{"openapi":"3.1.0","info":{"title":"Resilience Platform v1 security and routing contract","version":"2026-09-22","description":"Partial contract: runtime route and permission coverage. Not a complete payload schema or independent security attestation."},"servers":[{"url":"https:\/\/resilience.amartens.com"}],"paths":{"\/api\/v1\/compliance-status":{"get":{"summary":"GET \/api\/v1\/compliance-status","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"shared-reference-data","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"frameworks":{"type":"object","properties":{"dora":{"type":"object","properties":{"framework":{"type":"string"},"compliance_percentage":{"type":"number","minimum":0,"maximum":100},"status":{"type":"string"},"effective_date":{"type":"string"},"total_measures":{"type":"integer","minimum":0},"total_controls":{"type":"integer","minimum":0},"total_requirements":{"type":"integer","minimum":0},"maturity_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"review_status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"implementation_level_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"themes":{"type":"array","items":{"type":"object","properties":{"theme":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["theme","count","compliant","compliance_percentage"],"additionalProperties":true}},"sections":{"type":"array","items":{"type":"object","properties":{"section":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["section","count","compliant","compliance_percentage"],"additionalProperties":true}},"domains":{"type":"array","items":{"type":"object","properties":{"domain":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["domain","count","compliant","compliance_percentage"],"additionalProperties":true}},"requirements":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"article":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"status":{"type":"string"},"deadline":{"type":"string"},"responsible":{"type":"string"},"evidence_required":{"type":"boolean"}},"required":["id","article","title","description","status","deadline","responsible","evidence_required"],"additionalProperties":true}}},"required":["framework","compliance_percentage","status"],"additionalProperties":true},"marisk":{"type":"object","properties":{"framework":{"type":"string"},"compliance_percentage":{"type":"number","minimum":0,"maximum":100},"status":{"type":"string"},"effective_date":{"type":"string"},"total_measures":{"type":"integer","minimum":0},"total_controls":{"type":"integer","minimum":0},"total_requirements":{"type":"integer","minimum":0},"maturity_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"review_status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"implementation_level_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"themes":{"type":"array","items":{"type":"object","properties":{"theme":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["theme","count","compliant","compliance_percentage"],"additionalProperties":true}},"sections":{"type":"array","items":{"type":"object","properties":{"section":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["section","count","compliant","compliance_percentage"],"additionalProperties":true}},"domains":{"type":"array","items":{"type":"object","properties":{"domain":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["domain","count","compliant","compliance_percentage"],"additionalProperties":true}},"requirements":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"article":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"status":{"type":"string"},"deadline":{"type":"string"},"responsible":{"type":"string"},"evidence_required":{"type":"boolean"}},"required":["id","article","title","description","status","deadline","responsible","evidence_required"],"additionalProperties":true}}},"required":["framework","compliance_percentage","status"],"additionalProperties":true},"iso_27001":{"type":"object","properties":{"framework":{"type":"string"},"compliance_percentage":{"type":"number","minimum":0,"maximum":100},"status":{"type":"string"},"effective_date":{"type":"string"},"total_measures":{"type":"integer","minimum":0},"total_controls":{"type":"integer","minimum":0},"total_requirements":{"type":"integer","minimum":0},"maturity_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"review_status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"implementation_level_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"themes":{"type":"array","items":{"type":"object","properties":{"theme":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["theme","count","compliant","compliance_percentage"],"additionalProperties":true}},"sections":{"type":"array","items":{"type":"object","properties":{"section":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["section","count","compliant","compliance_percentage"],"additionalProperties":true}},"domains":{"type":"array","items":{"type":"object","properties":{"domain":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["domain","count","compliant","compliance_percentage"],"additionalProperties":true}},"requirements":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"article":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"status":{"type":"string"},"deadline":{"type":"string"},"responsible":{"type":"string"},"evidence_required":{"type":"boolean"}},"required":["id","article","title","description","status","deadline","responsible","evidence_required"],"additionalProperties":true}}},"required":["framework","compliance_percentage","status"],"additionalProperties":true},"cra":{"type":"object","properties":{"framework":{"type":"string"},"compliance_percentage":{"type":"number","minimum":0,"maximum":100},"status":{"type":"string"},"effective_date":{"type":"string"},"total_measures":{"type":"integer","minimum":0},"total_controls":{"type":"integer","minimum":0},"total_requirements":{"type":"integer","minimum":0},"maturity_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"review_status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"implementation_level_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"themes":{"type":"array","items":{"type":"object","properties":{"theme":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["theme","count","compliant","compliance_percentage"],"additionalProperties":true}},"sections":{"type":"array","items":{"type":"object","properties":{"section":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["section","count","compliant","compliance_percentage"],"additionalProperties":true}},"domains":{"type":"array","items":{"type":"object","properties":{"domain":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["domain","count","compliant","compliance_percentage"],"additionalProperties":true}},"requirements":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"article":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"status":{"type":"string"},"deadline":{"type":"string"},"responsible":{"type":"string"},"evidence_required":{"type":"boolean"}},"required":["id","article","title","description","status","deadline","responsible","evidence_required"],"additionalProperties":true}}},"required":["framework","compliance_percentage","status"],"additionalProperties":true}},"required":["dora","marisk","iso_27001","cra"],"additionalProperties":true},"overall":{"type":"object","properties":{"average_compliance_percentage":{"type":"number","minimum":0,"maximum":100},"status":{"type":"string"},"frameworks_included":{"type":"integer","minimum":0}},"required":["average_compliance_percentage","status","frameworks_included"],"additionalProperties":true},"generated_at":{"type":"string"}},"required":["generated_at"],"additionalProperties":true,"description":"Shared reference-catalogue aggregates. Legacy compliance field names do not establish institutional compliance, control effectiveness or approval."}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/compliance-status\/cra":{"get":{"summary":"GET \/api\/v1\/compliance-status\/cra","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"shared-reference-data","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"framework":{"type":"string"},"compliance_percentage":{"type":"number","minimum":0,"maximum":100},"status":{"type":"string"},"effective_date":{"type":"string"},"total_measures":{"type":"integer","minimum":0},"total_controls":{"type":"integer","minimum":0},"total_requirements":{"type":"integer","minimum":0},"maturity_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"review_status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"implementation_level_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"themes":{"type":"array","items":{"type":"object","properties":{"theme":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["theme","count","compliant","compliance_percentage"],"additionalProperties":true}},"sections":{"type":"array","items":{"type":"object","properties":{"section":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["section","count","compliant","compliance_percentage"],"additionalProperties":true}},"domains":{"type":"array","items":{"type":"object","properties":{"domain":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["domain","count","compliant","compliance_percentage"],"additionalProperties":true}},"requirements":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"article":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"status":{"type":"string"},"deadline":{"type":"string"},"responsible":{"type":"string"},"evidence_required":{"type":"boolean"}},"required":["id","article","title","description","status","deadline","responsible","evidence_required"],"additionalProperties":true}},"generated_at":{"type":"string"}},"required":["generated_at"],"additionalProperties":true,"description":"Shared reference-catalogue aggregates. Legacy compliance field names do not establish institutional compliance, control effectiveness or approval."}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/compliance-status\/dora":{"get":{"summary":"GET \/api\/v1\/compliance-status\/dora","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"shared-reference-data","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"framework":{"type":"string"},"compliance_percentage":{"type":"number","minimum":0,"maximum":100},"status":{"type":"string"},"effective_date":{"type":"string"},"total_measures":{"type":"integer","minimum":0},"total_controls":{"type":"integer","minimum":0},"total_requirements":{"type":"integer","minimum":0},"maturity_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"review_status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"implementation_level_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"themes":{"type":"array","items":{"type":"object","properties":{"theme":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["theme","count","compliant","compliance_percentage"],"additionalProperties":true}},"sections":{"type":"array","items":{"type":"object","properties":{"section":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["section","count","compliant","compliance_percentage"],"additionalProperties":true}},"domains":{"type":"array","items":{"type":"object","properties":{"domain":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["domain","count","compliant","compliance_percentage"],"additionalProperties":true}},"requirements":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"article":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"status":{"type":"string"},"deadline":{"type":"string"},"responsible":{"type":"string"},"evidence_required":{"type":"boolean"}},"required":["id","article","title","description","status","deadline","responsible","evidence_required"],"additionalProperties":true}},"generated_at":{"type":"string"}},"required":["generated_at"],"additionalProperties":true,"description":"Shared reference-catalogue aggregates. Legacy compliance field names do not establish institutional compliance, control effectiveness or approval."}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/compliance-status\/iso-27001":{"get":{"summary":"GET \/api\/v1\/compliance-status\/iso-27001","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"shared-reference-data","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"framework":{"type":"string"},"compliance_percentage":{"type":"number","minimum":0,"maximum":100},"status":{"type":"string"},"effective_date":{"type":"string"},"total_measures":{"type":"integer","minimum":0},"total_controls":{"type":"integer","minimum":0},"total_requirements":{"type":"integer","minimum":0},"maturity_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"review_status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"implementation_level_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"themes":{"type":"array","items":{"type":"object","properties":{"theme":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["theme","count","compliant","compliance_percentage"],"additionalProperties":true}},"sections":{"type":"array","items":{"type":"object","properties":{"section":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["section","count","compliant","compliance_percentage"],"additionalProperties":true}},"domains":{"type":"array","items":{"type":"object","properties":{"domain":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["domain","count","compliant","compliance_percentage"],"additionalProperties":true}},"requirements":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"article":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"status":{"type":"string"},"deadline":{"type":"string"},"responsible":{"type":"string"},"evidence_required":{"type":"boolean"}},"required":["id","article","title","description","status","deadline","responsible","evidence_required"],"additionalProperties":true}},"generated_at":{"type":"string"}},"required":["generated_at"],"additionalProperties":true,"description":"Shared reference-catalogue aggregates. Legacy compliance field names do not establish institutional compliance, control effectiveness or approval."}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/compliance-status\/marisk":{"get":{"summary":"GET \/api\/v1\/compliance-status\/marisk","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"shared-reference-data","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"framework":{"type":"string"},"compliance_percentage":{"type":"number","minimum":0,"maximum":100},"status":{"type":"string"},"effective_date":{"type":"string"},"total_measures":{"type":"integer","minimum":0},"total_controls":{"type":"integer","minimum":0},"total_requirements":{"type":"integer","minimum":0},"maturity_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"review_status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"implementation_level_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"status_distribution":{"oneOf":[{"type":"object","additionalProperties":{"type":"integer","minimum":0}},{"type":"array","maxItems":0}]},"themes":{"type":"array","items":{"type":"object","properties":{"theme":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["theme","count","compliant","compliance_percentage"],"additionalProperties":true}},"sections":{"type":"array","items":{"type":"object","properties":{"section":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["section","count","compliant","compliance_percentage"],"additionalProperties":true}},"domains":{"type":"array","items":{"type":"object","properties":{"domain":{"type":"string"},"count":{"type":"integer","minimum":0},"compliant":{"type":"integer","minimum":0},"compliance_percentage":{"type":"number","minimum":0,"maximum":100}},"required":["domain","count","compliant","compliance_percentage"],"additionalProperties":true}},"requirements":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"article":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"status":{"type":"string"},"deadline":{"type":"string"},"responsible":{"type":"string"},"evidence_required":{"type":"boolean"}},"required":["id","article","title","description","status","deadline","responsible","evidence_required"],"additionalProperties":true}},"generated_at":{"type":"string"}},"required":["generated_at"],"additionalProperties":true,"description":"Shared reference-catalogue aggregates. Legacy compliance field names do not establish institutional compliance, control effectiveness or approval."}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/compliance-timeline":{"get":{"summary":"GET \/api\/v1\/compliance-timeline","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"platform-wide","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"milestones":{"type":"array","items":{"type":"object","properties":{"date":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"category":{"type":"string"},"impact":{"type":"string"},"status":{"type":"string"},"source":{"type":"string"},"reference":{"type":"string"}},"required":["date","title"],"additionalProperties":true}}},"required":["milestones"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/compliance-timeline\/sync":{"post":{"summary":"POST \/api\/v1\/compliance-timeline\/sync","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":"write","x-data-scope":"platform-wide","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"status":{"type":"string"},"milestones_count":{"type":"integer"},"updated":{"type":"integer"},"added":{"type":"integer"}},"required":["status","milestones_count","updated","added"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"requestBody":{"required":true,"content":{"application\/json":{"schema":{"type":"object","required":["milestones"],"properties":{"milestones":{"type":"array","minItems":1,"items":{"type":"object","required":["date","title","description","category","impact","status","source","reference"],"properties":{"date":{"type":"string","format":"date"},"title":{"type":"string","maxLength":255},"description":{"type":"string"},"category":{"type":"string","enum":["regulatory"]},"impact":{"type":"string","enum":["critical","high","medium","low"]},"status":{"type":"string","enum":["pending"]},"source":{"type":"string","enum":["EBA","ESMA","EIOPA","ECB","SSM","BaFin","EU-Kommission","BSI","Bundesbank","EU-Parlament","EU-Rat"]},"reference":{"type":"string","format":"uri"}}}}}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/concentration-risk\/analyze":{"post":{"summary":"POST \/api\/v1\/concentration-risk\/analyze","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":"write","x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"status":{"type":"string"},"analyses_count":{"type":"integer"},"breaches":{"type":"integer"},"analyses":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"dimension":{"type":"string"},"dimension_value":{"type":"string"},"severity":{"type":"string"},"critical_service_count":{"type":"integer"},"total_critical_services":{"type":"integer"},"concentration_pct":{"type":"string","pattern":"^-?[0-9]+\\.[0-9]$"},"threshold_pct":{"type":"string","pattern":"^-?[0-9]+\\.[0-9]$"},"breached":{"type":"boolean"}},"required":["id","dimension","dimension_value","severity","critical_service_count","total_critical_services","concentration_pct","threshold_pct"],"additionalProperties":true}}},"required":["status","analyses_count","breaches","analyses"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/concentration-risk\/breaches":{"get":{"summary":"GET \/api\/v1\/concentration-risk\/breaches","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"has_breaches":{"type":"boolean"},"breach_count":{"type":"integer"},"latest_analysis_date":{"type":["string","null"]},"thresholds":{"type":"object","additionalProperties":true},"breaches":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"dimension":{"type":"string"},"dimension_value":{"type":"string"},"severity":{"type":"string"},"critical_service_count":{"type":"integer"},"total_critical_services":{"type":"integer"},"concentration_pct":{"type":"string","pattern":"^-?[0-9]+\\.[0-9]$"},"threshold_pct":{"type":"string","pattern":"^-?[0-9]+\\.[0-9]$"},"breached":{"type":"boolean"}},"required":["id","dimension","dimension_value","severity","critical_service_count","total_critical_services","concentration_pct","threshold_pct"],"additionalProperties":true}}},"required":["has_breaches","breach_count","latest_analysis_date","thresholds","breaches"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/concentration-risk\/latest":{"get":{"summary":"GET \/api\/v1\/concentration-risk\/latest","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"status":{"type":"string"},"analyses":{"oneOf":[{"type":"array","maxItems":0},{"type":"object","additionalProperties":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"dimension":{"type":"string"},"dimension_value":{"type":"string"},"severity":{"type":"string"},"critical_service_count":{"type":"integer"},"total_critical_services":{"type":"integer"},"concentration_pct":{"type":"string","pattern":"^-?[0-9]+\\.[0-9]$"},"threshold_pct":{"type":"string","pattern":"^-?[0-9]+\\.[0-9]$"},"breached":{"type":"boolean"}},"required":["id","dimension","dimension_value","severity","critical_service_count","total_critical_services","concentration_pct","threshold_pct"],"additionalProperties":true}}}]}},"required":["status","analyses"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/concentration-risk\/thresholds":{"get":{"summary":"GET \/api\/v1\/concentration-risk\/thresholds","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"review_frequency_days":{"type":"integer"},"enabled":{"type":"boolean"},"provider_concentration_pct":{"type":"integer"},"sector_concentration_pct":{"type":"integer"},"regional_concentration_pct":{"type":"integer"},"technology_concentration_pct":{"type":"integer"}},"required":["review_frequency_days","enabled","provider_concentration_pct","sector_concentration_pct","regional_concentration_pct","technology_concentration_pct"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"},"patch":{"summary":"PATCH \/api\/v1\/concentration-risk\/thresholds","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":"write","x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"status":{"type":"string"},"thresholds":{"type":"object","properties":{"review_frequency_days":{"type":"integer"},"enabled":{"type":"boolean"},"provider_concentration_pct":{"type":"integer"},"sector_concentration_pct":{"type":"integer"},"regional_concentration_pct":{"type":"integer"},"technology_concentration_pct":{"type":"integer"}},"required":["review_frequency_days","enabled","provider_concentration_pct","sector_concentration_pct","regional_concentration_pct","technology_concentration_pct"],"additionalProperties":true}},"required":["status","thresholds"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"requestBody":{"required":true,"content":{"application\/json":{"schema":{"type":"object","properties":{"provider_concentration_pct":{"type":"integer","minimum":1,"maximum":100},"sector_concentration_pct":{"type":"integer","minimum":1,"maximum":100},"regional_concentration_pct":{"type":"integer","minimum":1,"maximum":100},"technology_concentration_pct":{"type":"integer","minimum":1,"maximum":100},"review_frequency_days":{"type":"integer","minimum":30,"maximum":730},"enabled":{"type":["boolean","integer","string"],"enum":[true,false,0,1,"0","1"]}}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/dora\/measures":{"get":{"summary":"GET \/api\/v1\/dora\/measures","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"shared-reference-data","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"measure_id":{"type":["string","null"]},"title":{"type":["string","null"]},"theme":{"type":["string","null"]},"requirement_type":{"type":["string","null"]},"control_objective":{"type":["string","null"]},"target_state":{"type":["string","null"]},"dora_reference":{"type":["string","null"]},"marisk_reference":{"type":["string","null"]},"maturity":{"type":["string","null"]},"review_status":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"implementation_steps":{"type":["array","null"],"items":{"type":"string"}},"evidence_examples":{"type":["array","null"],"items":{"type":"string"}},"iso_control_anchors":{"type":["array","null"],"items":{"type":"string"}}},"required":["id"],"additionalProperties":true}},"current_page":{"type":"integer"},"last_page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"},"from":{"type":["integer","null"]},"to":{"type":["integer","null"]},"next_page_url":{"type":["string","null"]},"prev_page_url":{"type":["string","null"]},"links":{"type":"array","items":{"type":"object","additionalProperties":true}},"path":{"type":"string"}},"required":["data","current_page","per_page","total"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/dora\/measures\/{id}":{"get":{"summary":"GET \/api\/v1\/dora\/measures\/{id}","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"shared-reference-data","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"id":{"type":"integer"},"measure_id":{"type":["string","null"]},"title":{"type":["string","null"]},"theme":{"type":["string","null"]},"requirement_type":{"type":["string","null"]},"control_objective":{"type":["string","null"]},"target_state":{"type":["string","null"]},"dora_reference":{"type":["string","null"]},"marisk_reference":{"type":["string","null"]},"maturity":{"type":["string","null"]},"review_status":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"implementation_steps":{"type":["array","null"],"items":{"type":"string"}},"evidence_examples":{"type":["array","null"],"items":{"type":"string"}},"iso_control_anchors":{"type":["array","null"],"items":{"type":"string"}}},"required":["id"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"x-response-contract":"extensible-envelope"}},"\/api\/v1\/findings":{"get":{"summary":"GET \/api\/v1\/findings","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"description":{"type":["string","null"]},"severity":{"type":["string","null"]},"classification":{"type":["string","null"]},"root_cause":{"type":["string","null"]},"status":{"type":["string","null"]},"source":{"type":["string","null"]},"fingerprint":{"type":["string","null"]},"owner_role":{"type":["string","null"]},"due_date":{"type":["string","null"]},"regulatory_reference":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"sla_related":{"type":["boolean","null"]},"metadata":{"type":["object","array","null"],"additionalProperties":true},"test_case":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"objective":{"type":["string","null"]},"scope":{"type":["string","null"]},"frequency":{"type":["string","null"]},"trigger_source":{"type":["string","null"]},"owner_role":{"type":["string","null"]},"tester_type":{"type":["string","null"]},"independence_statement":{"type":["string","null"]},"status":{"type":["string","null"]},"review_status":{"type":["string","null"]},"planned_start_date":{"type":["string","null"]},"planned_end_date":{"type":["string","null"]},"actual_start_date":{"type":["string","null"]},"actual_end_date":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]}},"required":["id"],"additionalProperties":true},{"type":"null"}]}},"required":["id"],"additionalProperties":true}},"current_page":{"type":"integer"},"last_page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"},"from":{"type":["integer","null"]},"to":{"type":["integer","null"]},"next_page_url":{"type":["string","null"]},"prev_page_url":{"type":["string","null"]},"links":{"type":"array","items":{"type":"object","additionalProperties":true}},"path":{"type":"string"}},"required":["data","current_page","per_page","total"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/findings\/{id}":{"get":{"summary":"GET \/api\/v1\/findings\/{id}","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"description":{"type":["string","null"]},"severity":{"type":["string","null"]},"classification":{"type":["string","null"]},"root_cause":{"type":["string","null"]},"status":{"type":["string","null"]},"source":{"type":["string","null"]},"fingerprint":{"type":["string","null"]},"owner_role":{"type":["string","null"]},"due_date":{"type":["string","null"]},"regulatory_reference":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"sla_related":{"type":["boolean","null"]},"metadata":{"type":["object","array","null"],"additionalProperties":true},"test_case":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"objective":{"type":["string","null"]},"scope":{"type":["string","null"]},"frequency":{"type":["string","null"]},"trigger_source":{"type":["string","null"]},"owner_role":{"type":["string","null"]},"tester_type":{"type":["string","null"]},"independence_statement":{"type":["string","null"]},"status":{"type":["string","null"]},"review_status":{"type":["string","null"]},"planned_start_date":{"type":["string","null"]},"planned_end_date":{"type":["string","null"]},"actual_start_date":{"type":["string","null"]},"actual_end_date":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]}},"required":["id"],"additionalProperties":true},{"type":"null"}]}},"required":["id"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"x-response-contract":"extensible-envelope"}},"\/api\/v1\/keys":{"post":{"summary":"POST \/api\/v1\/keys","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":"manage_keys","x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"key":{"type":"string"},"permissions":{"type":"array","items":{"type":"string"}},"expires_at":{"type":["string","null"]}},"required":["id","name","key","permissions","expires_at"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"requestBody":{"required":true,"content":{"application\/json":{"schema":{"type":"object","required":["name"],"properties":{"name":{"type":"string","maxLength":255},"redirect_to":{"type":["string","null"],"enum":["profile","api-keys",null]}}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/programmes":{"get":{"summary":"GET \/api\/v1\/programmes","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"scope_summary":{"type":["string","null"]},"risk_based_approach":{"type":["string","null"]},"proportionality_rationale":{"type":["string","null"]},"status":{"type":["string","null"]},"review_status":{"type":["string","null"]},"approved_at":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"year":{"type":["integer","null"]},"test_cases_count":{"type":"integer"},"test_cases":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"objective":{"type":["string","null"]},"scope":{"type":["string","null"]},"frequency":{"type":["string","null"]},"trigger_source":{"type":["string","null"]},"owner_role":{"type":["string","null"]},"tester_type":{"type":["string","null"]},"independence_statement":{"type":["string","null"]},"status":{"type":["string","null"]},"review_status":{"type":["string","null"]},"planned_start_date":{"type":["string","null"]},"planned_end_date":{"type":["string","null"]},"actual_start_date":{"type":["string","null"]},"actual_end_date":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]}},"required":["id"],"additionalProperties":true}},"approver":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"email":{"type":"string"}},"required":["id"],"additionalProperties":true},{"type":"null"}]}},"required":["id"],"additionalProperties":true}},"current_page":{"type":"integer"},"last_page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"},"from":{"type":["integer","null"]},"to":{"type":["integer","null"]},"next_page_url":{"type":["string","null"]},"prev_page_url":{"type":["string","null"]},"links":{"type":"array","items":{"type":"object","additionalProperties":true}},"path":{"type":"string"}},"required":["data","current_page","per_page","total"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/programmes\/{id}":{"get":{"summary":"GET \/api\/v1\/programmes\/{id}","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"scope_summary":{"type":["string","null"]},"risk_based_approach":{"type":["string","null"]},"proportionality_rationale":{"type":["string","null"]},"status":{"type":["string","null"]},"review_status":{"type":["string","null"]},"approved_at":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"year":{"type":["integer","null"]},"test_cases_count":{"type":"integer"},"test_cases":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"objective":{"type":["string","null"]},"scope":{"type":["string","null"]},"frequency":{"type":["string","null"]},"trigger_source":{"type":["string","null"]},"owner_role":{"type":["string","null"]},"tester_type":{"type":["string","null"]},"independence_statement":{"type":["string","null"]},"status":{"type":["string","null"]},"review_status":{"type":["string","null"]},"planned_start_date":{"type":["string","null"]},"planned_end_date":{"type":["string","null"]},"actual_start_date":{"type":["string","null"]},"actual_end_date":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]}},"required":["id"],"additionalProperties":true}},"approver":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"email":{"type":"string"}},"required":["id"],"additionalProperties":true},{"type":"null"}]}},"required":["id"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"x-response-contract":"extensible-envelope"}},"\/api\/v1\/test-cases":{"get":{"summary":"GET \/api\/v1\/test-cases","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"objective":{"type":["string","null"]},"scope":{"type":["string","null"]},"frequency":{"type":["string","null"]},"trigger_source":{"type":["string","null"]},"owner_role":{"type":["string","null"]},"tester_type":{"type":["string","null"]},"independence_statement":{"type":["string","null"]},"status":{"type":["string","null"]},"review_status":{"type":["string","null"]},"planned_start_date":{"type":["string","null"]},"planned_end_date":{"type":["string","null"]},"actual_start_date":{"type":["string","null"]},"actual_end_date":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"test_programme":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"scope_summary":{"type":["string","null"]},"risk_based_approach":{"type":["string","null"]},"proportionality_rationale":{"type":["string","null"]},"status":{"type":["string","null"]},"review_status":{"type":["string","null"]},"approved_at":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"year":{"type":["integer","null"]},"test_cases_count":{"type":"integer"}},"required":["id"],"additionalProperties":true},{"type":"null"}]},"test_type":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"code":{"type":["string","null"]}},"required":["id"],"additionalProperties":true},{"type":"null"}]}},"required":["id"],"additionalProperties":true}},"current_page":{"type":"integer"},"last_page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"},"from":{"type":["integer","null"]},"to":{"type":["integer","null"]},"next_page_url":{"type":["string","null"]},"prev_page_url":{"type":["string","null"]},"links":{"type":"array","items":{"type":"object","additionalProperties":true}},"path":{"type":"string"}},"required":["data","current_page","per_page","total"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/test-cases\/{id}":{"get":{"summary":"GET \/api\/v1\/test-cases\/{id}","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"objective":{"type":["string","null"]},"scope":{"type":["string","null"]},"frequency":{"type":["string","null"]},"trigger_source":{"type":["string","null"]},"owner_role":{"type":["string","null"]},"tester_type":{"type":["string","null"]},"independence_statement":{"type":["string","null"]},"status":{"type":["string","null"]},"review_status":{"type":["string","null"]},"planned_start_date":{"type":["string","null"]},"planned_end_date":{"type":["string","null"]},"actual_start_date":{"type":["string","null"]},"actual_end_date":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"test_programme":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"title":{"type":["string","null"]},"scope_summary":{"type":["string","null"]},"risk_based_approach":{"type":["string","null"]},"proportionality_rationale":{"type":["string","null"]},"status":{"type":["string","null"]},"review_status":{"type":["string","null"]},"approved_at":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"year":{"type":["integer","null"]},"test_cases_count":{"type":"integer"}},"required":["id"],"additionalProperties":true},{"type":"null"}]},"test_type":{"anyOf":[{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"code":{"type":["string","null"]}},"required":["id"],"additionalProperties":true},{"type":"null"}]}},"required":["id"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"x-response-contract":"extensible-envelope"}},"\/api\/v1\/vulnerability-scan\/latest":{"get":{"summary":"GET \/api\/v1\/vulnerability-scan\/latest","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"platform-wide","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"description":"Version-dependent scan report JSON; not a tenant-specific assurance result.","type":["object","array"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/webhooks":{"get":{"summary":"GET \/api\/v1\/webhooks","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":["string","null"]},"channel":{"type":["string","null"]},"url":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"active":{"type":["boolean","null"]},"events":{"type":["array","null"],"items":{"type":"string"}}},"required":["id"],"additionalProperties":true}},"current_page":{"type":"integer"},"last_page":{"type":"integer"},"per_page":{"type":"integer"},"total":{"type":"integer"},"from":{"type":["integer","null"]},"to":{"type":["integer","null"]},"next_page_url":{"type":["string","null"]},"prev_page_url":{"type":["string","null"]},"links":{"type":"array","items":{"type":"object","additionalProperties":true}},"path":{"type":"string"}},"required":["data","current_page","per_page","total"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"x-response-contract":"extensible-envelope"},"post":{"summary":"POST \/api\/v1\/webhooks","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":"write","x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":["string","null"]},"channel":{"type":["string","null"]},"url":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"active":{"type":["boolean","null"]},"events":{"type":["array","null"],"items":{"type":"string"}}},"required":["id"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"requestBody":{"required":true,"content":{"application\/json":{"schema":{"type":"object","properties":{"name":{"type":"string","maxLength":255},"channel":{"type":"string","enum":["slack","teams","email"]},"url":{"type":"string","format":"uri","maxLength":512,"description":"Must also pass the server-side channel destination allowlist."},"events":{"type":"array","minItems":1,"items":{"type":"string","enum":["finding.created","finding.status_changed","test_case.status_changed","deadline.approaching"]}}},"required":["name","channel","url","events"]}}}},"x-response-contract":"extensible-envelope"}},"\/api\/v1\/webhooks\/{webhook}":{"get":{"summary":"GET \/api\/v1\/webhooks\/{webhook}","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":null,"x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":["string","null"]},"channel":{"type":["string","null"]},"url":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"active":{"type":["boolean","null"]},"events":{"type":["array","null"],"items":{"type":"string"}}},"required":["id"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"parameters":[{"name":"webhook","in":"path","required":true,"schema":{"type":"string"}}],"x-response-contract":"extensible-envelope"},"put":{"summary":"PUT \/api\/v1\/webhooks\/{webhook}","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":"write","x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":["string","null"]},"channel":{"type":["string","null"]},"url":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"active":{"type":["boolean","null"]},"events":{"type":["array","null"],"items":{"type":"string"}}},"required":["id"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"parameters":[{"name":"webhook","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application\/json":{"schema":{"type":"object","properties":{"name":{"type":"string","maxLength":255},"channel":{"type":"string","enum":["slack","teams","email"]},"url":{"type":"string","format":"uri","maxLength":512,"description":"Must also pass the server-side channel destination allowlist."},"events":{"type":"array","minItems":1,"items":{"type":"string","enum":["finding.created","finding.status_changed","test_case.status_changed","deadline.approaching"]}},"active":{"type":["boolean","integer","string"],"enum":[true,false,0,1,"0","1"]}}}}}},"x-response-contract":"extensible-envelope"},"patch":{"summary":"PATCH \/api\/v1\/webhooks\/{webhook}","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":"write","x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":["string","null"]},"channel":{"type":["string","null"]},"url":{"type":["string","null"]},"created_at":{"type":["string","null"]},"updated_at":{"type":["string","null"]},"tenant_id":{"type":["integer","null"]},"active":{"type":["boolean","null"]},"events":{"type":["array","null"],"items":{"type":"string"}}},"required":["id"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"parameters":[{"name":"webhook","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application\/json":{"schema":{"type":"object","properties":{"name":{"type":"string","maxLength":255},"channel":{"type":"string","enum":["slack","teams","email"]},"url":{"type":"string","format":"uri","maxLength":512,"description":"Must also pass the server-side channel destination allowlist."},"events":{"type":"array","minItems":1,"items":{"type":"string","enum":["finding.created","finding.status_changed","test_case.status_changed","deadline.approaching"]}},"active":{"type":["boolean","integer","string"],"enum":[true,false,0,1,"0","1"]}}}}}},"x-response-contract":"extensible-envelope"},"delete":{"summary":"DELETE \/api\/v1\/webhooks\/{webhook}","description":"Security and routing contract. Response payload schemas are not yet exhaustively specified. Tenant context is established by the API key. No API-wide idempotency, signed webhook delivery or complete business audit guarantee is asserted.","security":[{"BearerKey":[]},{"HeaderKey":[]}],"x-required-permission":"write","x-data-scope":"api-key-tenant","responses":{"2XX":{"description":"Successful operation; see endpoint documentation for payload.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"],"additionalProperties":true}}}},"401":{"description":"Missing, invalid or expired API key.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"403":{"description":"Insufficient permission.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"404":{"description":"Resource unavailable in the applicable context.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"422":{"description":"Validation failed.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}},"429":{"description":"Rate limit exceeded.","content":{"application\/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"error":{"type":"string"},"errors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"additionalProperties":true}}}}},"parameters":[{"name":"webhook","in":"path","required":true,"schema":{"type":"string"}}],"x-response-contract":"extensible-envelope"}}},"components":{"securitySchemes":{"BearerKey":{"type":"http","scheme":"bearer"},"HeaderKey":{"type":"apiKey","in":"header","name":"X-API-Key"}}}}