRequires the `root` ability.",
        "operationId": "handleTriggerRestore",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Restore, per database (restore.go).",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/restore-as-new": {
      "post": {
        "description": "Restore as a new database (database_clone_restore.go): the non-destructive counterpart just above, AbilityWriteSensitive rather than AbilityRoot, see handleCloneRestore's own doc comment for why this endpoint doesn't need the top tier the in-place restore route does. History listing is ordinary AbilityRead, the same boundary the in-place restore history route above draws.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleCloneRestore",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Restore as a new database (database_clone_restore.go): the non-destructive counterpart just above, AbilityWriteSensitive rather than AbilityRoot, see handleCloneRestore's own doc comment for why this endpoint doesn't need the top tier the in-place restore route does.",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/restores": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListRestoreHistory",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Restore History",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/saved-queries": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListDatabaseSavedQueries",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Database Saved Queries",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      },
      "post": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleSaveDatabaseQuery",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Save Database Query",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/saved-queries/{id}": {
      "delete": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleDeleteDatabaseSavedQuery",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Delete Database Saved Query",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/schema": {
      "get": {
        "description": "Database viewer: row data and SQL are sensitive, so reads are AbilityReadSensitive; the write console is AbilityRoot (admin only).\n\nRequires the `read:sensitive` ability.",
        "operationId": "handleGetDatabaseSchema",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Database viewer: row data and SQL are sensitive, so reads are AbilityReadSensitive; the write console is AbilityRoot (admin only).",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/slow-queries": {
      "get": {
        "description": "Slow query log, Postgres/MySQL only (database_slow_queries.go's own doc comment explains why Redis and every other engine return 400): parses the same stored container log lines the routes above expose, rather than a new telemetry source.\n\nRequires the `read` ability.",
        "operationId": "handleQueryDatabaseSlowQueries",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Slow query log, Postgres/MySQL only (database_slow_queries.go's own doc comment explains why Redis and every other engine return 400): parses the same stored container log lines the routes above expose, rather than a new telemetry source.",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/start": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleStartDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Start Database",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/status": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDatabaseStatus",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Database Status",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/stop": {
      "post": {
        "description": "Stop/start, per database (database_stop_start.go). AbilityWriteSensitive, same tier public-access above uses: taking a database offline (and, on start, back online) is real operational impact, not an ordinary desired-state edit.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleStopDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Stop/start, per database (database_stop_start.go).",
        "tags": [
          "Database Backups / Restore / Clone Restore"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/tables/{schema}/{table}/rows": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleGetDatabaseTableRows",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "schema",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "table",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Get Database Table Rows",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/tables/{schema}/{table}/structure": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleGetDatabaseTableStructure",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "schema",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "table",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Get Database Table Structure",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/databases/{name}/upgrade-now": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDatabaseUpgradeNow",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Database Upgrade Now",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/upgrade-policy": {
      "put": {
        "description": "Policy and upgrade-now restart the database, the same tier as PUT .../version.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handlePutDatabaseUpgradePolicy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Policy and upgrade-now restart the database, the same tier as PUT .../version.",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/databases/{name}/upgrades": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDatabaseUpgrades",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Database Upgrades",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/databases/{name}/users": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListDatabaseUsers",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Database Users",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "read:sensitive"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateDatabaseUser",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create Database User",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/users/{role}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteDatabaseUser",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "role",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete Database User",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/users/{role}/disable": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisableDatabaseUser",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "role",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disable Database User",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/users/{role}/enable": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleEnableDatabaseUser",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "role",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Enable Database User",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/users/{role}/rotate": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRotateDatabaseUser",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "role",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Rotate Database User",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/databases/{name}/version": {
      "put": {
        "description": "Minor and patch image change for a database, same data volume. AbilityWriteSensitive: it restarts the database container.\n\nRequires the `write:sensitive` ability.",
        "operationId": "handleSetDatabaseVersion",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Minor and patch image change for a database, same data volume.",
        "tags": [
          "Databases CRUD / Engines / Resources"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/deploy-approvals": {
      "get": {
        "description": "Deploy approvals (deploy_approvals.go): the real two-person gate behind a protected environment's confirm: true, replacing a same-actor confirm flag. List/get are AbilityRead; approve/reject are AbilityDeploy, the same tier the gated deploy/promote itself needs, plus loadDecidableApproval's own same-actor rejection.\n\nRequires the `read` ability.",
        "operationId": "handleListDeployApprovals",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Deploy approvals (deploy_approvals.go): the real two-person gate behind a protected environment's confirm: true, replacing a same-actor confirm flag.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/deploy-approvals/{id}": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDeployApproval",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Deploy Approval",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/deploy-approvals/{id}/approve": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleApproveDeployApproval",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Approve Deploy Approval",
        "tags": [
          "Other"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/deploy-approvals/{id}/reject": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleRejectDeployApproval",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Reject Deploy Approval",
        "tags": [
          "Other"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/deployments": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListDeployments",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Deployments",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/deployments/stream": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDeploymentsStream",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Deployments Stream",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/deployments/summary": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDeploymentsSummary",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Deployments Summary",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/deploys/failed": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListFailedDeploys",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Failed Deploys",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/dev-mode": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleDevMode",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Dev Mode",
        "tags": [
          "System"
        ]
      }
    },
    "/api/v1/dns/check": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDNSCheck",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "DNS Check",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/dns/health-checks": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListDNSHealthChecks",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List DNS Health Checks",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateDNSHealthCheck",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create DNS Health Check",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/dns/health-checks/{id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteDNSHealthCheck",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete DNS Health Check",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/dns/templates": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListDNSTemplates",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List DNS Templates",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/dns/zone": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDNSZone",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "DNS Zone",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/dns/zones": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListDNSZones",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List DNS Zones",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateDNSZone",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create DNS Zone",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/dns/zones/{zone}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteDNSZone",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete DNS Zone",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDNSZone",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get DNS Zone",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/dns/zones/{zone}/delegation": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDNSZoneDelegation",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "DNS Zone Delegation",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/dns/zones/{zone}/discover": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDiscoverDNSZoneRecords",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Discover DNS Zone Records",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/dns/zones/{zone}/nameservers": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDNSZoneNameServers",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "DNS Zone Name Servers",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/dns/zones/{zone}/records": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteDNSZoneRecord",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete DNS Zone Record",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListDNSZoneRecords",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List DNS Zone Records",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateDNSZoneRecord",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create DNS Zone Record",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateDNSZoneRecord",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update DNS Zone Record",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/dns/zones/{zone}/records/export": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleExportDNSZoneRecords",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Export DNS Zone Records",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/dns/zones/{zone}/records/import": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleImportDNSZoneRecords",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Import DNS Zone Records",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/dns/zones/{zone}/templates/{id}": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleApplyDNSTemplate",
        "parameters": [
          {
            "in": "path",
            "name": "zone",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Apply DNS Template",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/dockerhub/repositories/{namespace}/{repo}/tags": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDockerHubTags",
        "parameters": [
          {
            "in": "path",
            "name": "namespace",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "repo",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Docker Hub Tags",
        "tags": [
          "Built-in Container Registry"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/dockerhub/search": {
      "get": {
        "description": "Public Docker Hub search (dockerhub_search.go): the same picker's third source, for a well-known public image that isn't in the built-in registry or a connected credential. AbilityRead, same tier as the built-in catalog just above: a read of a public, unauthenticated upstream, proxied server-side only to avoid a browser-to-hub.docker.com CORS call.\n\nRequires the `read` ability.",
        "operationId": "handleDockerHubSearch",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Public Docker Hub search (dockerhub_search.go): the same picker's third source, for a well-known public image that isn't in the built-in registry or a connected credential.",
        "tags": [
          "Built-in Container Registry"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/domains": {
      "get": {
        "description": "Domains (centralized cross-app list, web/src/routes/domains): every service_domains row, AbilityRead like GET /api/v1/apps, no new ability tier: this is the same data DomainEditor already exposes per-app, aggregated across every app in one read-only call.\n\nRequires the `read` ability.",
        "operationId": "handleListDomains",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Domains (centralized cross-app list, web/src/routes/domains): every service_domains row, AbilityRead like GET /api/v1/apps, no new ability tier: this is the same data DomainEditor already exposes per-app, aggregated across every app in one read-only call.",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/domains/automation/runs": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAutomationRuns",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Automation Runs",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/domains/automation/runs/{id}/undo": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUndoAutomationRun",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Undo Automation Run",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/domains/{domain}/activity": {
      "get": {
        "description": "One domain's activity timeline: audit rows plus certificate failures, cursor paginated by ?before. Visible to callers who can see its app.\n\nRequires the `read` ability.",
        "operationId": "handleDomainActivity",
        "parameters": [
          {
            "in": "path",
            "name": "domain",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "One domain's activity timeline: audit rows plus certificate failures, cursor paginated by ?before.",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/environments": {
      "get": {
        "description": "Global typed environments (environments_global.go, environment_move.go), behind the global-environments experimental feature.\n\nRequires the `read` ability.",
        "operationId": "handleListAllEnvironments",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Global typed environments (environments_global.go, environment_move.go), behind the global-environments experimental feature.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateGlobalEnvironment",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Global Environment",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/environments/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteEnvironment",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Environment",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      },
      "patch": {
        "description": "Requires the `write` ability.",
        "operationId": "handleUpdateEnvironment",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Update Environment",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/environments/{id}/clone": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleEnvironmentClone",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Environment Clone",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/environments/{id}/clone/preview": {
      "get": {
        "description": "Clone environment (environment_clone.go): copy a whole environment's app set plus config into a brand-new environment, AbilityDeploy-gated like promote.go's own trigger route since it actually deploys real containers, not just database rows.\n\nRequires the `read` ability.",
        "operationId": "handleEnvironmentClonePreview",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Clone environment (environment_clone.go): copy a whole environment's app set plus config into a brand-new environment, AbilityDeploy-gated like promote.go's own trigger route since it actually deploys real containers, not just database rows.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/environments/{id}/env": {
      "get": {
        "description": "Shared env vars every service tagged with this environment inherits (environment_env.go): the tier between organizations/{id}/env and projects/{id}/env above and a service's own env below.\n\nRequires the `read` ability.",
        "operationId": "handleGetEnvironmentEnv",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Shared env vars every service tagged with this environment inherits (environment_env.go): the tier between organizations/{id}/env and projects/{id}/env above and a service's own env below.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetEnvironmentEnv",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Environment Env",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/environments/{id}/env/all": {
      "get": {
        "description": "Secret-backed shared env vars at the environment tier, mirroring the organization tier's own four routes above.\n\nRequires the `read` ability.",
        "operationId": "handleListEnvironmentEnvAll",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Secret-backed shared env vars at the environment tier, mirroring the organization tier's own four routes above.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/environments/{id}/env/secrets": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListEnvironmentEnvSecretKeys",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Environment Env Secret Keys",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/environments/{id}/env/secrets/{key}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteEnvironmentEnvSecret",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Environment Env Secret",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetEnvironmentEnvSecret",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Environment Env Secret",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/export": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIaCExport",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Ia C Export",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/export/destinations": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListExportDestinations",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List Export Destinations",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateExportDestination",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create Export Destination",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/export/destinations/{id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteExportDestination",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete Export Destination",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGetExportDestination",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Get Export Destination",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "patch": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateExportDestination",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Export Destination",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/export/destinations/{id}/test": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleTestExportDestination",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Test Export Destination",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/external-databases": {
      "get": {
        "description": "External databases: connected, never run, by this platform. Anything that dials out or reveals a credential is admin only.\n\nRequires the `read` ability.",
        "operationId": "handleListExternalDatabases",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "External databases: connected, never run, by this platform.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateExternalDatabase",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create External Database",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/external-databases/adopt": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleAdoptExternalDatabase",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Adopt External Database",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/external-databases/candidates": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListExternalDatabaseCandidates",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List External Database Candidates",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/external-databases/test": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleTestExternalDatabase",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Test External Database",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/external-databases/{name}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteExternalDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete External Database",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetExternalDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get External Database",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateExternalDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update External Database",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/external-databases/{name}/password": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRevealExternalDatabasePassword",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Reveal External Database Password",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/external-databases/{name}/probe": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleProbeExternalDatabase",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Probe External Database",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/firewall-rules": {
      "get": {
        "description": "Firewall rules (firewall_rules.go): declarative host firewall rules internal/reconcile/firewall converges onto ufw. AbilityWriteSensitive for create/delete, same tier as a backup target: a rule here changes what inbound traffic this host accepts. List is ordinary AbilityRead.\n\nRequires the `read` ability.",
        "operationId": "handleListFirewallRules",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Firewall rules (firewall_rules.go): declarative host firewall rules internal/reconcile/firewall converges onto ufw.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCreateFirewallRule",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Create Firewall Rule",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/firewall-rules/{id}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteFirewallRule",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete Firewall Rule",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/firewall/exposure": {
      "get": {
        "description": "Exposure audit (exposure.go): read-only list of published container ports and how reachable each is; preview is a pure computation. Restricting and unrestricting change the host's DOCKER-USER chain, so they are AbilityRoot like the ufw switch above.\n\nRequires the `read` ability.",
        "operationId": "handleExposureReport",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Exposure audit (exposure.go): read-only list of published container ports and how reachable each is; preview is a pure computation.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/firewall/exposure/preview": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleExposurePreview",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Exposure Preview",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/firewall/exposure/restrictions/{protocol}/{port}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleExposureUnrestrict",
        "parameters": [
          {
            "in": "path",
            "name": "protocol",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "port",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Exposure Unrestrict",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleExposureRestrict",
        "parameters": [
          {
            "in": "path",
            "name": "protocol",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "port",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Exposure Restrict",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/firewall/host": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleHostFirewallStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Host Firewall Status",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/firewall/host/disable": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisableHostFirewall",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disable Host Firewall",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/firewall/host/enable": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleEnableHostFirewall",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Enable Host Firewall",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/flags/evaluate/{key}": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleEvaluateFeatureFlag",
        "parameters": [
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Evaluate Feature Flag",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/git-providers": {
      "get": {
        "description": "Aggregated git provider capability summary (git_providers.go): one AbilityReadSensitive call the git-source picker uses instead of the three AbilityRoot status endpoints below, so a non-root deploy-scoped user can open the app creation wizard without hitting a 403. See handleListGitProviders's own doc comment.\n\nRequires the `read:sensitive` ability.",
        "operationId": "handleListGitProviders",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Aggregated git provider capability summary (git_providers.go): one AbilityReadSensitive call the git-source picker uses instead of the three AbilityRoot status endpoints below, so a non-root deploy-scoped user can open the app creation wizard without hitting a 403.",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/git/branches": {
      "post": {
        "description": "Branch listing for an arbitrary public git remote (handleListGitBranches's own doc comment): not scoped to an existing app, since the create-app- from-git wizard needs this before an app exists to attach a build to. AbilityDeploy, the same tier the build trigger above requires: listing what a repo could be built from is a strict subset of actually triggering that build.\n\nRequires the `deploy` ability.",
        "operationId": "handleListGitBranches",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Branch listing for an arbitrary public git remote (handleListGitBranches's own doc comment): not scoped to an existing app, since the create-app- from-git wizard needs this before an app exists to attach a build to.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/gitea-app": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisconnectGiteaApp",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disconnect Gitea App",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Gitea App: the OAuth-Application counterpart of the GitLab App routes above, same ability tiers and self-hosted instance_url shape (Gitea is almost always self-hosted). Repos are addressed by an \"owner/repo\" path pair like Bitbucket's workspace/repoSlug, not a numeric id like GitLab's.\n\nRequires the `root` ability.",
        "operationId": "handleGetGiteaAppStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Gitea App: the OAuth-Application counterpart of the GitLab App routes above, same ability tiers and self-hosted instance_url shape (Gitea is almost always self-hosted).",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleConnectGiteaApp",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Connect Gitea App",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/gitea-app/callback": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGiteaAppCallback",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Gitea App Callback",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/gitea-app/connect": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleStartGiteaAppConnect",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Start Gitea App Connect",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/gitea-app/repos": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListGiteaAppRepos",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Gitea App Repos",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/gitea-app/repos/{owner}/{repo}/branches": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListGiteaAppBranches",
        "parameters": [
          {
            "in": "path",
            "name": "owner",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "repo",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Gitea App Branches",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/gitea-app/repos/{owner}/{repo}/use-as-source": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleUseGiteaRepoAsSource",
        "parameters": [
          {
            "in": "path",
            "name": "owner",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "repo",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Use Gitea Repo As Source",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/github-app": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisconnectGitHubApp",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disconnect Git Hub App",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "GitHub App connection: the manifest-based registration flow, installation, and repo/branch browsing through it (internal/api/github_app.go, github_app_register.go, github_app_repos.go). Every route that reads or mutates the connection itself (status, register/start, callback, installed, disconnect) is AbilityRoot, matching PUT /api/v1/settings/ingress's own precedent above rather than the plain AbilityRead most other GET routes use: this is platform-wide configuration with a real external-account relationship behind it (an installed GitHub App can read a private repository's contents), the same \"real infrastructure, high blast radius\" class ingress settings and node placement already reserve this tier for, not an ordinary per-app read. register/start, callback, and installed are all real, full-page browser navigations (GitHub's manifest flow is inherently that, not a fetch call), not XHR/fetch calls: a session cookie is implicitly AbilityRoot (requireAbility's own doc comment), so the operator's own logged-in browser satisfies this gate the same way it satisfies every other AbilityRoot route.  Repo and branch listing are the one exception, at AbilityReadSensitive: see handleListGitHubAppRepos's own doc comment for why reading already-connected repo/branch names is a materially different (lower) risk class than changing the connection itself. use-as-source is AbilityWriteSensitive, matching PUT .../git-source's own tier and GitLab/Bitbucket's own use-as-source routes below: it performs that exact action.\n\nRequires the `root` ability.",
        "operationId": "handleGetGitHubAppStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "GitHub App connection: the manifest-based registration flow, installation, and repo/branch browsing through it (internal/api/github_app.go, github_app_register.go, github_app_repos.go).",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/github-app/callback": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGitHubAppCallback",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Git Hub App Callback",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/github-app/installations": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListGitHubAppInstallations",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List Git Hub App Installations",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/github-app/installations/{id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteGitHubAppInstallation",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete Git Hub App Installation",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/github-app/installed": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGitHubAppInstalled",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Git Hub App Installed",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/github-app/manual": {
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleConnectGitHubAppManually",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Connect Git Hub App Manually",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/github-app/register/preview": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGetGitHubAppManifestPreview",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Get Git Hub App Manifest Preview",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/github-app/register/start": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleStartGitHubAppRegistration",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Start Git Hub App Registration",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/github-app/repos": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListGitHubAppRepos",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Git Hub App Repos",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/github-app/repos/{owner}/{repo}/branches": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListGitHubAppBranches",
        "parameters": [
          {
            "in": "path",
            "name": "owner",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "repo",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Git Hub App Branches",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/github-app/repos/{owner}/{repo}/use-as-source": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleUseGitHubRepoAsSource",
        "parameters": [
          {
            "in": "path",
            "name": "owner",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "repo",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Use Git Hub Repo As Source",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/gitlab-app": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisconnectGitLabApp",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disconnect Git Lab App",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "GitLab App: the OAuth-Application counterpart of the GitHub App routes above, same ability tiers for the same reasons. connect and callback are real, full-page browser navigations (GitLab's OAuth2 authorization endpoint requires that), not fetch calls. use-as-source is AbilityWriteSensitive, matching PUT .../git-source's own tier: it performs that exact action.\n\nRequires the `root` ability.",
        "operationId": "handleGetGitLabAppStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "GitLab App: the OAuth-Application counterpart of the GitHub App routes above, same ability tiers for the same reasons.",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleConnectGitLabApp",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Connect Git Lab App",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/gitlab-app/callback": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGitLabAppCallback",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Git Lab App Callback",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/gitlab-app/connect": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleStartGitLabAppConnect",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Start Git Lab App Connect",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/gitlab-app/projects": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListGitLabAppProjects",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Git Lab App Projects",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/gitlab-app/projects/{id}/branches": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListGitLabAppBranches",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Git Lab App Branches",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/gitlab-app/projects/{id}/use-as-source": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleUseGitLabProjectAsSource",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Use Git Lab Project As Source",
        "tags": [
          "Git Provider Apps"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/gpus": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListGPUNodes",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List GPU Nodes",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/hooks/image-update/{name}/{token}": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleImageUpdateWebhook",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "token",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Image Update Webhook",
        "tags": [
          "Other"
        ]
      }
    },
    "/api/v1/hooks/wake": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleWakeHook",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Wake Hook",
        "tags": [
          "Other"
        ]
      }
    },
    "/api/v1/iam/analyze": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIAMAnalyze",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "IAM Analyze",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/catalog": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIAMCatalog",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "IAM Catalog",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/policies": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPolicies",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Policies",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "IAM policies (iam.go/iam_handlers.go): resource-scoped Allow/Deny documents attached to a user or token, additive on top of the flat Abilities list above. Reading the catalog is AbilityRead like roles above; every mutation (create/update/delete/attach/detach) is AbilityRoot, the same tier as handleUpdateUserAbilities, since a policy can grant or deny access at a resource-scoped level a non-root caller could not otherwise touch.\n\nRequires the `root` ability.",
        "operationId": "handleCreatePolicy",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "IAM policies (iam.go/iam_handlers.go): resource-scoped Allow/Deny documents attached to a user or token, additive on top of the flat Abilities list above.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/iam/policies/validate": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handleValidatePolicy",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Validate Policy",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/policies/{id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeletePolicy",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete Policy",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Policy",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdatePolicy",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Policy",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/iam/policies/{id}/attachments": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPolicyAttachments",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Policy Attachments",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleAttachPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Attach Policy",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/iam/policies/{id}/attachments/{principal_type}/{principal_id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDetachPolicy",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "principal_type",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "principal_id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Detach Policy",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/iam/policies/{id}/versions": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPolicyVersions",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Policy Versions",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/policy-templates": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListPolicyTemplates",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Policy Templates",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/policy-templates/{id}/apply": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleApplyPolicyTemplate",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Apply Policy Template",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/iam/policy-templates/{id}/render": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handleRenderPolicyTemplate",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Render Policy Template",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/preview": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIAMPreview",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "IAM Preview",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/principals": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIAMPrincipals",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "IAM Principals",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/principals/{principal_type}/{principal_id}/effective": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIAMEffective",
        "parameters": [
          {
            "in": "path",
            "name": "principal_type",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "principal_id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "IAM Effective",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/resources": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIAMResources",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "IAM Resources",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/resources/match": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIAMMatch",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "IAM Match",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/iam/simulate": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIAMSimulate",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "IAM Simulate",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/imports/plan": {
      "post": {
        "description": "Import front door: classifies pasted input and returns a plan preview, creating nothing. AbilityWrite because it makes outbound fetches.\n\nRequires the `write` ability.",
        "operationId": "handleImportPlan",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Import front door: classifies pasted input and returns a plan preview, creating nothing.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/imports/platform/apply": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleApplyPlatformImport",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Apply Platform Import",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/imports/platform/databases": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListDatabaseDataCopies",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Database Data Copies",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/imports/platform/databases/{name}": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDatabaseDataCopy",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Database Data Copy",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/imports/platform/databases/{name}/copy": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCopyDatabaseData",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Copy Database Data",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/imports/platform/discover": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDiscoverPlatformImport",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Discover Platform Import",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/ingress/connectivity": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleIngressConnectivity",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Ingress Connectivity",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/integrations": {
      "get": {
        "description": "Integrations (app_integrations.go): the curated internal/integrations catalog (PostHog, Sentry, etc), env-var injection only. The catalog itself is global and read-only (AbilityRead, no store involved, same shape service-templates uses); attach/detach store a field value through the app's own secrets namespace, AbilityWriteSensitive like PUT .../secrets/{key} above.\n\nRequires the `read` ability.",
        "operationId": "handleListIntegrationCatalog",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Integrations (app_integrations.go): the curated internal/integrations catalog (PostHog, Sentry, etc), env-var injection only.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/invites": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListInvites",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Invites",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Team invites (invites.go): unlike POST /api/v1/auth/users above, create/revoke are AbilityWrite, not AbilityRoot: handleCreateInvite itself caps the abilities an invite can carry at the caller's own resolved abilities, so a write-level caller can never hand out more than they hold, closing off the escalation risk without needing a root gate. Revoke additionally requires the caller be either root or the invite's own creator (handleRevokeInvite). Listing stays AbilityRead, same tier as the user list, but scopes non-root callers to invites they created (handleListInvites). Accept is necessarily public, gated by possession of the emailed token instead of a session or ability, the same shape as reset-password below.\n\nRequires the `write` ability.",
        "operationId": "handleCreateInvite",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Team invites (invites.go): unlike POST /api/v1/auth/users above, create/revoke are AbilityWrite, not AbilityRoot: handleCreateInvite itself caps the abilities an invite can carry at the caller's own resolved abilities, so a write-level caller can never hand out more than they hold, closing off the escalation risk without needing a root gate.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/invites/accept": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleAcceptInvite",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Accept Invite",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/invites/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleRevokeInvite",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Revoke Invite",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/loadbalancers": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListLoadBalancers",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Load Balancers",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/log-archive/dump": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleLogArchiveDump",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Log Archive Dump",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/log-archive/objects": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListLogArchiveObjects",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Log Archive Objects",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/log-archive/objects/download": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleDownloadLogArchiveObject",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Download Log Archive Object",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/log-archive/policies": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListLogArchivePolicies",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Log Archive Policies",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/log-archive/policy": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteLogArchivePolicy",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Log Archive Policy",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetLogArchivePolicy",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Log Archive Policy",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/log-archive/runs": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListLogArchiveRuns",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Log Archive Runs",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/mesh": {
      "get": {
        "description": "Mesh status and key rotation, same AbilityRoot boundary: WireGuard peer/handshake data and a node's own key material are fleet infrastructure, not app-scoped, matching every other node route above.\n\nRequires the `root` ability.",
        "operationId": "handleGetMeshStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Mesh status and key rotation, same AbilityRoot boundary: WireGuard peer/handshake data and a node's own key material are fleet infrastructure, not app-scoped, matching every other node route above.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/mesh/connectivity": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleMeshConnectivity",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Mesh Connectivity",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/migration/apps/plan": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleAppImportPlan",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "App Import Plan",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAppImportSessions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List App Import Sessions",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCreateAppImportSession",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Create App Import Session",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteAppImportSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete App Import Session",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetAppImportSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get App Import Session",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/connect": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleConnectAppImportSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Connect App Import Session",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/cutover": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAppImportCutover",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "App Import Cutover",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/cutover/verify": {
      "get": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleAppImportCutoverVerify",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "App Import Cutover Verify",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/images": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAppImportImages",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "App Import Images",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/images/cancel": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCancelAppImportImages",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Cancel App Import Images",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/images/status": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAppImportImagesStatus",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "App Import Images Status",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/images/transfer": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleTransferAppImportImages",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Transfer App Import Images",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/items/{item}/cutover/plan": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAppImportCutoverPlan",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "App Import Cutover Plan",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/items/{item}/cutover/runs": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAppImportCutoverRuns",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List App Import Cutover Runs",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleStartAppImportCutover",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Start App Import Cutover",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/items/{item}/cutover/runs/{run}": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetAppImportCutoverRun",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "run",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get App Import Cutover Run",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/items/{item}/cutover/runs/{run}/confirm-dns": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleConfirmAppImportCutoverDNS",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "run",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Confirm App Import Cutover DNS",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/items/{item}/cutover/runs/{run}/rollback": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleRollbackAppImportCutover",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "run",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Rollback App Import Cutover",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/items/{item}/route": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleRouteAppImport",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Route App Import",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/items/{item}/volumes/{vol}": {
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetAppImportVolume",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "item",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "vol",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set App Import Volume",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/plan": {
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handlePutAppImportPlan",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Put App Import Plan",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/receipt": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAppImportReceipt",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "App Import Receipt",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/rollback": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleRollbackAppImport",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Rollback App Import",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/stage": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleStageAppImport",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Stage App Import",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/verify": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleVerifyAppImport",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Verify App Import",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/apps/sessions/{id}/volumes": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleAppImportVolumes",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "App Import Volumes",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/cutover": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleCutoverReport",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Cutover Report",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/cutover/verify": {
      "get": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCutoverVerify",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Cutover Verify",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/hub/local-sources": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleHubLocalSources",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Hub Local Sources",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/hub/sessions": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListHubSessions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Hub Sessions",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCreateHubSession",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Create Hub Session",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/hub/sessions/{id}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteHubSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete Hub Session",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetHubSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Hub Session",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/hub/sessions/{id}/apply": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleApplyHubSession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Apply Hub Session",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/hub/sessions/{id}/items/{db}/connection": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleHubConnection",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "db",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Hub Connection",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/hub/sessions/{id}/items/{db}/reveal": {
      "post": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleHubReveal",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "db",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Hub Reveal",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/migration/hub/sessions/{id}/receipt": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleHubReceipt",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Hub Receipt",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/migration/hub/sessions/{id}/selection": {
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handlePutHubSelection",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Put Hub Selection",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/hub/sessions/{id}/step": {
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handlePutHubStep",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Put Hub Step",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/migration/volumes": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleVolumeGuide",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Volume Guide",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/model-cache": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListModelCache",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Model Cache",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/model-cache/prune": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handlePruneModelCache",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Prune Model Cache",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/models": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListModels",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Models",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCreateModel",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Create Model",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/models/fit": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handleModelFitCheck",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Model Fit Check",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/models/preflight": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handleModelPreflight",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Model Preflight",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/models/{name}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteModel",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Model",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetModel",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Model",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/models/{name}/api-key": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleRotateModelAPIKey",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Rotate Model API Key",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/models/{name}/engine-metrics": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleModelEngineMetrics",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Model Engine Metrics",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/models/{name}/fit": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleModelFit",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Model Fit",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/models/{name}/hf-token": {
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleSetModelHFToken",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Set Model HF Token",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/models/{name}/keys": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListModelKeys",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Model Keys",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCreateModelKey",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Create Model Key",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/models/{name}/keys/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleRevokeModelKey",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Revoke Model Key",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/models/{name}/keys/{id}/rotate": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleRotateModelKey",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Rotate Model Key",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/models/{name}/logs": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleQueryModelLogs",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Query Model Logs",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/models/{name}/logs/stream": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleLiveModelLogStream",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Live Model Log Stream",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/models/{name}/residency": {
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetModelResidency",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Model Residency",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/models/{name}/restart": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleRestartModel",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Restart Model",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/models/{name}/sleep": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSleepModel",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Sleep Model",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/models/{name}/swap-group": {
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetModelSwapGroup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Model Swap Group",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/models/{name}/usage": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleModelUsage",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Model Usage",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/models/{name}/wake": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleWakeModel",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Wake Model",
        "tags": [
          "AI Models / GPUs"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/network-shares": {
      "get": {
        "description": "Network shares (network_shares.go): an NFS/CIFS export mountable as a Docker local-driver volume. Same ability tiers as registry credentials just above: POST/PUT/DELETE handle a live CIFS password, test is a read-only reachability dial.\n\nRequires the `read` ability.",
        "operationId": "handleListNetworkShares",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Network shares (network_shares.go): an NFS/CIFS export mountable as a Docker local-driver volume.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCreateNetworkShare",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Create Network Share",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/network-shares/{id}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteNetworkShare",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete Network Share",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetNetworkShare",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Network Share",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleUpdateNetworkShare",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Update Network Share",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/network-shares/{id}/test": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handleTestNetworkShare",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Test Network Share",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/network/proxy": {
      "get": {
        "description": "Proxy/traffic: per-domain reachability (CrossNodeIngress, see doctor_cross_node_ingress.go) plus TLS status, joined for the Traffic/Proxy dashboard page. Same AbilityRead boundary as topology above, same reasoning: read-only, no key material.\n\nRequires the `read` ability.",
        "operationId": "handleGetNetworkProxy",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Proxy/traffic: per-domain reachability (CrossNodeIngress, see doctor_cross_node_ingress.go) plus TLS status, joined for the Traffic/Proxy dashboard page.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/network/topology": {
      "get": {
        "description": "Network topology: a read-only, whole-mesh summary (nodes, apps, databases, load balancers, app-to-database connections). Unlike every other node/mesh route above, AbilityRead rather than AbilityRoot: it exposes no key material, no join tokens, and no mutation, just the same placement/DNS-name facts already visible piecemeal across GET /apps, /databases and /nodes.\n\nRequires the `read` ability.",
        "operationId": "handleGetNetworkTopology",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Network topology: a read-only, whole-mesh summary (nodes, apps, databases, load balancers, app-to-database connections).",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/node-drains/{id}": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGetNodeDrain",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Get Node Drain",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/node-moves": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListNodeMoves",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List Node Moves",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/node-moves/{id}": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGetNodeMove",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Get Node Move",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/node-providers": {
      "get": {
        "description": "Cloud node provisioning: same AbilityRoot boundary as every other node route above, a provider credential and the ability to spin up a VM are at least as sensitive as a join token.\n\nRequires the `root` ability.",
        "operationId": "handleListNodeProviders",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Cloud node provisioning: same AbilityRoot boundary as every other node route above, a provider credential and the ability to spin up a VM are at least as sensitive as a join token.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetNodeProviderCredential",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Node Provider Credential",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/node-providers/{provider}/regions": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListNodeProviderRegions",
        "parameters": [
          {
            "in": "path",
            "name": "provider",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List Node Provider Regions",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/node-providers/{provider}/sizes": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListNodeProviderSizes",
        "parameters": [
          {
            "in": "path",
            "name": "provider",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List Node Provider Sizes",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/node-provisions": {
      "get": {
        "description": "A top-level sibling of /api/v1/nodes/{id}/..., not nested under it: \"/api/v1/nodes/provisions/{id}\" and \"/api/v1/nodes/{id}/health\" would be two equally-specific wildcard patterns net/http's own ServeMux refuses to register together.\n\nRequires the `root` ability.",
        "operationId": "handleListNodeProvisions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "A top-level sibling of /api/v1/nodes/{id}/..., not nested under it: \"/api/v1/nodes/provisions/{id}\" and \"/api/v1/nodes/{id}/health\" would be two equally-specific wildcard patterns net/http's own ServeMux refuses to register together.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/node-provisions/{id}": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGetNodeProvision",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Get Node Provision",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes": {
      "get": {
        "description": "Nodes: fleet-level infrastructure, not scoped to any one app, so every route here requires AbilityRoot specifically rather than AbilityRead/AbilityWrite: minting a join token or removing a node is a materially more sensitive operation than editing one app's config, the same reasoning secrets.go's AbilityWriteSensitive already applies one level down at the per-app layer.\n\nRequires the `root` ability.",
        "operationId": "handleListNodes",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Nodes: fleet-level infrastructure, not scoped to any one app, so every route here requires AbilityRoot specifically rather than AbilityRead/AbilityWrite: minting a join token or removing a node is a materially more sensitive operation than editing one app's config, the same reasoning secrets.go's AbilityWriteSensitive already applies one level down at the per-app layer.",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/join-tokens": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateNodeJoinToken",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create Node Join Token",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/provision": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateNodeProvision",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create Node Provision",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/resource-usage": {
      "get": {
        "description": "Fleet-wide latest CPU/memory/disk snapshot plus rollup (node_resource_usage.go), the node-scoped counterpart to GET /apps/resource-usage above: registered as a literal path segment under /nodes/, which Go's net/http mux matches ahead of the /nodes/{id} wildcard above regardless of registration order, the same precedent apps/resource-usage already relies on.\n\nRequires the `root` ability.",
        "operationId": "handleFleetResourceUsage",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Fleet-wide latest CPU/memory/disk snapshot plus rollup (node_resource_usage.go), the node-scoped counterpart to GET /apps/resource-usage above: registered as a literal path segment under /nodes/, which Go's net/http mux matches ahead of the /nodes/{id} wildcard above regardless of registration order, the same precedent apps/resource-usage already relies on.",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/ssh-provision": {
      "post": {
        "description": "SSH-based node provisioning: adopts a machine the operator already has instead of creating one at a cloud provider, same AbilityRoot boundary as every other node route above (an SSH credential is at least as sensitive as a join token or a provider credential). The create route has no path wildcard, so it can live under /api/v1/nodes/ like /api/v1/nodes/provision does; the show route needs a wildcard {id} and so, like /api/v1/node-provisions/{id} above, must be a top-level sibling rather than nested under /api/v1/nodes/{id}/...: \"/api/v1/nodes/ssh-provisions/{id}\" would conflict with \"/api/v1/nodes/{id}/health\" the exact way that comment already explains for the cloud path.\n\nRequires the `root` ability.",
        "operationId": "handleCreateSSHNodeProvision",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "SSH-based node provisioning: adopts a machine the operator already has instead of creating one at a cloud provider, same AbilityRoot boundary as every other node route above (an SSH credential is at least as sensitive as a join token or a provider credential).",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteNode",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete Node",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGetNode",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Get Node",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/capacity-forecast": {
      "get": {
        "description": "Rough disk/memory exhaustion projection (node_capacity_forecast.go), a read-and-suggest layer over the same host samples patch-status/metrics above read, same AbilityRoot boundary and nil-telemetry 501 shape as every other node route.\n\nRequires the `root` ability.",
        "operationId": "handleNodeCapacityForecast",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Rough disk/memory exhaustion projection (node_capacity_forecast.go), a read-and-suggest layer over the same host samples patch-status/metrics above read, same AbilityRoot boundary and nil-telemetry 501 shape as every other node route.",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/cordon": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCordonNode",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Cordon Node",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/drain": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDrainNode",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Drain Node",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/drains": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListNodeDrains",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List Node Drains",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/events": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListNodeEvents",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List Node Events",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/health": {
      "get": {
        "description": "Health, cordon, drain, same AbilityRoot boundary as every other node route above.\n\nRequires the `root` ability.",
        "operationId": "handleGetNodeHealth",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Health, cordon, drain, same AbilityRoot boundary as every other node route above.",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/labels": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGetNodeLabels",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Get Node Labels",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetNodeLabels",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Node Labels",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/mesh/rejoin": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRejoinNodeMesh",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Rejoin Node Mesh",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/mesh/rotate-key": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRotateNodeMeshKey",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Rotate Node Mesh Key",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/metrics": {
      "get": {
        "description": "Node-level metrics (sum of per-container samples for everything placed on this node, see handleQueryNodeMetrics's own doc comment for exactly what that does and doesn't mean): same AbilityRoot boundary and nil-telemetry 501 shape as every route above, and the same query-param contract as GET /apps/{name}/metrics above it.\n\nRequires the `root` ability.",
        "operationId": "handleQueryNodeMetrics",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Node-level metrics (sum of per-container samples for everything placed on this node, see handleQueryNodeMetrics's own doc comment for exactly what that does and doesn't mean): same AbilityRoot boundary and nil-telemetry 501 shape as every route above, and the same query-param contract as GET /apps/{name}/metrics above it.",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/patch-status": {
      "get": {
        "description": "Latest OS-patch reading (internal/telemetry/hostpatch.go's HostPatchCollector), a single current fact rather than a time series, same AbilityRoot boundary as every other node route.\n\nRequires the `root` ability.",
        "operationId": "handleGetNodePatchStatus",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Latest OS-patch reading (internal/telemetry/hostpatch.go's HostPatchCollector), a single current fact rather than a time series, same AbilityRoot boundary as every other node route.",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/reenroll-token": {
      "post": {
        "description": "Agent certificate lifecycle (node_cert.go, ADR 021).\n\nRequires the `root` ability.",
        "operationId": "handleCreateNodeReenrollToken",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Agent certificate lifecycle (node_cert.go, ADR 021).",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/region": {
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetNodeRegion",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Node Region",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/revoke-cert": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRevokeNodeCert",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Revoke Node Cert",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/uncordon": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUncordonNode",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Uncordon Node",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/nodes/{id}/workloads": {
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetNodeWorkloads",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set Node Workloads",
        "tags": [
          "Nodes"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/notification-channels": {
      "get": {
        "description": "Notification channels: the global, connect-once destination the deploy-notify-target routes above attach to by channel_id. AbilityWrite, same tier as deploy-notify-targets' own POST.\n\nRequires the `read` ability.",
        "operationId": "handleListNotificationChannels",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Notification channels: the global, connect-once destination the deploy-notify-target routes above attach to by channel_id.",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateNotificationChannel",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Notification Channel",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/notification-channels/test": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleTestNotificationChannel",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Test Notification Channel",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/notification-channels/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteNotificationChannel",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Notification Channel",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleUpdateNotificationChannel",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Update Notification Channel",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/notification-channels/{id}/deliveries": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListNotificationDeliveries",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Notification Deliveries",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/notification-channels/{id}/test": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleTestExistingNotificationChannel",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Test Existing Notification Channel",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/onboarding": {
      "get": {
        "description": "Setup wizard state. Completing stays AbilityWrite so creating a first app any other way can dismiss it; step progress is admin-only.\n\nRequires the `read` ability.",
        "operationId": "handleGetOnboardingState",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Setup wizard state.",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/onboarding/complete": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCompleteOnboarding",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Complete Onboarding",
        "tags": [
          "System"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/onboarding/progress": {
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateOnboardingProgress",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Onboarding Progress",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/openapi.json": {
      "get": {
        "description": "Route metadata for the in-app API explorer (web/src/routes/settings/api-explorer.tsx): AbilityRead, same tier as system/status, since this is the API surface's own shape, not resource data.\n\nRequires the `read` ability.",
        "operationId": "handleOpenAPISpec",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Route metadata for the in-app API explorer (web/src/routes/settings/api-explorer.tsx): AbilityRead, same tier as system/status, since this is the API surface's own shape, not resource data.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/organizations": {
      "get": {
        "description": "Organizations (organizations.go): groups projects, same ordinary AbilityRead/AbilityWrite boundary as projects above.\n\nRequires the `read` ability.",
        "operationId": "handleListOrganizations",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Organizations (organizations.go): groups projects, same ordinary AbilityRead/AbilityWrite boundary as projects above.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateOrganization",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Organization",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/organizations/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteOrganization",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Organization",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetOrganization",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Organization",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/organizations/{id}/env": {
      "get": {
        "description": "Shared env vars every project filed under this organization inherits (organization_env.go), the base layer beneath projects/{id}/env below.\n\nRequires the `read` ability.",
        "operationId": "handleGetOrganizationEnv",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Shared env vars every project filed under this organization inherits (organization_env.go), the base layer beneath projects/{id}/env below.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetOrganizationEnv",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Organization Env",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/organizations/{id}/env/all": {
      "get": {
        "description": "Secret-backed shared env vars at the organization tier (shared_env_secrets.go/organization_env.go): the encrypted counterpart to the plain-value GET/PUT above, reusing internal/secrets.Manager (Router.secrets) for the actual encryption.\n\nRequires the `read` ability.",
        "operationId": "handleListOrganizationEnvAll",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Secret-backed shared env vars at the organization tier (shared_env_secrets.go/organization_env.go): the encrypted counterpart to the plain-value GET/PUT above, reusing internal/secrets.Manager (Router.secrets) for the actual encryption.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/organizations/{id}/env/secrets": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListOrganizationEnvSecretKeys",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Organization Env Secret Keys",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/organizations/{id}/env/secrets/{key}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteOrganizationEnvSecret",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Organization Env Secret",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetOrganizationEnvSecret",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Organization Env Secret",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/pipeline-runs": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAllPipelineRuns",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List All Pipeline Runs",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/pipelines/filters": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handlePipelineFilters",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Pipeline Filters",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/pipelines/oidc": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPipelineOIDCInfo",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Pipeline OIDC Info",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/pipelines/oidc/rotate-key": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRotatePipelineOIDCKey",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Rotate Pipeline OIDC Key",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/pipelines/schema": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handlePipelineSchema",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Pipeline Schema",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/pipelines/summary": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetPipelineSummary",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Pipeline Summary",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/pipelines/validate": {
      "post": {
        "description": "Requires the `read` ability.",
        "operationId": "handleValidatePipeline",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Validate Pipeline",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/preflight": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handlePreflightNew",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Preflight New",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/previews": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAllPreviews",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List All Previews",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/previews/sweep": {
      "post": {
        "description": "Preview environment TTL sweep (preview_environments_sweep.go): the fallback for a pull-request-closed webhook delivery that never arrived, cross-app since staleness is a control-plane-wide sweep, not a per-app one. Same manual-trigger-alongside-the-automatic-path shape as POST .../previews/{number}/teardown above, same AbilityDeploy tier.\n\nRequires the `deploy` ability.",
        "operationId": "handleSweepPreviewEnvironments",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Preview environment TTL sweep (preview_environments_sweep.go): the fallback for a pull-request-closed webhook delivery that never arrived, cross-app since staleness is a control-plane-wide sweep, not a per-app one.",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/projects": {
      "get": {
        "description": "Projects (projects.go): a lightweight, non-auth organizational grouping, explicitly not the deferred Phase 4 teams/RBAC work (see that file's own package doc comment). AbilityRead/AbilityWrite, the same ordinary boundary apps/databases CRUD already uses, not AbilityRoot: unlike a node (real infrastructure), creating or deleting a project has no fleet-level consequence.\n\nRequires the `read` ability.",
        "operationId": "handleListProjects",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Projects (projects.go): a lightweight, non-auth organizational grouping, explicitly not the deferred Phase 4 teams/RBAC work (see that file's own package doc comment).",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateProject",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Project",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/projects/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteProject",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Project",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetProject",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Project",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/projects/{id}/env": {
      "get": {
        "description": "Shared env vars every app filed under this project inherits (project_env.go): same AbilityRead/AbilityWrite boundary as the project CRUD routes just above.\n\nRequires the `read` ability.",
        "operationId": "handleGetProjectEnv",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Shared env vars every app filed under this project inherits (project_env.go): same AbilityRead/AbilityWrite boundary as the project CRUD routes just above.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetProjectEnv",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Project Env",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/projects/{id}/env/all": {
      "get": {
        "description": "Secret-backed shared env vars at the project tier, mirroring the organization/environment tiers' own four routes above.\n\nRequires the `read` ability.",
        "operationId": "handleListProjectEnvAll",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Secret-backed shared env vars at the project tier, mirroring the organization/environment tiers' own four routes above.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/projects/{id}/env/secrets": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListProjectEnvSecretKeys",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Project Env Secret Keys",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/projects/{id}/env/secrets/{key}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteProjectEnvSecret",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Project Env Secret",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetProjectEnvSecret",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "key",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Project Env Secret",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/projects/{id}/environments": {
      "get": {
        "description": "Environments (environments.go): staging/production-style labels scoped to a project, tagged onto a service via its own app route.\n\nRequires the `read` ability.",
        "operationId": "handleListEnvironments",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Environments (environments.go): staging/production-style labels scoped to a project, tagged onto a service via its own app route.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateEnvironment",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Environment",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/projects/{id}/environments/compare": {
      "get": {
        "description": "Cross-environment env var drift check (environment_compare.go): resolved effective env vars for two of this project's environments, secret values always redacted.\n\nRequires the `read` ability.",
        "operationId": "handleCompareEnvironmentEnv",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Cross-environment env var drift check (environment_compare.go): resolved effective env vars for two of this project's environments, secret values always redacted.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/projects/{id}/organization": {
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetProjectOrganization",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Project Organization",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/projects/{id}/restart": {
      "post": {
        "description": "Bulk restart every app filed under this project (project_restart.go): AbilityDeploy, the same ability POST /api/v1/apps/{name}/restart itself uses, not AbilityWrite, since this triggers a real container recreation rather than an ordinary label edit.\n\nRequires the `deploy` ability.",
        "operationId": "handleRestartProject",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Bulk restart every app filed under this project (project_restart.go): AbilityDeploy, the same ability POST /api/v1/apps/{name}/restart itself uses, not AbilityWrite, since this triggers a real container recreation rather than an ordinary label edit.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/projects/{id}/start": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleStartProject",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Start Project",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/projects/{id}/stop": {
      "post": {
        "description": "Stop/start (handleStopProject/handleStartProject's own doc comments): same AbilityDeploy tier as the per-app POST /api/v1/apps/{name}/stop and .../start routes, the same class of lifecycle action, applied to every app and database in the project at once.\n\nRequires the `deploy` ability.",
        "operationId": "handleStopProject",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Stop/start (handleStopProject/handleStartProject's own doc comments): same AbilityDeploy tier as the per-app POST /api/v1/apps/{name}/stop and .../start routes, the same class of lifecycle action, applied to every app and database in the project at once.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/projects/{id}/topology": {
      "get": {
        "description": "Topology (topology.go): a read-only diagram-ready graph derived from this project's existing desired state, AbilityRead like the project read itself above, not a new server-side list filter (see this file's own package doc comment on why apps/databases stay client-filtered elsewhere): a graph's nodes and edges aren't a list page.\n\nRequires the `read` ability.",
        "operationId": "handleGetProjectTopology",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Topology (topology.go): a read-only diagram-ready graph derived from this project's existing desired state, AbilityRead like the project read itself above, not a new server-side list filter (see this file's own package doc comment on why apps/databases stay client-filtered elsewhere): a graph's nodes and edges aren't a list page.",
        "tags": [
          "Projects / Organizations / Environments"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/prometheus/read": {
      "post": {
        "description": "Prometheus remote read. Gated by requireAbility the same as every other read route, not left open: leaving a metrics endpoint unauthenticated would let any caller pull every service's resource usage. Prometheus's own remote_read config supports bearer-token auth (authorization.credentials), which is exactly an API token scoped to at least \"read\" (see the token management routes above); requireAbility already accepts one the same way it does for every JSON route, this isn't a special case.\n\nRequires the `read` ability.",
        "operationId": "handlePrometheusRead",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Prometheus remote read.",
        "tags": [
          "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/registry-credentials": {
      "get": {
        "description": "Registry credentials (registry_credentials.go): same ability tiers as backup targets just above, same reasoning (POST/PUT/DELETE handle live pull credentials).\n\nRequires the `read` ability.",
        "operationId": "handleListRegistryCredentials",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Registry credentials (registry_credentials.go): same ability tiers as backup targets just above, same reasoning (POST/PUT/DELETE handle live pull credentials).",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCreateRegistryCredential",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Create Registry Credential",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/registry-credentials/{id}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteRegistryCredential",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete Registry Credential",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetRegistryCredential",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Registry Credential",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleUpdateRegistryCredential",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Update Registry Credential",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/registry-credentials/{id}/repositories": {
      "get": {
        "description": "Registry credential browsing (registry_catalog.go): repository/tag lookup for a stored external credential, the same generic catalog client GET /api/v1/registry/repositories and /api/v1/registry/tags use above for the built-in registry. AbilityReadSensitive, the same tier GET /api/v1/git-providers and the github-app/gitlab-app/ bitbucket-app repo-browsing routes below use: read-only, but only works because a stored credential's secret is resolved server-side.\n\nRequires the `read:sensitive` ability.",
        "operationId": "handleListRegistryCredentialRepositories",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "Registry credential browsing (registry_catalog.go): repository/tag lookup for a stored external credential, the same generic catalog client GET /api/v1/registry/repositories and /api/v1/registry/tags use above for the built-in registry.",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/registry-credentials/{id}/tags": {
      "get": {
        "description": "Requires the `read:sensitive` ability.",
        "operationId": "handleListRegistryCredentialTags",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read:sensitive"
            ]
          }
        ],
        "summary": "List Registry Credential Tags",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "read:sensitive"
      }
    },
    "/api/v1/registry-credentials/{id}/test": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleTestRegistryCredential",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Test Registry Credential",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/registry/repositories": {
      "get": {
        "description": "Built-in registry catalog (registry_catalog.go): read-only browsing for the app-creation \"existing image\" step's repository/tag picker. AbilityRead, same tier as the settings GET just above: no secret is ever returned, the resolved password is only used server-side to authenticate the upstream catalog query.\n\nRequires the `read` ability.",
        "operationId": "handleListRegistryRepositories",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Built-in registry catalog (registry_catalog.go): read-only browsing for the app-creation \"existing image\" step's repository/tag picker.",
        "tags": [
          "Built-in Container Registry"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/registry/tags": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListRegistryTags",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Registry Tags",
        "tags": [
          "Built-in Container Registry"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/roles": {
      "get": {
        "description": "Curated role presets (roles.go): static, non-sensitive metadata, AbilityRead like the user list itself, so any signed-in caller can populate a role picker even without AbilityRoot.\n\nRequires the `read` ability.",
        "operationId": "handleListRoles",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Curated role presets (roles.go): static, non-sensitive metadata, AbilityRead like the user list itself, so any signed-in caller can populate a role picker even without AbilityRoot.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Stored roles, role assignment and environment grants: root, and the handlers answer the experimental-disabled error while access-roles is off.\n\nRequires the `root` ability.",
        "operationId": "handleCreateRole",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Stored roles, role assignment and environment grants: root, and the handlers answer the experimental-disabled error while access-roles is off.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/roles/{id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteRole",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete Role",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateRole",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Role",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/security/account": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleGetAccountSecurity",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Get Account Security",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      },
      "put": {
        "description": "No authentication required.",
        "operationId": "handlePutAccountSecurity",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Put Account Security",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/security/policy": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetSecurityPolicy",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Security Policy",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handlePutSecurityPolicy",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Put Security Policy",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/security/posture": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleSecurityPosture",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Security Posture",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/security/sessions": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleListSecuritySessions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "List Security Sessions",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/security/sessions/revoke-others": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleRevokeOtherSecuritySessions",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Revoke Other Security Sessions",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/security/sessions/{id}": {
      "delete": {
        "description": "No authentication required.",
        "operationId": "handleRevokeSecuritySession",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Revoke Security Session",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ]
      }
    },
    "/api/v1/service-templates": {
      "get": {
        "description": "Service template catalog (service_templates.go, ADR 015): read-only, static, served straight from internal/catalog.Templates, no store involved. AbilityRead like every other passive view.\n\nRequires the `read` ability.",
        "operationId": "handleListServiceTemplates",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Service template catalog (service_templates.go, ADR 015): read-only, static, served straight from internal/catalog.Templates, no store involved.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/service-templates/{id}": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetServiceTemplate",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Service Template",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/service-templates/{id}/deploy": {
      "post": {
        "description": "One-click template deploy (handleDeployServiceTemplateNow): not scoped to an existing app (the app doesn't exist until this request creates it), same \"no resource to scope to yet\" shape as POST /api/v1/git/branches and POST /api/v1/build/detect below. AbilityDeploy, matching POST /api/v1/apps/{name}/compose above, since deployComposeBody is the same create-and-deploy core.\n\nRequires the `deploy` ability.",
        "operationId": "handleDeployServiceTemplateNow",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "One-click template deploy (handleDeployServiceTemplateNow): not scoped to an existing app (the app doesn't exist until this request creates it), same \"no resource to scope to yet\" shape as POST /api/v1/git/branches and POST /api/v1/build/detect below.",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/service-templates/{id}/install": {
      "post": {
        "description": "Requires the `deploy` ability.",
        "operationId": "handleInstallServiceTemplate",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "deploy"
            ]
          }
        ],
        "summary": "Install Service Template",
        "tags": [
          "Apps CRUD / Lifecycle / Deploy"
        ],
        "x-required-ability": "deploy"
      }
    },
    "/api/v1/settings/ai-assistant": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteAIAssistantSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete AI Assistant Settings",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "BYOK AI assistant settings (ai_settings.go): GET is AbilityRead; PUT/DELETE are AbilityRoot, the same tier PUT /api/v1/settings/ email uses for any other platform-wide credential-bearing config.\n\nRequires the `read` ability.",
        "operationId": "handleGetAIAssistantSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "BYOK AI assistant settings (ai_settings.go): GET is AbilityRead; PUT/DELETE are AbilityRoot, the same tier PUT /api/v1/settings/ email uses for any other platform-wide credential-bearing config.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateAIAssistantSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update AI Assistant Settings",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/ai-control": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetAIControl",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get AI Control",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateAIControl",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update AI Control",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/ai-control/revoke-agent-tokens": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRevokeAgentTokens",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Revoke Agent Tokens",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/auth/code-login": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetCodeLoginSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Code Login Settings",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handlePutCodeLoginSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Put Code Login Settings",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/cloudflare-dns": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisconnectCloudflareDNS",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disconnect Cloudflare DNS",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetCloudflareDNSSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Cloudflare DNS Settings",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateCloudflareDNSSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Cloudflare DNS Settings",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/cloudflare-tunnel": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisconnectCloudflareTunnel",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disconnect Cloudflare Tunnel",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Cloudflare Tunnel (instance-level, one connection per control plane): GET is AbilityRead; PUT/DELETE are AbilityRoot, matching PUT /api/v1/settings/email's own tier for infrastructure config that changes how this control plane is reachable.\n\nRequires the `read` ability.",
        "operationId": "handleGetCloudflareTunnelSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Cloudflare Tunnel (instance-level, one connection per control plane): GET is AbilityRead; PUT/DELETE are AbilityRoot, matching PUT /api/v1/settings/email's own tier for infrastructure config that changes how this control plane is reachable.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateCloudflareTunnelSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Cloudflare Tunnel Settings",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/dashboard-url": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDashboardURL",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Dashboard URL",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateDashboardURL",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Dashboard URL",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/database-upgrades": {
      "get": {
        "description": "The platform default reaches every database, so writing it is root-only.\n\nRequires the `read` ability.",
        "operationId": "handleGetPlatformUpgradePolicy",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "The platform default reaches every database, so writing it is root-only.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handlePutPlatformUpgradePolicy",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Put Platform Upgrade Policy",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/deploy-freeze": {
      "get": {
        "description": "OAuth settings: GET is AbilityRead, PUT is AbilityRoot, matching /api/v1/settings/ingress's own tiers. Global deploy freeze windows apply to every app, so writing them is root-only.\n\nRequires the `read` ability.",
        "operationId": "handleGetGlobalDeployFreeze",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "OAuth settings: GET is AbilityRead, PUT is AbilityRoot, matching /api/v1/settings/ingress's own tiers.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handlePutGlobalDeployFreeze",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Put Global Deploy Freeze",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/domain-automation": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetDomainAutomation",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Domain Automation",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateDomainAutomation",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Domain Automation",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/email": {
      "get": {
        "description": "Email settings: same precedent as ingress settings just above. GET is AbilityRead; PUT is AbilityRoot, real infrastructure config.\n\nRequires the `read` ability.",
        "operationId": "handleGetEmailSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Email settings: same precedent as ingress settings just above.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateEmailSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Email Settings",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/email/test": {
      "post": {
        "description": "AbilityWrite, not AbilityRoot: same tier notification-channel testing uses, since sending a test doesn't change stored config.\n\nRequires the `write` ability.",
        "operationId": "handleTestEmail",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "AbilityWrite, not AbilityRoot: same tier notification-channel testing uses, since sending a test doesn't change stored config.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/settings/ingress": {
      "get": {
        "description": "Ingress settings (ACME toggle, platform primary domain, ADR 005's own \"Verified\" section names this exact gap: real ACME issuance was explicitly unproven, spot-checked against a real domain, not assumed to follow automatically). GET is AbilityRead, the same passive-visibility tier as GET /api/v1/certificates above: reading today's toggle state is ordinary operator visibility. PUT is AbilityRoot, matching handleSetAppNode/handleDrainNode/POST /system/prune's own precedent for \"real infrastructure, high blast radius, not an ordinary per-app write\": flipping acme_enabled changes what every currently-routed host's certificate automation does, fleet-wide, on the very next ingress reconcile pass, the same class of change node placement and draining already reserve AbilityRoot for.\n\nRequires the `read` ability.",
        "operationId": "handleGetIngressSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Ingress settings (ACME toggle, platform primary domain, ADR 005's own \"Verified\" section names this exact gap: real ACME issuance was explicitly unproven, spot-checked against a real domain, not assumed to follow automatically).",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateIngressSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Ingress Settings",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/ingress/apps-base-domain/backfill": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleBackfillBaseDomain",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Backfill Base Domain",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/ingress/check": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCheckIngressDomain",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Check Ingress Domain",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/ingress/https": {
      "get": {
        "description": "Platform-level DNS check (ingress_settings.go): runDomainCheck against the platform's own PrimaryDomain instead of a per-app one. AbilityRoot, matching PUT /api/v1/settings/ingress just above: the result speaks directly to whether that endpoint's ACMEEnabled toggle can actually succeed.\n\nRequires the `read` ability.",
        "operationId": "handleGetHTTPSStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Platform-level DNS check (ingress_settings.go): runDomainCheck against the platform's own PrimaryDomain instead of a per-app one.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleEnableHTTPS",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Enable HTTPS",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/oauth": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListOAuthSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List O Auth Settings",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/settings/oauth/{provider}": {
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateOAuthProviderSettings",
        "parameters": [
          {
            "in": "path",
            "name": "provider",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update O Auth Provider Settings",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/observability": {
      "get": {
        "description": "Observability settings: the external Grafana/dashboard link, same precedent as email settings just above. GET is AbilityRead; PUT is AbilityRoot, matching every other instance-level config row.\n\nRequires the `read` ability.",
        "operationId": "handleGetObservabilitySettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Observability settings: the external Grafana/dashboard link, same precedent as email settings just above.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateObservabilitySettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Observability Settings",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/proxy-integration": {
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateProxyIntegrationSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Proxy Integration Settings",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/push-subscriptions": {
      "get": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleListPushSubscriptions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "List Push Subscriptions",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      },
      "post": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleCreatePushSubscription",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Create Push Subscription",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/settings/push-subscriptions/vapid-public-key": {
      "get": {
        "description": "Browser push notification subscriptions (push_subscriptions.go): one admin account's registered browsers, the delivery target for the \"webpush\" notification-channel kind. Self-service like passkeys above, so requireAuth not requireAbility.\n\nRequires a signed-in dashboard session.",
        "operationId": "handleGetPushVAPIDPublicKey",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Browser push notification subscriptions (push_subscriptions.go): one admin account's registered browsers, the delivery target for the \"webpush\" notification-channel kind.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/settings/push-subscriptions/{id}": {
      "delete": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handleDeletePushSubscription",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Delete Push Subscription",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/settings/registry": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisableRegistry",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disable Registry",
        "tags": [
          "Built-in Container Registry"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Built-in container registry (instance-level, one registry per control plane): GET is AbilityRead; PUT/DELETE are AbilityRoot, matching PUT /api/v1/settings/cloudflare-tunnel's own tier for infrastructure config that runs a system container and generates credentials.\n\nRequires the `read` ability.",
        "operationId": "handleGetRegistrySettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Built-in container registry (instance-level, one registry per control plane): GET is AbilityRead; PUT/DELETE are AbilityRoot, matching PUT /api/v1/settings/cloudflare-tunnel's own tier for infrastructure config that runs a system container and generates credentials.",
        "tags": [
          "Built-in Container Registry"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateRegistrySettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Registry Settings",
        "tags": [
          "Built-in Container Registry"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/route53-dns": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisconnectRoute53DNS",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disconnect Route53DNS",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "Route53 DNS-01: a second, independent ACME DNS-01 provider, same tier as cloudflare-dns above.\n\nRequires the `read` ability.",
        "operationId": "handleGetRoute53DNSSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Route53 DNS-01: a second, independent ACME DNS-01 provider, same tier as cloudflare-dns above.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateRoute53DNSSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Route53DNS Settings",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/settings/vault": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDisconnectVault",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Disconnect Vault",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      },
      "get": {
        "description": "External HashiCorp Vault (instance-level, one connection per control plane): same GET AbilityRead / PUT+DELETE AbilityRoot tier as Cloudflare Tunnel above.\n\nRequires the `read` ability.",
        "operationId": "handleGetVaultSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "External HashiCorp Vault (instance-level, one connection per control plane): same GET AbilityRead / PUT+DELETE AbilityRoot tier as Cloudflare Tunnel above.",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateVaultSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Vault Settings",
        "tags": [
          "Ingress / Certificates / Domains / Email / Cloudflare"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/ssh-node-provisions": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListSSHNodeProvisions",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List SSH Node Provisions",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/ssh-node-provisions/{id}": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGetSSHNodeProvision",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Get SSH Node Provision",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/static-sites": {
      "get": {
        "description": "Static sites (build.type: static): read-only dashboard visibility for sites served directly by embedded Caddy with no container, closing the gap flagged when static-site support (migration 0015) first landed. AbilityRead, the same passive-visibility boundary as handleListCertificates above: no create/update/delete route exists yet because the backend has no mutation path for a static site beyond internal/deploy.Pipeline's own git-push-triggered write.\n\nRequires the `read` ability.",
        "operationId": "handleListStaticSites",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Static sites (build.type: static): read-only dashboard visibility for sites served directly by embedded Caddy with no container, closing the gap flagged when static-site support (migration 0015) first landed.",
        "tags": [
          "Static Sites / Backup Targets / Registry Credentials"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/status-page": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetStatusPage",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Status Page",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handlePutStatusPage",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Put Status Page",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/status-page/components": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListStatusComponents",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Status Components",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateStatusComponent",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Status Component",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/status-page/components/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteStatusComponent",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Status Component",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleUpdateStatusComponent",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Update Status Component",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/status-page/incidents": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListStatusIncidents",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Status Incidents",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateStatusIncident",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Status Incident",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/status-page/incidents/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteStatusIncident",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Status Incident",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/status-page/incidents/{id}/updates": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handlePostStatusIncidentUpdate",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Post Status Incident Update",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/status-page/preview": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleStatusPagePreview",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Status Page Preview",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/storage-env-keys": {
      "get": {
        "description": "Read-only, not scoped to any one app: the static list of env var names attaching storage can inject, backed by application.StorageEnvKeys rather than a hardcoded list, see handleListStorageEnvKeys' own doc comment.\n\nRequires the `read` ability.",
        "operationId": "handleListStorageEnvKeys",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Read-only, not scoped to any one app: the static list of env var names attaching storage can inject, backed by application.StorageEnvKeys rather than a hardcoded list, see handleListStorageEnvKeys' own doc comment.",
        "tags": [
          "App Storage / Database Attach"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/storage/destinations": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListStorageDestinations",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Storage Destinations",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleCreateStorageDestination",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Create Storage Destination",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/storage/destinations/{id}": {
      "delete": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleDeleteStorageDestination",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Delete Storage Destination",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetStorageDestination",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Storage Destination",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleUpdateStorageDestination",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Update Storage Destination",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/storage/destinations/{id}/test": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleTestStorageDestination",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Test Storage Destination",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/storage/providers": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListStorageProviders",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Storage Providers",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/backups": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleListControlPlaneBackups",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "List Control Plane Backups",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      },
      "post": {
        "description": "Control plane self-backups hold every stored secret ciphertext and token hash, so every verb is AbilityRoot, including the read ones.\n\nRequires the `root` ability.",
        "operationId": "handleCreateControlPlaneBackup",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Control plane self-backups hold every stored secret ciphertext and token hash, so every verb is AbilityRoot, including the read ones.",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/backups/{name}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteControlPlaneBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete Control Plane Backup",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/backups/{name}/download": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDownloadControlPlaneBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Download Control Plane Backup",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/backups/{name}/verify": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleVerifyControlPlaneBackup",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Verify Control Plane Backup",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/containers": {
      "get": {
        "description": "Every container on this node, Levelrail-managed or not (containers.go's own doc comment on why a Managed one stays read-only here), AbilityRead like system/status above.\n\nRequires the `read` ability.",
        "operationId": "handleListContainers",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Every container on this node, Levelrail-managed or not (containers.go's own doc comment on why a Managed one stays read-only here), AbilityRead like system/status above.",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/containers/{name}/claim": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleClaimOrphanedContainer",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Claim Orphaned Container",
        "tags": [
          "System"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/system/containers/{name}/remove": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRemoveOrphanedContainer",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Remove Orphaned Container",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/containers/{name}/stop": {
      "post": {
        "description": "Orphaned containers only (containers_orphaned.go's requireOrphanedContainer re-confirms this server-side on every call, never trusting the client). Stop/remove are raw docker-level mutations fleet-wide, not scoped to one app's own desired state: AbilityRoot, the same tier system/prune and orphaned volume cleanup already sit behind. Claim creates an ordinary app through the same path POST /api/v1/apps itself uses, so it stays AbilityWrite, that route's own tier.\n\nRequires the `root` ability.",
        "operationId": "handleStopOrphanedContainer",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Orphaned containers only (containers_orphaned.go's requireOrphanedContainer re-confirms this server-side on every call, never trusting the client).",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/control-plane-dr": {
      "get": {
        "description": "Off-box encrypted control plane backups, restore drills and escrow (control_plane_dr.go). Status reads are AbilityRead and carry public recipients only. Changing the destination or recipients is AbilityWriteSensitive; building an escrow bundle touches the master key, so it is AbilityRoot. Restore stays an offline CLI action.\n\nRequires the `read` ability.",
        "operationId": "handleGetControlPlaneDR",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Off-box encrypted control plane backups, restore drills and escrow (control_plane_dr.go).",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/control-plane-dr/backups": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListControlPlaneDRBackups",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Control Plane DR Backups",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/control-plane-dr/drill": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleRunControlPlaneDRDrill",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Run Control Plane DR Drill",
        "tags": [
          "System"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/system/control-plane-dr/escrow": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleControlPlaneDREscrow",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Control Plane DR Escrow",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/control-plane-dr/escrow/ack": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleAckControlPlaneDREscrow",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Ack Control Plane DR Escrow",
        "tags": [
          "System"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/system/control-plane-dr/run": {
      "post": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleRunControlPlaneDRBackup",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Run Control Plane DR Backup",
        "tags": [
          "System"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/system/control-plane-dr/settings": {
      "put": {
        "description": "Requires the `write:sensitive` ability.",
        "operationId": "handleUpdateControlPlaneDR",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write:sensitive"
            ]
          }
        ],
        "summary": "Update Control Plane DR",
        "tags": [
          "System"
        ],
        "x-required-ability": "write:sensitive"
      }
    },
    "/api/v1/system/docker-guard": {
      "get": {
        "description": "Docker API guard status (Security settings page): AbilityRead like system/doctor.\n\nRequires the `read` ability.",
        "operationId": "handleGetDockerGuard",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Docker API guard status (Security settings page): AbilityRead like system/doctor.",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      },
      "put": {
        "description": "Switching modes changes the host-protection boundary, so AbilityRoot.\n\nRequires the `root` ability.",
        "operationId": "handleUpdateDockerGuard",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Switching modes changes the host-protection boundary, so AbilityRoot.",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/doctor": {
      "get": {
        "description": "Doctor (levelrail-cli doctor): a superset preflight bundle of the same individual checks above, plus a few doctor-only ones (data dir writability, ingress port availability, SQLite reachability), AbilityRead like system/status above.\n\nRequires the `read` ability.",
        "operationId": "handleSystemDoctor",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Doctor (levelrail-cli doctor): a superset preflight bundle of the same individual checks above, plus a few doctor-only ones (data dir writability, ingress port availability, SQLite reachability), AbilityRead like system/status above.",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/geoip": {
      "get": {
        "description": "Active country sources and a test lookup for one address.\n\nRequires the `read` ability.",
        "operationId": "handleGeoIPLookup",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Active country sources and a test lookup for one address.",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/master-key/rotate": {
      "post": {
        "description": "Master key rotation re-wraps every stored DEK live: AbilityRoot, the same fleet-wide-blast-radius tier as prune above, not AbilityWrite (SecretSetter's own gate for a single app's values).\n\nRequires the `root` ability.",
        "operationId": "handleRotateMasterKey",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Master key rotation re-wraps every stored DEK live: AbilityRoot, the same fleet-wide-blast-radius tier as prune above, not AbilityWrite (SecretSetter's own gate for a single app's values).",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/orphans": {
      "get": {
        "description": "Orphaned named volumes: detection is a read (AbilityRead), the cleanup that actually deletes one is the same AbilityRoot, fleet-wide, no-undo tier system/prune sits behind, not AbilityWrite.\n\nRequires the `read` ability.",
        "operationId": "handleListOrphans",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Orphaned named volumes: detection is a read (AbilityRead), the cleanup that actually deletes one is the same AbilityRoot, fleet-wide, no-undo tier system/prune sits behind, not AbilityWrite.",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/orphans/reap": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleReapOrphans",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Reap Orphans",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/proxy-integration": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetProxyIntegration",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Proxy Integration",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/proxy-integration/apply": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleApplyProxyIntegration",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Apply Proxy Integration",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/proxy-integration/setup": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetupProxyIntegration",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Setup Proxy Integration",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/proxy-integration/verify": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleVerifyProxyIntegration",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Verify Proxy Integration",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/prune": {
      "post": {
        "description": "POST /system/prune deletes real Docker resources (stopped containers, dangling images, anonymous volumes, unused build cache) fleet-wide, not scoped to one app: AbilityRoot, the same gate handleDrainNode uses for its own fleet-wide, no-undo action, not AbilityWrite (which a narrower, single-app token could hold).\n\nRequires the `root` ability.",
        "operationId": "handleSystemPrune",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "POST /system/prune deletes real Docker resources (stopped containers, dangling images, anonymous volumes, unused build cache) fleet-wide, not scoped to one app: AbilityRoot, the same gate handleDrainNode uses for its own fleet-wide, no-undo action, not AbilityWrite (which a narrower, single-app token could hold).",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/readiness": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleServerReadiness",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Server Readiness",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/reverse-proxy": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleReverseProxyGuide",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Reverse Proxy Guide",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/secrets/binding": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetSecretBinding",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Secret Binding",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/secrets/rebind": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRebindSecrets",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Rebind Secrets",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/system/status": {
      "get": {
        "description": "System status (General settings page): configured/not-configured signals plus disk usage, AbilityRead like everything else an authenticated operator can passively view.\n\nRequires the `read` ability.",
        "operationId": "handleSystemStatus",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "System status (General settings page): configured/not-configured signals plus disk usage, AbilityRead like everything else an authenticated operator can passively view.",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/volumes/orphaned": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListOrphanedVolumes",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Orphaned Volumes",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/system/volumes/orphaned/cleanup": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCleanupOrphanedVolumes",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Cleanup Orphaned Volumes",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/tags": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListTags",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Tags",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Tags (tags.go): arbitrary operator-defined labels for organizing and filtering apps, independent of the project/environment hierarchy. The global collection lives flat under /api/v1/tags (create/list/delete, plus filter-by-tag); attach/detach is scoped under the app it applies to, the same nesting scheduled-tasks/flags above use for their own per-app child resources.\n\nRequires the `write` ability.",
        "operationId": "handleCreateTag",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Tags (tags.go): arbitrary operator-defined labels for organizing and filtering apps, independent of the project/environment hierarchy.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/tags/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteTag",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Tag",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/tags/{id}/apps": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListAppsByTag",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Apps By Tag",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/team-invites/accept": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleAcceptTeamInvite",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Accept Team Invite",
        "tags": [
          "Other"
        ]
      }
    },
    "/api/v1/team-invites/{token}": {
      "get": {
        "description": "Requires a signed-in dashboard session.",
        "operationId": "handlePreviewTeamInvite",
        "parameters": [
          {
            "in": "path",
            "name": "token",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Not signed in."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "sessionAuth": []
          }
        ],
        "summary": "Preview Team Invite",
        "tags": [
          "Other"
        ],
        "x-required-ability": "session"
      }
    },
    "/api/v1/teams": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListTeams",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Teams",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleCreateTeam",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Create Team",
        "tags": [
          "Other"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/teams/roles": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListTeamRoles",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Team Roles",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/teams/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteTeam",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Team",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      },
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleGetTeam",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Get Team",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "patch": {
        "description": "Requires the `write` ability.",
        "operationId": "handleRenameTeam",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Rename Team",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/teams/{id}/events": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListTeamEvents",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Team Events",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/teams/{id}/invites": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListTeamInvites",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Team Invites",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      },
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleCreateTeamInvite",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Create Team Invite",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/teams/{id}/invites/{invite}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleRevokeTeamInvite",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "invite",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Revoke Team Invite",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/teams/{id}/members": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListTeamMembers",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Team Members",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/teams/{id}/members/me": {
      "delete": {
        "description": "Read tier: it only ever removes the caller's own membership.\n\nRequires the `read` ability.",
        "operationId": "handleLeaveTeam",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Read tier: it only ever removes the caller's own membership.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/teams/{id}/members/{user}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleRemoveTeamMember",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "user",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Remove Team Member",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      },
      "put": {
        "description": "Requires the `write` ability.",
        "operationId": "handleSetTeamMemberRole",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "path",
            "name": "user",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Set Team Member Role",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/teams/{id}/transfer": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleTransferTeam",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Transfer Team",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/templates/custom": {
      "get": {
        "description": "Custom templates (service_templates_custom.go): operator-defined templates captured from a running app. Deploy reuses the service-templates/{id}/deploy route above, no second deploy path.\n\nRequires the `read` ability.",
        "operationId": "handleListCustomTemplates",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Custom templates (service_templates_custom.go): operator-defined templates captured from a running app.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/templates/custom/{id}": {
      "delete": {
        "description": "Requires the `write` ability.",
        "operationId": "handleDeleteCustomTemplate",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Delete Custom Template",
        "tags": [
          "Other"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/traffic/summary": {
      "get": {
        "description": "Counts for the sidebar attention badge and the domains health strip, from stored state and the last known DNS checks only.\n\nRequires the `read` ability.",
        "operationId": "handleTrafficSummary",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Counts for the sidebar attention badge and the domains health strip, from stored state and the last known DNS checks only.",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/updates": {
      "get": {
        "description": "Updates (Settings \u003e Updates page): running version vs. GitHub's latest published release, AbilityRead like system/status above.\n\nRequires the `read` ability.",
        "operationId": "handleGetUpdates",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Updates (Settings \u003e Updates page): running version vs.",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/updates/history": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleUpgradeHistory",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Upgrade History",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/updates/history/{id}/ack": {
      "post": {
        "description": "Requires the `write` ability.",
        "operationId": "handleAckUpgrade",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "write"
            ]
          }
        ],
        "summary": "Ack Upgrade",
        "tags": [
          "System"
        ],
        "x-required-ability": "write"
      }
    },
    "/api/v1/updates/preflight": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleUpdatePreflight",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Update Preflight",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/updates/releases": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleReleaseHistory",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Release History",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/updates/rollback-plan": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleRollbackPlan",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Rollback Plan",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/updates/self-upgrade": {
      "post": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSelfUpgradeStart",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Self Upgrade Start",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/updates/self-upgrade/attempts": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleSelfUpgradeAttempts",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Self Upgrade Attempts",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/updates/self-upgrade/plan": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleSelfUpgradePlan",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Self Upgrade Plan",
        "tags": [
          "System"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/updates/settings": {
      "get": {
        "description": "Channel/auto-update settings are AbilityRoot on both verbs: see handleGetUpdateSettings' own doc comment (updates_settings.go).\n\nRequires the `root` ability.",
        "operationId": "handleGetUpdateSettings",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Channel/auto-update settings are AbilityRoot on both verbs: see handleGetUpdateSettings' own doc comment (updates_settings.go).",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleUpdateSettings",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Update Settings",
        "tags": [
          "System"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/usage/summary": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleUsageSummary",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Usage Summary",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/users": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleListUsers",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "List Users",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "read"
      }
    },
    "/api/v1/users/{id}": {
      "delete": {
        "description": "Requires the `root` ability.",
        "operationId": "handleDeleteUser",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Delete User",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/users/{id}/abilities": {
      "put": {
        "description": "PUT .../abilities is AbilityRoot like the delete route above, and refuses self-edits inside the handler (self-lockout guard): a root caller may change any other user's abilities, never their own.\n\nRequires the `root` ability.",
        "operationId": "handleUpdateUserAbilities",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "PUT .../abilities is AbilityRoot like the delete route above, and refuses self-edits inside the handler (self-lockout guard): a root caller may change any other user's abilities, never their own.",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/users/{id}/environment-grants": {
      "get": {
        "description": "Requires the `root` ability.",
        "operationId": "handleGetEnvironmentGrants",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Get Environment Grants",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      },
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handlePutEnvironmentGrants",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Put Environment Grants",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/users/{id}/role": {
      "put": {
        "description": "Requires the `root` ability.",
        "operationId": "handleSetUserRole",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "root"
            ]
          }
        ],
        "summary": "Set User Role",
        "tags": [
          "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
        ],
        "x-required-ability": "root"
      }
    },
    "/api/v1/webhooks/discord/interactions": {
      "post": {
        "description": "No authentication required.",
        "operationId": "handleDiscordInteraction",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Discord Interaction",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ]
      }
    },
    "/api/v1/webhooks/github/{name}": {
      "post": {
        "description": "Git push webhook (git_webhook.go), the per-app-URL evolution of the original static POST /webhook (still mounted separately by cmd/levelrail/main.go for the single-app, env-var-configured path). Deliberately unauthenticated, like that route: GitHub cannot present a session or API token, so this is not wrapped in requireAbility. Its own per-app HMAC signature check (the secret generated at connect time, PUT .../git-source above) is what stands in for auth here, the same trust boundary internal/webhook.Handler's own doc comment establishes for the single-app path.\n\nNo authentication required.",
        "operationId": "handleGitPushWebhook",
        "parameters": [
          {
            "in": "path",
            "name": "name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Git push webhook (git_webhook.go), the per-app-URL evolution of the original static POST /webhook (still mounted separately by cmd/levelrail/main.go for the single-app, env-var-configured path).",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ]
      }
    },
    "/api/v1/webhooks/slack/interactions": {
      "post": {
        "description": "Chat-interactive deploy approval (chat_interactions.go): a Slack/Discord button click posts back here, unauthenticated like POST .../webhooks/github/{name} above; its own signature check (Slack HMAC, Discord Ed25519) stands in for auth, and the decision itself runs through the exact same functions the gated routes above call.\n\nNo authentication required.",
        "operationId": "handleSlackInteraction",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "additionalProperties": true,
                "type": "object"
              }
            }
          },
          "required": false
        },
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Chat-interactive deploy approval (chat_interactions.go): a Slack/Discord button click posts back here, unauthenticated like POST .../webhooks/github/{name} above; its own signature check (Slack HMAC, Discord Ed25519) stands in for auth, and the decision itself runs through the exact same functions the gated routes above call.",
        "tags": [
          "Secrets / Git Source / Webhooks / Preview Environments"
        ]
      }
    },
    "/healthz": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleHealthz",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Healthz",
        "tags": [
          "System"
        ]
      }
    },
    "/metrics": {
      "get": {
        "description": "Requires the `read` ability.",
        "operationId": "handleScrapeMetrics",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "401": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Missing or invalid credentials."
          },
          "403": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "The token lacks the required ability."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [
          {
            "bearerAuth": [
              "read"
            ]
          }
        ],
        "summary": "Scrape Metrics",
        "tags": [
          "Other"
        ],
        "x-required-ability": "read"
      }
    },
    "/public/status": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handlePublicStatusHTML",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Public Status HTML",
        "tags": [
          "Other"
        ]
      }
    },
    "/public/status.json": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handlePublicStatusJSON",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Public Status JSON",
        "tags": [
          "Other"
        ]
      }
    },
    "/public/status.rss": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handlePublicStatusRSS",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Public Status RSS",
        "tags": [
          "Other"
        ]
      }
    },
    "/readyz": {
      "get": {
        "description": "No authentication required.",
        "operationId": "handleReadyz",
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {}
              }
            },
            "description": "Successful response. The body shape is not described in this document."
          },
          "4XX": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Client error."
          },
          "default": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            },
            "description": "Error response."
          }
        },
        "security": [],
        "summary": "Readyz",
        "tags": [
          "System"
        ]
      }
    }
  },
  "servers": [
    {
      "description": "Your own control plane. There is no hosted API.",
      "url": "https://{host}",
      "variables": {
        "host": {
          "default": "control-plane.example.com"
        }
      }
    }
  ],
  "tags": [
    {
      "description": "Routes in the AI Models / GPUs group.",
      "name": "AI Models / GPUs"
    },
    {
      "description": "Routes in the Alerts / Scheduled Tasks / Feature Flags / Notification Channels group.",
      "name": "Alerts / Scheduled Tasks / Feature Flags / Notification Channels"
    },
    {
      "description": "Routes in the App Storage / Database Attach group.",
      "name": "App Storage / Database Attach"
    },
    {
      "description": "Routes in the App Volume Backups / Restore group.",
      "name": "App Volume Backups / Restore"
    },
    {
      "description": "Routes in the Apps CRUD / Lifecycle / Deploy group.",
      "name": "Apps CRUD / Lifecycle / Deploy"
    },
    {
      "description": "Routes in the Audit Log / Log Drain group.",
      "name": "Audit Log / Log Drain"
    },
    {
      "description": "Routes in the Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth group.",
      "name": "Auth / 2FA / Users / Roles / IAM / Device Auth / OAuth"
    },
    {
      "description": "Routes in the Built-in Container Registry group.",
      "name": "Built-in Container Registry"
    },
    {
      "description": "Routes in the Database Backups / Restore / Clone Restore group.",
      "name": "Database Backups / Restore / Clone Restore"
    },
    {
      "description": "Routes in the Databases CRUD / Engines / Resources group.",
      "name": "Databases CRUD / Engines / Resources"
    },
    {
      "description": "Routes in the Git Provider Apps group.",
      "name": "Git Provider Apps"
    },
    {
      "description": "Routes in the Ingress / Certificates / Domains / Email / Cloudflare group.",
      "name": "Ingress / Certificates / Domains / Email / Cloudflare"
    },
    {
      "description": "Routes in the Nodes group.",
      "name": "Nodes"
    },
    {
      "description": "Routes in the Other group.",
      "name": "Other"
    },
    {
      "description": "Routes in the Projects / Organizations / Environments group.",
      "name": "Projects / Organizations / Environments"
    },
    {
      "description": "Routes in the Secrets / Git Source / Webhooks / Preview Environments group.",
      "name": "Secrets / Git Source / Webhooks / Preview Environments"
    },
    {
      "description": "Routes in the Static Sites / Backup Targets / Registry Credentials group.",
      "name": "Static Sites / Backup Targets / Registry Credentials"
    },
    {
      "description": "Routes in the System group.",
      "name": "System"
    },
    {
      "description": "Routes in the Telemetry group.",
      "name": "Telemetry"
    }
  ]
}